malware

QUIETEXIT S1084

Type: malware
Platform: Network Devices
Created: 17 August 2023
Last modified: 15 April 2025

QUIETEXIT is a novel backdoor, based on the open-source Dropbear SSH client-server software, that has been used by APT29 since at least 2021. APT29 has deployed QUIETEXIT on opaque network appliances that typically don't support antivirus or endpoint detection and response tools within a victim environment.[1]

TechniquesBottom 23%

TacticsBottom 12%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S1084

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
Splunk	The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage Command and Control Ingress Tool Transfer Resource Development Obtain Capabilities Tool Command and Control Proxy External Proxy	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	f7e5e792-d907-46c1-a58e-4ff974dc462a
Splunk	This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Initial Access Exploit Public-Facing Application Execution Exploitation for Client Execution Credential Access OS Credential Dumping Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	ec99bb81-c31b-4837-8c7d-1b32aa70b337
Splunk	The following analytic detects internal systems that generate an unusually high volume of intrusion detections within a 30-minute window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Command and Control Application Layer Protocol Execution Command and Scripting Interpreter	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	9f2295a0-0dcb-4a5f-b013-8a6f2a3c11f6
	Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	a80d927d-ac6e-443f-a867-e8d6e3897318
	The PowerShell implementation of DNSCat2 calls nslookup to craft queries. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol DNS Command and Control Data Obfuscation Protocol or Service Impersonation Exfiltration Exfiltration Over C2 Channel	-	high	Cian Heasley	2020-08-08	2023-02-24	b11d75d6-d7c1-11ea-87d0-0242ac130003
	Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	CVE-2015-1641	critical	Florian Roth (Nextron Systems)	2018-02-22	2021-11-27	7993792c-5ce2-4475-a3db-a3a5539827ef
	Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-06-24	—	13c02350-4177-4e45-ac17-cf7ca628ff5e
	Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)	2020-05-26	2026-07-28	d5866ddf-ce8f-4aea-b28e-d96485a20d3d
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.	Emerging	test	-	windows	DNS Server	Command and Control Application Layer Protocol	-	high	Tim Burrell	2020-02-07	2023-01-02	3db10f25-2527-4b79-8d4b-471eb900ee29
	Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Credential Access Exploitation for Credential Access	-	high	Tim Burrell	2020-02-07	2024-11-23	440a56bf-7873-4439-940a-1c8a671073c2
	Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Command and Control Web Service Bidirectional Communication	-	medium	Daniel Koifman (KoifSec)	2025-11-29	—	5bac7a56-da88-4c27-922e-c81e113b20cb
	Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Syma (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Stealth Masquerading Match Legitimate Resource Name or Location	-	critical	Florian Roth (Nextron Systems)	2020-05-20	2023-03-09	3711eee4-a808-4849-8a14-faf733da3612
	Detects SILENTTRINITY stager dll loading activity	Generic	test	image_load	windows	Sysmon	Command and Control Application Layer Protocol	-	high	Aleksey Potapov, oscd.community	2019-10-22	2023-02-17	75c505b1-711d-4f68-a357-8c3fe37dbf2d
	Detects SILENTTRINITY stager use via PE metadata	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol	-	high	Aleksey Potapov, oscd.community	2019-10-22	2023-02-13	03552375-cc2c-4883-bbe4-7958d5a980be
	Detects binaries used by the Lazarus group which use system names but are executed and launched from (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)	2020-06-03	2023-03-10	3f7f5b0b-5b16-476c-a85f-ab477f6dd24b
Splunk	The following analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`. (...)	Generic	stable	process_creation	linux	Sysmon	Command and Control Non-Application Layer Protocol Command and Control Proxy	-	medium	Michael Haag, Splunk, 0xC0FFEEEE, Github Community	2022-07-29	2026-06-04	bd596c22-ad1e-44fc-b242-817253ce8b08
	Adversaries may use a non-application layer protocol for communication between host and C2 server or (...)	Generic	test	ps_classic_start	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Command and Control Non-Application Layer Protocol	-	medium	frack113	2021-07-21	2023-10-27	c5b20776-639a-49bf-94c7-84f912b91c15
	Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic (...)	Generic	test	network_connection	windows	Sysmon	Exfiltration Exfiltration Over C2 Channel Command and Control Proxy External Proxy	-	medium	Florian Roth (Nextron Systems)	2024-05-31	—	07837ab9-60e1-481f-a74d-c31fb496a94c
	Detects the creation of a macro file for Outlook.	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	medium	@ScoubiMtl	2021-04-05	2023-02-08	8c31f563-f9a7-450c-bfa8-35f8f32f1f61
	Detects the modification of Outlook security setting to allow unprompted execution of macros.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	high	@ScoubiMtl	2021-04-05	2023-08-17	e3b50fa5-3c3f-444e-937b-0a99d33731cd
	Detects binaries that use the same name as legitimate sysinternals tools to evade detection. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indirect Command Execution Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	medium	frack113, Swachchhanda Shrawan Poudel (Nextron Systems)	2021-12-20	2025-04-12	7cce6fc8-a07f-4d84-a53e-96e1879843c9
	Detects the execution of msiexec.exe from an uncommon directory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Florian Roth (Nextron Systems)	2019-11-14	2023-02-21	e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144
	Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the au (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	high	Nasreddine Bencherchali (Nextron Systems)	2021-04-05	2023-08-17	396ae3eb-4174-4b9b-880e-dc0364d78a19
	Detects the modification of the wsl.exe binary from its installed location. (...)	Generic	experimental	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	medium	Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-05-05	—	2f400434-01e1-416b-b52c-bb5bfbb9eb78
	Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Stealth System Binary Proxy Execution Rundll32	-	medium	@kostastsale	2024-08-16	—	0ea52357-cd59-4340-9981-c46c7e900428
	Detects execution of Netcat. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Non-Application Layer Protocol	-	high	frack113, Florian Roth (Nextron Systems)	2021-07-21	2023-02-08	e31033fc-33f0-4020-9a16-faf9b31cbf08
	Detects svchost hosting RDP termsvcs communicating with the loopback address	Generic	test	network_connection	windows	WinEventLog Security	Command and Control Proxy Internal Proxy External Proxy Lateral Movement Remote Services Remote Desktop Protocol	-	high	Samir Bousseaden	2019-02-16	2022-09-02	5bed80b6-b3e8-428e-a3ae-d3c757589e41
	Detects two stages of the RedSun post-exploitation process chain that deliver a SYSTEM-level shell to the attacker's interactive session. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Create Process with Token Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost	2026-04-17	—	2ad78473-6978-40f5-b8f1-89c7e1c27a1a
	Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.ex (...)	Emerging	experimental	-	windows	Windows Defender	Defense Impairment Disable or Modify Tools Stealth Masquerading Match Legitimate Resource Name or Location Privilege Escalation, Stealth Process Injection	-	critical	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-17	—	a7c3e5f2-8b1d-4e9a-b6c2-3d7f5e8a9b4c
	Detects the creation of a file named TieringEngineService.exe inside a directory whose path contains (...)	Emerging	experimental	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	critical	Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost	2026-04-17	—	f2e4b7d9-5c3a-4f8b-9e1d-7a6c2b3f4e5d
	Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Masquerade Task or Service Match Legitimate Resource Name or Location Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-05	—	9f8573c9-22b4-40e3-89c1-72bc2b8d49ab
	Detects filename indicators that contain a specific typo seen used by the Small Sieve malware.	Emerging	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)	2023-05-19	—	39466c42-c189-476a-989f-8cdb135c163a
	The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused). (...)	Generic	test	-	-	DNS · Zeek	Command and Control Non-Application Layer Protocol Command and Control Non-Standard Port	-	medium	@neu5ron, SOC Prime Team, Corelight	2021-05-04	2022-11-29	ede05abc-2c9e-4624-9944-9ff17fdc0bf5
	Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	elhoim	2022-04-28	—	5f87308a-0a5b-4623-ae15-d8fa1809bc60
	Detects the execution of suspicious child processes from macOS installer package parent process. (...)	Generic	test	process_creation	macos	-	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter JavaScript	-	medium	Sohan G (D4rkCiph3r)	2023-02-18	—	e0cfaecd-602d-41af-988d-f6ccebb2af26
	Detects the creation of a macro file for Outlook.	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-08	—	117d3d3a-755c-4a61-b23e-9171146d094c
	Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Swachchhanda Shrawan Poudel	2024-08-07	—	be58d2e2-06c8-4f58-b666-b99f6dc3b6cd
	Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Swachchhanda Shrawan Poudel, Elastic (idea)	2023-04-20	2024-12-01	dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c
	Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-05-05	—	88d306e9-8e2d-4025-9768-28757d2732db
	Detects execution of masqueraded wsl.exe binary. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-05-05	—	530576ee-3b62-4bce-9a03-9aac6c61788a
	Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Privilege Escalation, Stealth Process Injection Process Hollowing	-	high	Liran Ravich	2025-11-14	2026-03-23	f17211f1-1f24-4d0c-829f-31e28dc93cdd
	Detects an uncommon svchost parent process	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Florian Roth (Nextron Systems)	2017-08-15	2022-06-28	01d2e2a1-5f09-44f7-9fc1-24faa7479b6d
	Detects the loading of unsigned .node files. (...)	Generic	experimental	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL Stealth Masquerading Match Legitimate Resource Name or Location Execution Shared Modules	-	medium	Jonathan Beierle (@hullabrian)	2025-11-22	2026-08-27	e5f5c693-52d7-4de5-88ae-afbfbce85595
Splunk	The following analytic detects a suspicious process creating or connecting to a potential Qakbot named pipe. (...)	Anomaly	stable	pipe_created	windows	Sysmon	Command and Control Application Layer Protocol	-	medium	Teoderick Contreras, Splunk	2022-10-28	2026-05-13	63a2c15e-9448-43c5-a4a8-9852266aaada
Splunk	The following analytic detects the wermgr.exe process creating or connecting to a named pipe. (...)	Anomaly	stable	pipe_created	windows	Sysmon	Command and Control Application Layer Protocol	-	medium	Teoderick Contreras, Splunk	2022-10-28	2026-08-18	2f3a4092-548b-421c-9caa-84918e1787ef
Splunk	The following analytic detects the use of default or publicly known named pipes associated with the RMX remote admin tool. (...)	Generic	stable	pipe_created	windows	Sysmon	Command and Control Application Layer Protocol	-	medium	Teoderick Contreras, Splunk	2022-06-24	2026-05-13	b62a6040-49f4-47c8-b3f6-fc1adb952a33
Splunk	The following analytic identifies the `finger.exe` utility being spawned with a command line containing an `@` character, indicating a remote host/server was specified. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Command and Control Application Layer Protocol	-	medium	Onur Mustafa Erdogan, Splunk	2026-09-16	2026-09-16	86a5686a-7bc4-469c-9f88-2620279ede6e
Splunk	The following analytic identifies a LOLBAS process being executed outside of it's expected location. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution Rundll32	-	medium	Steven Dick	2024-05-03	2026-09-22	326fdf44-b90c-4d2e-adca-1fd140b10536

Title

Description

QUIETEXIT S1084

QUIETEXIT S1084

QUIETEXIT MITRE reference S1084

Standing S1084

Reach

Coverage

QUIETEXIT detections S1084