malware
Mori is a backdoor that has been used by MuddyWater since at least January 2022.[1][2]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Mori can read data from the Registry including from HKLM\Software\NFC\IPA and
HKLM\Software\NFC\.4
Mori can delete its DLL file and related files by Registry value.5
Mori can communicate using HTTP over IPv4 or IPv6 depending on a flag set.6
Mori can write data to HKLM\Software\NFC\IPA and HKLM\Software\NFC\ and delete Registry values.910
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
44th percentile · 56% of 825 ATT&CK software entries have more Enterprise techniques.
41st percentile · 59% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
66th percentile · 66% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
368 distinct rules cover the 9 techniques recorded for this malware. 228 Sigma · 140 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups. | Hunting | test | file_access | windows | - | - | low | frack113 | 2023-09-15 | 2024-07-29 | 337a31c6-46c4-46be-886a-260d7aa78cac | ||||
Detect set Notification_Suppress to 1 to disable the Windows security center notification | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 0c93308a-3f1b-40a9-b649-57ea1a1c1d63 | ||||
Detect set DisallowRun to 1 to prevent user running specific computer program | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 275641a5-a492-45e2-a817-7c81e9d9d3e9 | ||||
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Detect enable rdp feature to allow specific user to rdp connect on the targeted machine | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b | ||||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects suspicious user agent string of APT40 Dropbox tool | Emerging | test | proxy | - | - | - | high | Thomas Patzke | 2019-11-12 | 2023-05-18 | 5ba715b6-71b7-44fd-8245-f66893e81b3d | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC | 2021-08-26 | 2022-10-09 | ff151c33-45fa-475d-af4f-c2f93571f4fe | ||||
This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS). (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC | 2021-08-26 | 2022-10-09 | 1d2ab8ac-1a01-423b-9c39-001510eae8e8 | ||||
Detects backup catalog deletions | Generic | test | - | windows | WinEventLog Application | - | medium | Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection) | 2017-05-12 | 2022-12-25 | 9703792d-fd9a-456d-a672-ff92efe4806a | ||||
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Detects Bitsadmin connections to IP addresses instead of FQDN names | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2022-06-10 | 2022-08-24 | 8ccd35a2-1c7c-468b-b568-ac6cdf80eec3 | ||||
Detects Bitsadmin connections to domains with uncommon TLDs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Tim Shelton | 2019-03-07 | 2026-09-30 | 9eb68894-7476-4cd6-8752-23b51f5883a7 | ||||
Detects specific windows registry modifications made by BlackByte ransomware variants. (...) | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-01-24 | 2025-10-21 | 83314318-052a-4c90-a1ad-660ece38d276 | ||||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2022-10-09 | c3198a27-23a0-4c2c-af19-e5328d49680e | ||||
Attempts to detect system changes made by Blue Mockingbird | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Trent Liffick (@tliffick) | 2020-05-14 | 2023-08-17 | 92b0b372-a939-44ed-a11b-5136cf680e27 | ||||
Splunk | The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-03-25 | 2026-10-02 | bfe94226-8c10-11eb-a4b3-acde48001122 | |||
Detects HTTP request used by Chafer malware to receive data from its C2. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-01-31 | 2024-02-15 | fb502828-2db0-438e-93e6-801c7548686d | ||||
Detect possible persistence using Fax DLL load when service restart | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-07-17 | 2022-12-30 | 9e3357ba-09d4-4fbd-a7c5-ad6386314513 | ||||
Detect change of the user account associated with the FAX service to avoid the escalation problem. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-07-17 | 2022-12-30 | e3fdf743-f05b-4051-990a-b66919be1743 | ||||
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-23 | 2025-07-18 | d4488827-73af-4f8d-9244-7b7662ef046e | ||||
See what files are being deleted from flash file systems | Generic | test | authentication | - | Cisco AAA · Cisco | - | medium | Austin Clark | 2019-08-12 | 2023-01-04 | 71d65515-c436-43c0-841b-236b1f32c21e | - | |||
Splunk | This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Radka Viskova, Splunk | 2026-09-18 | 2026-09-22 | 6bc88a9d-f7de-4257-b526-acf15bc5a517 | |||
Splunk | The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-09-22 | c43f7b49-2dab-4e76-892e-7f971c2f20f1 | |||
Splunk | The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | f7e5e792-d907-46c1-a58e-4ff974dc462a | |||
Splunk | The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 8c15183e-2e70-4db4-86c3-88f8d9129b66 | |||
Splunk | The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 173a1cb9-1814-4128-a9dc-f29dade89957 | |||
Splunk | The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-06-10 | 2026-05-13 | cd80a6ac-c9d9-11eb-8839-acde48001122 | |||
Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | @SerkinValery, Nasreddine Bencherchali (Nextron Systems) | 2023-06-12 | 2023-08-17 | ac9159cc-c364-4304-8f0a-d63fc1a0aabb | ||||
Detects DNS requests to Cloudflared tunnels domains. (...) | Generic | test | dns | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-12-20 | — | a1d9eec5-33b2-4177-8d24-27fe754d0812 | ||||
Detects suspicious DNS queries known from Cobalt Strike beacons | Generic | test | dns | - | - | - | critical | Florian Roth (Nextron Systems) | 2018-05-10 | 2022-10-09 | 2975af79-28c4-4d2f-a951-9095f229df29 | ||||
Detects Turla ComRAT network communication. | Emerging | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2020-05-26 | 2024-02-26 | 7857f021-007f-4928-8b2c-7aedbe64bb82 | ||||
Detects disabling the CrashDump per registry (as used by HermeticWiper) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Tobias Michalski (Nextron Systems) | 2022-02-24 | 2023-08-17 | 2ff692c2-4594-41ec-8fcb-46587de769e0 | ||||
Detects suspicious user agent strings used by crypto miners in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems) | 2019-10-21 | 2021-11-27 | fa935401-513b-467b-81f4-f9e77aa0dd78 | ||||
Detects execution of curl.exe with custom useragent options | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-23 | 2023-02-21 | 3286d37a-00fd-41c2-a624-a672dcd34e60 | ||||
Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension. (...) | Emerging | test | registry_set | windows | Sysmon · WinEventLog Security | high | EagleEye Team, Florian Roth (Nextron Systems), NVISO | 2020-05-13 | 2024-03-25 | 7ec912f2-5175-4868-b811-ec13ad0f8567 | |||||
Splunk | The following analytic identifies the abuse of Regsvr32.exe to proxy execution of malicious code, specifically detecting the loading of "scrobj.dll" by Regsvr32.exe. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-01-29 | 2026-10-02 | 070e9b80-6252-11eb-ae93-0242ac130002 | |||
Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Dimitrios Slamaris | 2017-05-15 | 2023-08-17 | 9d3436ef-9476-4c43-acca-90ce06bdf33a | ||||
Detects execution of the builtin "rmdir" command in order to delete directories. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113 | 2022-01-15 | 2023-03-07 | 41ca393d-538c-408a-ac27-cf1e038be80c | ||||
Detects registry modifications that change features of internal Windows tools (malware like Agent Te (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113, Nasreddine Bencherchali (Nextron Systems), CrimpSec | 2022-03-18 | 2025-06-04 | e2482f8d-3443-4237-b906-cc145d87a076 | ||||
Splunk | The following analytic detects modifications to the Windows registry aimed at disabling the Registry Editor (regedit). (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-03-31 | 2026-10-02 | cd2cf33c-9201-11eb-a10a-acde48001122 | |||
Detects the addition of a key 'MiniNt' to the registry. (...) | Generic | test | registry_event | windows | Sysmon · WinEventLog Security | - | high | Ilyas Ochkov, oscd.community | 2019-10-25 | 2021-11-27 | 919f2ef0-be2d-4a7a-b635-eb2b41fde044 | ||||
Splunk | The following analytic detects a suspicious registry modification aimed at disabling security audit logs by adding a specific registry entry. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-10-05 | 2026-05-13 | 39ebdc68-25b9-11ec-aec7-acde48001122 | |||
Splunk | The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...) | Anomaly | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-03-31 | 2026-05-13 | 6f3ccfa2-91fe-11eb-8f9b-acde48001122 | |||
Splunk | The following analytic detects a suspicious registry modification aimed at disabling Windows hotkeys for native applications. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-05-07 | 2026-05-13 | 1490f224-ad8b-11eb-8c4f-acde48001122 | |||
Detect set UseActionCenterExperience to 0 to disable the Windows security center notification | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-08-19 | 2023-08-17 | 3ae1a046-f7db-439d-b7ce-b8b366b81fa6 | ||||
Splunk | The following analytic detects modifications to the registry that disable the CMD prompt application. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-03-31 | 2026-10-02 | ff86077c-9212-11eb-a1e6-acde48001122 | |||
Splunk | The following analytic detects registry modifications that disable the Control Panel on Windows systems. (...) | Generic | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-03-31 | 2026-05-13 | 6ae0148e-9215-11eb-a94a-acde48001122 |
42nd percentile · 58% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 9 Enterprise techniques.
Technique Campaign use over its cumulative rule count.