tool
AsyncRAT is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.[1][2][3]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
AsyncRAT can enumerate the NetBIOS name on targeted machines.4
AsyncRAT can check if the current user of a compromised system is an administrator. 5
AsyncRAT can create a scheduled task to maintain persistence on system start-up.6
AsyncRAT can examine running processes to determine if a debugger is present.8
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
80th percentile · 80% of 825 ATT&CK software entries have this many Enterprise techniques or fewer.
89th percentile · 89% of 825 ATT&CK software entries have this many tactics spanned or fewer.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
16th percentile · 84% of 825 ATT&CK software entries have more detection rules per technique.
55th percentile · 55% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
23rd percentile · 77% of 825 ATT&CK software entries have more mitigations per technique.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 20 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
514 distinct rules cover the 20 techniques recorded for this tool. 331 Sigma · 183 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Detects DNS queries made by "AppInstaller.EXE". (...) | Generic | test | dns | windows | Sysmon | - | medium | frack113 | 2021-11-24 | 2023-11-09 | 7cff77e1-9663-46a3-8260-17f2e1aa9d0a | ||||
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Victor Sergeev, oscd.community | 2020-10-09 | 2023-10-18 | eee00933-a761-4cd0-be70-c42fe91731e7 | ||||
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Sreeman | 2020-03-13 | 2022-04-14 | 24de4f3b-804c-4165-b442-5a06a2302c7e | ||||
Detects changes to the EC2 instance startup script. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | high | faloker | 2020-02-12 | 2022-06-07 | 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df | ||||
Detects file creation events linked to the Axios NPM supply chain compromise. (...) | Emerging | experimental | file_event | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | b7cb840c-11f6-47f7-b3ef-5524739c9077 | ||||
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...) | Emerging | experimental | file_event | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 2db0458c-05c9-4069-a26f-77becd9c8c13 | ||||
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...) | Emerging | experimental | process_creation | linux | Sysmon | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 0a23a62d-c5b3-468b-a072-25064a9a8c87 | ||||
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup. | Emerging | experimental | process_creation | macos | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | a09ee860-31b3-4586-8a68-0ebd74ce0e5f | ||||
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...) | Emerging | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | f6c27ecc-d890-4452-80e6-2e274a10e097 | ||||
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...) | Emerging | experimental | dns | - | - | - | high | Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-04-01 | — | 73e5d24f-493f-4092-bd2f-c72cabda40ee | ||||
Splunk | The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...) | Anomaly | stable | file_event | windows | Sysmon | - | medium | Steven Dick, Michael Haag, Rico Valdez, Splunk | 2020-04-29 | 2026-07-02 | 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 | - | ||
Splunk | The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Sittikorn S | 2021-03-30 | 2026-10-02 | 80630ff4-8e4c-11eb-aab5-acde48001122 | |||
detects BPFDoor .lock and .pid files access in temporary file storage facility | Generic | test | file_event | linux | Linux Auditd | - | high | Rafal Piasecki | 2022-08-10 | 2026-03-30 | 808146b2-9332-4d78-9416-d7e47012d83d | ||||
Detects execution of Chromium based browser in headless mode | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems) | 2023-09-12 | — | ef9dcfed-690c-4c5d-a9d1-482cd422225c | ||||
Splunk | The following analytic identifies the execution of the "whoami" command with the "/group" flag, where the results are passed to the "find" command in order to look for a the string "12288". (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Teoderick Contreras, Splunk | 2021-09-14 | 2026-05-13 | a9079b18-1633-11ec-859c-acde48001122 | - | ||
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | high | Florian Roth (Nextron Systems), MSTI (query) | 2022-10-01 | — | fa3c117a-bc0d-416e-a31b-0c0e80653efb | |||||
Detects execution of ChromeLoader malware via a registered scheduled task | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | @kostastsale | 2022-01-10 | — | 0a74c5a9-1b71-4475-9af2-7829d320d5c2 | ||||
Find information about network devices that is not stored in config files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 9705a6a1-6db6-4a16-a987-15b7151e299b | ||||
Splunk | This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...) | Anomaly | stable | network_device | - | Cisco IOS · Cisco | - | medium | Nasreddine Bencherchali | 2026-05-19 | 2026-05-20 | 71ac5328-2364-40cf-8381-92b8dc531399 | |||
Splunk | The following analytic detects the execution of curl commands with insecure flags within the Cisco Isovalent environment. (...) | Anomaly | stable | process_creation | - | Cisco | - | medium | Bhavin Patel, Splunk | 2026-01-05 | 2026-10-02 | c16c4899-d3f7-461b-92c2-cc0ef5758855 | |||
Splunk | This analytic detects script execution (`wscript.exe` or `cscript.exe`) triggered from compressed fi (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-07-01 | 2026-09-22 | 8b07c2c9-0cde-4c44-9fa6-59dcf2b25777 | |||
Splunk | This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument. (...) | Generic | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-07-01 | 2026-09-22 | cd0e816f-f67d-4dbe-a153-480b546e867e | |||
Splunk | This analytic identifies non-browser processes reaching out to public IP lookup or geolocation servi (...) | Anomaly | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk, Janantha Marasinghe | 2025-07-01 | 2026-09-22 | 568cb83e-d79e-4a23-85ec-6e1f6c30cb2f | |||
Splunk | This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. (...) | Generic | stable | network_connection | - | Cisco NVM · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-07-01 | 2026-09-22 | 1984f997-3b49-4d4b-a7e9-dc5dbf88370e | |||
Splunk | This analytic detects attempts to access proxy-evasion or anonymizer services using Cisco Secure Access DNS and secure web proxy telemetry. (...) | Anomaly | stable | network_device | - | Cisco | - | medium | Mahamudul Chowdhury, Bhavin Patel, Splunk | 2026-05-06 | 2026-06-09 | a7c8613a-92e2-4232-b64d-bd39d33dee8b | |||
Splunk | The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3 | |||
Splunk | The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | f7e5e792-d907-46c1-a58e-4ff974dc462a | |||
Splunk | The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | f26445a8-a6a2-4855-bec0-0c39e52e5b8f | |||
Splunk | The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 8c15183e-2e70-4db4-86c3-88f8d9129b66 | |||
Splunk | The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | 3cc93f52-5aa6-4b7f-83b9-3430b1436813 | |||
Splunk | The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | aeff2bb5-3483-48d4-9be8-c8976194be1e | |||
Splunk | This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-16 | 2026-05-13 | a4c76d0a-56b6-44be-814b-939746c4d406 | |||
Splunk | The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-03 | 2026-05-13 | 173a1cb9-1814-4128-a9dc-f29dade89957 | |||
Various protocols maybe used to put data on the device for exfil or infil | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59 | - | |||
Detects CLR DLL being loaded by an Office Product | Generic | test | image_load | windows | Sysmon | - | medium | Antonlovesdnb | 2020-02-19 | 2023-03-29 | d13c43f0-f66b-4279-8b2c-5912077c1780 | ||||
Splunk | The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | medium | Teoderick Contreras, Bhavin Patel, Splunk | 2021-10-21 | 2026-05-13 | 54a6ed00-3256-11ec-b031-acde48001122 | ||||
Splunk | The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Michael Haag, Splunk | 2021-05-27 | 2026-05-13 | eb277ba0-b96b-11eb-b00e-acde48001122 | |||
Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. (...) | Generic | experimental | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems) | 2026-01-24 | — | 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d | ||||
Detects a suspicious command line execution that includes an URL and AppData string in the command l (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community | 2019-01-16 | 2021-11-27 | 1ac8666b-046f-4201-8aba-1951aaec03a3 | ||||
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfi (...) | Generic | test | network_connection | linux | Sysmon | - | high | Florian Roth (Nextron Systems) | 2022-11-03 | — | 19bf6fdb-7721-4f3d-867f-53467f6a5db6 | ||||
Detects an executable initiating a network connection to "ngrok" tunneling domains. (...) | Generic | test | network_connection | windows | Sysmon | - | high | Florian Roth (Nextron Systems) | 2022-11-03 | 2024-02-02 | 1d08ac94-400d-4469-a82f-daee9a908849 | ||||
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-11-10 | 2022-11-17 | 435e10e4-992a-4281-96f3-38b11106adde | ||||
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file | Generic | test | ps_script | windows | PowerShell | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-11-17 | — | db885529-903f-4c5d-9864-28fe199e6370 | ||||
detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-06-14 | — | ee5e119b-1f75-4b34-add8-3be976961e39 | ||||
Splunk | The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...) | Generic | stable | file_event | - | CrushFTP | medium | Michael Haag, Splunk | 2025-04-14 | 2026-09-08 | 82eb7f64-d219-4e21-acfe-956de84c1a35 | ||||
Adversaries can use curl to download payloads remotely and execute them. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Sreeman, Nasreddine Bencherchali (Nextron Systems) | 2020-01-13 | 2024-03-05 | 21dd6d38-2b18-4453-9404-a0fe4a0cc288 | ||||
Splunk | The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...) | Anomaly | stable | process_creation | windows · linux | CrowdStrike · Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali, Splunk | 2026-03-03 | 2026-05-13 | 9a8d5516-4c5e-11ef-9d42-acde48001122 | |||
Detects a curl process start on linux, which indicates a file download from a remote location or a s (...) | Generic | test | process_creation | linux | Sysmon | - | low | Nasreddine Bencherchali (Nextron Systems) | 2022-09-15 | — | ea34fb97-e2c4-4afb-810f-785e4459b194 |