SUGARUSH S1049

Type: malware
Platform: Windows
Created: 4 October 2022
Last modified: 22 October 2025

SUGARUSH is a small custom backdoor that can establish a reverse shell over TCP to a hard coded C2 address. SUGARUSH was first identified during analysis of UNC3890's C0010 campaign targeting Israeli companies, which began in late 2020.[1]

Techniques29th pct

Tactics41st pct

Threat groupsNone recorded

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

SUGARUSH MITRE reference S1049

Internet Connection Discovery T1016.001 ↗

SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.2

Discovery1 detection rules

Windows Command Shell T1059.003 ↗

SUGARUSH has used cmd for execution on an infected host.3

Execution63 detection rules

Non-Application Layer Protocol T1095 ↗

SUGARUSH has used TCP for C2.4

Command and Control4 detection rules

Windows Service T1543.003 ↗

SUGARUSH has created a service named Service1 for persistence.5

Persistence · Privilege Escalation72 detection rules

Non-Standard Port T1571 ↗

SUGARUSH has used port 4585 for a TCP connection to its C2.6

Command and Control9 detection rules

Local Storage Discovery T1680 ↗

MoonWind can obtain the number of drives on the victim machine.7

Discoveryno detection rules

Standing S1049

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques629th pct

29th percentile · 71% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics541st pct

41st percentile · 59% of 825 ATT&CK software entries have more tactics spanned.

Threat groups061% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaign185% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique6.5medBottom 9%

9th percentile · 91% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique5med

SUGARUSH detections S1049

147 distinct rules cover the 6 techniques recorded for this malware. 105 Sigma · 42 Splunk.

5 covered by at least one rule1 with no coverage147 distinct rules in total

Showing 1-50 of 100+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-28	2025-10-22	6c8fbee5-dee8-49bc-851d-c3142d02aa47
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	This method detects malicious services mentioned in APT29 report by FireEye. (...)	Unsupported	unsupported	process_creation	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Thomas Patzke	2017-11-01	2022-03-21	c069f460-2b87-4010-8dcf-e45bab362624
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
Splunk	The following analytic detects any outbound network connection from an endpoint process to a known suspicious or non-standard port. (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Command and Control Non-Standard Port	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	fc32a8d5-bc79-4437-b48f-4646ab7bed9d
Splunk	The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Command and Control Non-Standard Port Privilege Escalation, Stealth Process Injection Command and Control Remote Access Tools Lateral Movement Remote Services	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
Splunk	The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Command and Control Non-Standard Port	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	f26445a8-a6a2-4855-bec0-0c39e52e5b8f
Splunk	The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	CVE-2021-44228	medium	Teoderick Contreras, Bhavin Patel, Splunk	2021-10-21	2026-05-13	54a6ed00-3256-11ec-b031-acde48001122
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	d7a95147-145f-4678-b85d-d1ff4a3bb3f6
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	5a105d34-05fc-401e-8553-272b45c1522d
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	Detects programs that connect to uncommon destination ports	Generic	test	network_connection	windows	Sysmon	Command and Control Non-Standard Port	-	medium	Florian Roth (Nextron Systems)	2017-03-19	2024-03-12	6d8c3d20-a5e1-494f-8412-4571d716cf5c
	detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-14	—	ee5e119b-1f75-4b34-add8-3be976961e39
	Detects the installation of a service named "javamtsup" on the system. (...)	Emerging	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-10-09	cb062102-587e-4414-8efa-dbe3c7bf19c6
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
	Detects suspicious DACL modifications to deny access to a service that affects critical trustees. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Jonhnathan Ribeiro, oscd.community	2020-10-16	2023-02-28	99cf1e02-00fb-4c0d-8375-563f978dfd37
Splunk	The following analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	dcfd6b40-42f9-469d-a433-2e53f7486664	-
Splunk	The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Mauricio Velazco, Splunk	2020-04-29	2026-05-13	b89919ed-fe5f-492c-b139-95dbb162039e
	Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Defense Impairment Disable or Modify Tools	-	high	Matt Anderson, Dray Agha, Anna Pham (Huntress)	2026-01-02	—	85f520e7-6f5e-43ca-874c-222e5bf9c0de
	Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. (...)	Generic	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol DNS Execution Command and Scripting Interpreter Windows Command Shell	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-19	—	c082c2b0-525b-4dbc-9a26-a57dc4692074
	Detects a driver load from a temporary directory	Generic	test	driver_load	windows	Sysmon	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Florian Roth (Nextron Systems)	2017-02-12	2021-11-27	2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75
	Detects Elise backdoor activity used by APT32	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	critical	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2018-01-31	2023-03-09	e507feb7-5f73-4ef6-a970-91bb6f6d744f
	Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability rep (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2020-10189	high	Florian Roth (Nextron Systems)	2020-03-25	2023-01-21	846b866e-2a57-46ee-8e16-85fa92759be7
	Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and Partner (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Privilege Escalation Exploitation for Privilege Escalation Execution, Stealth Hijack Execution Flow	CVE-2019-1378	high	Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro	2019-11-15	2021-11-27	1c373b6d-76ce-4553-997d-8c1da9a6b5f5
	This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Brute Force Execution Command and Scripting Interpreter PowerShell Windows Command Shell Discovery Password Policy Discovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-03-08	42a993dd-bb3e-48c8-b372-4d6684c4106c
	Detects various execution patterns of the CrackMapExec pentesting framework	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Thomas Patzke	2020-05-22	2023-11-06	058f4380-962d-40a5-afce-50207d36d7e2
	Detects the use of Jlaive to execute assemblies in a copied PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)	2022-05-24	2023-02-22	0a99eb3e-1617-41bd-b095-13dc767f3def
	Detects command line parameters used by Koadic hack tool	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic JavaScript	-	high	wagga, Jonhnathan Ribeiro, oscd.community	2020-01-12	2023-02-11	5cddf373-ef00-4112-ad72-960ac29bac34
	Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Execution Native API Stealth System Binary Proxy Execution Rundll32	-	high	Alexander Rausch	2020-06-24	2023-03-01	95022b85-ff2a-49fa-939a-d7b8f56eeb9b
	Detects the launch of a child process via "conhost.exe" with the "--headless" flag. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-07-23	—	00ca75ab-d5ce-43be-b86c-55ff39c6abfc
	Detects a suspicious child process of a Microsoft HTML Help (HH.exe)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic JavaScript Initial Access Phishing Spearphishing Attachment Stealth System Binary Proxy Execution Compiled HTML File Regsvr32 Rundll32 Execution Windows Management Instrumentation	-	high	Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)	2020-04-01	2023-04-12	52cad028-0ff0-4854-8f67-d25dfcbc78b4
Splunk	The following analytic identifies the use of suspicious command-line parameters associated with Impacket tools, such as `wmiexec.py`, `smbexec.py`, `dcomexec.py`, and `atexec.py`, which are used for lateral movement and remote code execution. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Mauricio Velazco, Splunk	2021-11-19	2026-05-13	8ce07472-496f-11ec-ab3b-3e22fbd008af
Splunk	The following analytic identifies suspicious command-line parameters associated with the use of Impacket's smbexec.py for lateral movement. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Michael Haag, Splunk	2023-04-25	2026-05-13	bb3c1bac-6bdf-4aa0-8dc9-068b8b712a76
Splunk	The following analytic detects the use of Impacket's `wmiexec.py` tool for lateral movement by identifying specific command-line parameters. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Michael Haag, Splunk	2021-11-19	2026-10-09	d6e464e4-5c6a-474e-82d2-aed616a3a492
Splunk	The following analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`. (...)	Generic	stable	process_creation	linux	Sysmon	Command and Control Non-Application Layer Protocol Command and Control Proxy	-	medium	Michael Haag, Splunk, 0xC0FFEEEE, Github Community	2022-07-29	2026-06-04	bd596c22-ad1e-44fc-b242-817253ce8b08
	Detects loading of known malicious drivers via their hash.	Generic	test	driver_load	windows	Sysmon	Persistence, Privilege Escalation Create or Modify System Process Windows Service Privilege Escalation Exploitation for Privilege Escalation	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-08-18	2023-12-02	05296024-fe8a-4baf-8f3d-9a5f5624ceb2
	Detects loading of known malicious drivers via the file name of the drivers.	Generic	test	driver_load	windows	Sysmon	Persistence, Privilege Escalation Create or Modify System Process Windows Service Privilege Escalation Exploitation for Privilege Escalation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-03	2023-12-02	39b64854-5497-4b57-a448-40977b8c9679
	Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.	Unsupported	unsupported	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Credential Access OS Credential Dumping Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-03-21	2cfe636e-317a-4bee-9f2c-1066d9f54d1a
	Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	critical	Bhabesh Raj	2021-05-06	2022-11-29	25b9c01c-350d-4b95-bed1-836d04a4f324
	Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. (...)	Emerging	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	critical	Bhabesh Raj	2021-05-06	2023-05-05	a1507d71-0b60-44f6-b17c-bf53220fdd88
	Adversaries may use a non-application layer protocol for communication between host and C2 server or (...)	Generic	test	ps_classic_start	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Command and Control Non-Application Layer Protocol	-	medium	frack113	2021-07-21	2023-10-27	c5b20776-639a-49bf-94c7-84f912b91c15
	Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. (...)	Generic	experimental	network_connection	windows	Sysmon	Command and Control Application Layer Protocol DNS Execution Command and Scripting Interpreter Windows Command Shell	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-19	—	2fdaf50b-9fd5-449f-ba69-f17248119af6
Splunk	The following analytic detects the execution of the `route.exe` Windows application, commonly used for network discovery. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Network Configuration Discovery Internet Connection Discovery	-	medium	Teoderick Contreras, Splunk	2021-11-17	2026-05-13	dd83407e-439f-11ec-ab8e-acde48001122
	Detects creation of a new service (kernel driver) with the type "kernel"	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-07-14	2025-10-07	431a1fdb-4799-4f3b-91c3-a683b003fc49
	Detects PDQDeploy service installation on the target system. (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-07-22	—	b98a10af-1e1e-44a7-bab2-4cc026917648
	Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines. (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-07-22	—	ee9ca27c-9bd7-4cee-9b01-6e906be7cae3
	Detects the creation of a new service using powershell.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	low	Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community	2023-02-20	—	c02e96b7-c63a-4c47-bd83-4a9f74afcfb2