malware

Royal S1073

Type: malware
Platforms: Windows, ESXi
Created: 30 March 2023
Last modified: 21 October 2025

Royal is ransomware that first appeared in early 2022; a version that also targets ESXi servers was later observed in February 2023. Royal employs partial encryption and multiple threads to evade detection and speed encryption. Royal has been used in attacks against multiple industries worldwide--including critical infrastructure. Security researchers have identified similarities in the encryption routines and TTPs used in Royal and Conti attacks and noted a possible connection between their operators.[1][2][3][4][5]

Techniques66th pct

Tactics53rd pct

Threat groupsNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects access to ADMIN$ network share	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	low	Florian Roth (Nextron Systems)	2017-03-04	2024-01-16	098d7118-55bc-4912-a836-dc6483a8d150
Splunk	The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-10-24	2026-05-13	9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
	Detects the use of Advanced IP Scanner. (...)	Generic	test	file_event	windows	Sysmon	Discovery Network Service Discovery	-	medium	@ROxPinTeddy	2020-05-12	2022-11-29	fed85bf9-e075-4280-9159-fbe8a023d6fa
	Detects the deletion of all backups or system state backups via "wbadmin.exe". (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Impact Inhibit System Recovery	-	high	frack113, Nasreddine Bencherchali (Nextron Systems)	2021-12-13	2024-05-10	639c9081-f482-47d3-a0bd-ddee3d4ecd76
	Detects loading of Amsi.dll by uncommon processes	Hunting	test	image_load	windows	Sysmon	Impact Inhibit System Recovery	-	low	frack113	2023-03-12	2026-06-29	facd1549-e416-48e0-b8c4-41d7215eedc8
	Detects a highly relevant Antivirus alert that reports ransomware. (...)	Generic	test	antivirus	-	-	Impact Data Encrypted for Impact	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2022-05-12	2026-06-15	4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
	An application has been removed. (...)	Generic	test	-	windows	WinEventLog Application	Impact Service Stop	-	low	frack113	2022-01-28	2022-09-17	570ae5ec-33dc-427c-b815-db86228ad43e
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Patrick Bareiss, Splunk	2020-10-27	2026-05-13	16ae9076-d1d5-411c-8fdd-457504b33dac
Splunk	The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	f32598bb-fa5f-4afd-8ab3-0263cc28efbc
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	The following analytic detects the creation of AWS KMS keys with an encryption policy accessible to everyone, including external entities. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	c79c164f-4b21-4847-98f9-cf6a9f49179e
Splunk	The following analytic identifies users with KMS keys performing encryption operations on S3 buckets. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact	-	medium	Rod Soto, Patrick Bareiss Splunk	2020-10-27	2026-05-13	884a5f59-eec7-4f4a-948b-dbde18225fdc
Splunk	The following analytic detects when AWS S3 bucket versioning is suspended by a user. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Bhavin Patel, Splunk	2023-05-01	2026-05-13	657902a9-987d-4879-a1b2-e7a65512824b
	Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Impact Data Manipulation	-	medium	Sittikorn S	2021-06-29	2021-08-20	16124c2d-e40b-4fcc-8f2c-5ab7870a2223
	Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Encrypted for Impact Resource Development Stage Capabilities Install Digital Certificate	-	high	toopricey	2025-10-18	—	1279262f-1464-422f-ac0d-5b545320c526
	Detects when S3 bucket versioning is disabled. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Inhibit System Recovery	-	medium	Sean Johnstone \| Unit 42	2023-10-28	—	a136ac98-b2bc-4189-a14d-f0d0388e57a7
	Identifies when a application is deleted in Azure.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-09-03	2026-04-30	410d2a41-1e6d-452f-85e5-abdd8257a823
	Detects when a Container Registry is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	93e0ef48-37c8-49ed-a02c-038aab23628e
	Detects when a Azure Kubernetes Cluster is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	9541f321-7cba-4b43-80fc-fbd1fb922808
	Identifies when a Azure Kubernetes network policy is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	08d6ac24-c927-4469-b3b7-2e422d6e3c43
	Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	25cb259b-bbdc-4b87-98b7-90d7c72f8743
	Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	7ee0b4aa-d8d4-4088-b661-20efdf41a04c
	Identifies when ClusterRoles/Roles are being modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	818fee0c-e0ec-4e45-824e-83e4817b0887
	Identifies when a service account is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Account Access Removal Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	12d027c3-b48c-4d9d-8bb6-a732200034b2
	Detects deletion of files with extensions often used for backup files. (...)	Generic	test	file_delete	windows	Sysmon	Impact Inhibit System Recovery	-	medium	frack113	2022-01-02	2023-02-15	06125661-3814-4e03-bfa2-1e4411c60ac3
Splunk	The following analytic detects the execution of a suspicious `bcdedit` command that reconfigures a host from safe mode back to normal boot. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Teoderick Contreras, Splunk	2021-09-07	2026-05-13	dc7a8004-0f18-11ec-8c54-acde48001122
Splunk	The following analytic detects modifications to the Windows error recovery boot configurations using bcdedit.exe with flags such as "recoveryenabled" and "no". (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Michael Haag, Splunk	2021-01-11	2026-10-02	809b31d2-5462-11eb-ae93-0242ac130002
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
	Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.	Emerging	test	file_event	windows	WinEventLog Security	Impact Data Encrypted for Impact	-	high	j4son	2023-05-23	—	eee8311f-a752-44f0-bf2f-6b007db16300
	Detects the use of the bcdedit command to tamper with the boot configuration data. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Impact Inhibit System Recovery	-	high	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2023-02-15	1444443e-6757-43e4-9ea4-c8fc705f79a2
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
Splunk	The following analytic detects the execution of a suspicious `bcdedit` command that configures a host to boot in safe mode with network support. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Impact Inhibit System Recovery	-	medium	Teoderick Contreras, Splunk	2021-09-07	2026-05-13	81f1dce0-0f18-11ec-a5d7-acde48001122
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
	Modifications to a config that will serve an adversary's impacts or persistence	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Data Manipulation Transmitted Data Manipulation Impact Inhibit System Recovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Persistence Server Software Component	-	medium	Austin Clark	2019-08-12	2025-04-28	671ffc77-50a7-464f-9e3d-9ea2b493b26b	-
Splunk	This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Reconnaissance Gather Victim Network Information IP Addresses Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali, Splunk, Janantha Marasinghe	2025-07-01	2026-09-22	568cb83e-d79e-4a23-85ec-6e1f6c30cb2f
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
	Detects the use of the redirection character ">" to redirect information on the command line. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-22	2024-03-19	4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	d7a95147-145f-4678-b85d-d1ff4a3bb3f6
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	5a105d34-05fc-401e-8553-272b45c1522d
	Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	746c86fb-ccda-4816-8997-01386263acc4
	Detects a copy command or a copy utility execution to or from an Admin share or remote	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Network Shared Drive Exfiltration Exfiltration Over Alternative Protocol Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali	2019-12-30	2025-10-22	855bc8b5-2ae8-402e-a9ed-b889e6df1900
	Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to co (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Impact Inhibit System Recovery	-	high	Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)	2021-08-09	2023-03-07	c73124a7-3e89-44a3-bdc1-25fe4df754b1
	Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability a (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution Initial Access Phishing	CVE-2021-33771 CVE-2021-31979	critical	Sittikorn S, frack113	2021-07-16	2023-08-17	32b5db62-cb5f-4266-9639-0fa48376ac00
	Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability a (...)	Emerging	test	file_event	windows	Sysmon	Execution Exploitation for Client Execution Initial Access Phishing	CVE-2021-33771 CVE-2021-31979	critical	Sittikorn S	2021-07-16	2022-10-09	ad7085ac-92e4-4b76-8ce2-276d2c0e68ef

Title

Description

Royal S1073

Royal S1073

Royal MITRE reference S1073

Royal MITRE reference S1073

Standing S1073

Reach

Coverage

Royal detections S1073