malware
LoFiSe has been used by ToddyCat since at least 2023 to identify and collect files of interest on targeted systems.[1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
LoFiSe can collect files of interest from targeted systems.2
LoFiSe can save files to be evaluated for further exfiltration in the C:\Programdata\Microsoft\ and C:\windows\temp\ folders.
3
LoFiSe can monitor the file system to identify files less than 6.4 MB in size with file extensions including .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .rtf, .tif, .odt, .ods, .odp, .eml, and .msg.4
LoFiSe can collect all the files from the working directory every three hours and place them into a password-protected archive for further exfiltration.5
LoFiSe can collect files into password-protected ZIP-archives for exfiltration.6
LoFiSe has been executed as a file named DsNcDiag.dll through side-loading.7
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
29th percentile · 71% of 825 ATT&CK software entries have more Enterprise techniques.
32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
38th percentile · 62% of 825 ATT&CK software entries have more detection rules per technique.
186 distinct rules cover the 6 techniques recorded for this malware. 146 Sigma · 40 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...) | Generic | test | pipe_created | windows | Sysmon | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2021-10-08 | 2023-11-30 | 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3 | ||||
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27 | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2018-09-03 | 2023-03-09 | 9aa01d62-7667-4d3b-acb8-8cb5103e2014 | ||||
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...) | Generic | test | image_load | windows | Sysmon | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-01-22 | 2023-03-15 | 90ae0469-0cee-4509-b67f-e5efcef040f7 | ||||
Once established within a system or network, an adversary may use automated techniques for collecting internal data. | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2021-07-28 | 2022-12-25 | c1dda054-d638-4c16-afc8-53e007f3fbc5 | ||||
Once established within a system or network, an adversary may use automated techniques for collecting internal data. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2021-07-28 | 2022-11-11 | f576a613-2392-4067-9d1a-9345fb58d8d1 | ||||
Detects automated lateral movement by Turla group | Unsupported | unsupported | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Markus Neis | 2017-11-07 | 2023-02-24 | 75925535-ca97-4e0a-a850-00b5c00779dc | ||||
An attempt to export an AWS EC2 instance has been detected. (...) | Generic | test | cloud_audit | - | AWS CloudTrail · AWS | - | low | Diogo Braz | 2020-04-16 | 2022-10-05 | 54b9a76a-3c71-4673-b4b3-2edb4566ea7b | ||||
Splunk | The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. (...) | Anomaly | stable | cloud_audit | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-10 | 2026-05-13 | e4384bbf-5835-4831-8d85-694de6ad2cc6 | |||
Splunk | The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. (...) | Generic | stable | scheduled_job | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-24 | 2026-05-13 | 04455dd3-ced7-480f-b8e6-5469b99e98e2 | |||
Splunk | The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. (...) | Generic | stable | scheduled_job | - | AWS CloudTrail · AWS | - | medium | Bhavin Patel, Splunk | 2023-04-10 | 2026-05-13 | 05c4b09f-ea28-4c7c-a7aa-a246f665c8a2 | |||
Detects usage of "getcap" binary. (...) | Generic | test | process_creation | linux | Sysmon | - | low | Nasreddine Bencherchali (Nextron Systems) | 2022-12-28 | 2026-01-24 | d8d97d51-122d-4cdd-9e2f-01b4b4933530 | ||||
Splunk | This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-11-21 | 2026-05-13 | 4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c | |||
Splunk | This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-11-21 | 2026-05-13 | 8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b | |||
Collect pertinent data from the configuration files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-11 | 2023-01-04 | cd072b25-a418-4f98-8ebc-5093fb38fe1a | ||||
Find information about network devices that is not stored in config files | Generic | test | authentication | - | Cisco AAA · Cisco | - | low | Austin Clark | 2019-08-12 | 2023-01-04 | 9705a6a1-6db6-4a16-a987-15b7151e299b | ||||
Splunk | This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...) | Generic | stable | configuration_change | - | Cisco IOS · Cisco | medium | Bhavin Patel, Michael Haag, Splunk | 2025-08-21 | 2026-05-13 | 1abce487-f480-4d5f-a551-01de0bece0bd | ||||
Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. (...) | Hunting | test | ps_script | windows | PowerShell | - | low | Timur Zinniatullin, oscd.community | 2019-10-21 | 2023-12-15 | 6dc5d284-69ea-42cf-9311-fb1c3932a69a | ||||
Detects execution of "tar.exe" in order to create a compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems), AdmU3 | 2023-12-19 | — | 418a3163-3247-4b7b-9933-dcfcb7c52ea9 | ||||
Detects execution of "tar.exe" in order to extract compressed file. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | AdmU3 | 2023-12-19 | — | bf361876-6620-407a-812f-bfe11e51e924 | ||||
Detects a command used by conti to exfiltrate NTDS | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) | 2021-08-09 | 2022-10-09 | aa92fd02-09f2-48b0-8a93-864813fb8f41 | ||||
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID. | Generic | experimental | - | windows | WinEventLog System | - | medium | Jason Mull | 2025-05-12 | — | 882fbe50-d8d7-4e29-ae80-0648a8556866 | ||||
Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. (...) | Generic | test | file_event | windows | Sysmon | medium | Nasreddine Bencherchali (Nextron Systems), fornotes | 2022-12-01 | 2026-01-24 | df6ecb8b-7822-4f4b-b412-08f524b4576c | |||||
Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking. | Generic | test | file_event | windows | Sysmon | - | medium | frack113 | 2022-05-09 | 2026-05-18 | 28a452f3-786c-4fd8-b8f2-bddbe9d616d1 | ||||
Splunk | The following analytic detects the use of the Certipy tool to enumerate Active Directory Certificate Services (AD CS) environments by identifying unique file modifications. (...) | Generic | stable | file_event | windows | Sysmon | - | medium | Steven Dick | 2023-07-28 | 2026-05-13 | 7e3df743-b1d8-4631-8fa8-bd5819688876 | |||
Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Dimitrios Slamaris | 2017-05-15 | 2023-08-17 | 9d3436ef-9476-4c43-acca-90ce06bdf33a | ||||
This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be lo (...) | Generic | test | - | windows | WinEventLog System | - | high | Dimitrios Slamaris, @atc_project (fix) | 2017-05-15 | 2022-12-25 | 75edd3fd-7146-48e5-9848-3013d7f0282c | ||||
This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded | Generic | test | - | windows | WinEventLog System | - | high | Dimitrios Slamaris | 2017-05-15 | 2022-12-25 | 13fc89a9-971e-4ca6-b9dc-aa53a445bf40 | ||||
Detects DLL sideloading activity seen used by Diamond Sleet APT | Emerging | test | image_load | windows | Sysmon | high | Nasreddine Bencherchali (Nextron Systems) | 2023-10-24 | — | d1b65d98-37d7-4ff6-b139-2d87c1af3042 | |||||
Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113 | 2022-08-20 | 2023-02-04 | b4dc61f5-6cce-468e-a608-b48b469feaa2 | ||||
Hunts known SVR-specific DLL names. | Emerging | test | image_load | windows | Sysmon | - | medium | CISA | 2023-12-18 | — | e64c8ef3-9f98-40c8-b71e-96110991cb4c | ||||
Detects when an attacker create a similar folder structure to windows system folders such as (Window (...) | Generic | test | file_event | windows | Sysmon | - | high | frack113, Nasreddine Bencherchali (Nextron Systems) | 2022-07-30 | — | b6f91281-20aa-446a-b986-38a92813a18f | ||||
Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which m (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-08-02 | — | ebea773c-a8f1-42ad-a856-00cb221966e8 | ||||
Detects processes loading the non-existent DLL "ShellChromeAPI". (...) | Generic | test | image_load | windows | Sysmon | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-12-01 | — | ee4c5d06-3abc-48cc-8885-77f1c20f4451 | ||||
Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded | Generic | test | - | windows | DNS Server | - | high | Florian Roth (Nextron Systems) | 2017-05-08 | 2023-02-05 | cbe51394-cd93-4473-b555-edf0144952d9 | ||||
One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and M (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-02-13 | 2024-03-05 | 6a69f62d-ce75-4b57-8dce-6351eb55b362 | ||||
Splunk | This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. (...) | Generic | stable | - | esxi | VMware ESXi · VMware | - | medium | Raven Tait, Splunk | 2025-07-11 | 2026-05-13 | 6fa0073d-6ca0-4f93-913d-fb420c9de15b | - | ||
Splunk | This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. (...) | Generic | stable | - | esxi | VMware ESXi · VMware | - | medium | Raven Tait, Splunk | 2025-07-11 | 2026-05-13 | 2e155547-aaac-49d3-b0ef-ceabc31fd364 | - | ||
The Fax service attempts to load ualapi.dll, which is non-existent. (...) | Generic | test | image_load | windows | Sysmon | - | high | NVISO | 2020-05-04 | 2022-06-02 | 828af599-4c53-4ed2-ba4a-a9f835c434ea | ||||
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares. | Generic | test | process_creation | linux | Sysmon | - | informational | Daniil Yugoslavskiy, oscd.community, CheraghiMilad | 2020-10-19 | 2024-12-01 | d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72 | ||||
Detects usage of system utilities to discover files and directories | Generic | test | process_creation | macos | - | - | informational | Daniil Yugoslavskiy, oscd.community | 2020-10-19 | 2022-11-25 | 089dbdf6-b960-4bcc-90e3-ffc3480c20f6 | ||||
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems), frack113 | 2021-07-20 | 2022-10-09 | 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 | ||||
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Nasreddine Bencherchali | 2022-10-10 | 2024-11-23 | fca949cc-79ca-446e-8064-01aa7e52ece5 | ||||
Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. (...) | Generic | test | file_event | windows | Sysmon | - | high | Subhash Popuri (@pbssubhash) | 2021-08-21 | 2024-06-27 | 602a1f13-c640-4d73-b053-be9a2fa58b96 | ||||
Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospa (...) | Emerging | test | image_load | windows | Sysmon | - | high | Thurein Oo, Nasreddine Bencherchali (Nextron Systems) | 2023-10-18 | — | 24007168-a26b-4049-90d0-ce138e13a5cf | ||||
Splunk | The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. (...) | Anomaly | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-23 | 2026-05-13 | f616c4f3-bde9-41cf-856c-019b65f668bb | |||
Splunk | The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. (...) | Anomaly | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-22 | 2026-10-02 | 0bbfb79c-a755-49a5-a38a-1128d0a452f1 | |||
Splunk | The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. (...) | Anomaly | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-12 | 2026-05-13 | 555cc358-bf16-4e05-9b3a-0f89c73b7261 | |||
Splunk | The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. (...) | Anomaly | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-12 | 2026-05-13 | eec78cef-d4c8-4b35-8f5b-6922102a4a41 | |||
Detects attempts to discover the files with setuid/setgid capability on them. (...) | Generic | test | process_creation | linux | Linux Auditd | - | low | Pawel Mazur | 2021-11-28 | 2022-12-25 | fe10751f-1995-40a5-aaa2-c97ccb4123fe | ||||
Detects creation of a malicious DLL file in the location where the OneDrive or Team applications
Upo (...) | Generic | test | file_event | windows | Sysmon | - | high | frack113 | 2022-08-12 | — | 1908fcc1-1b92-4272-8214-0fbaf2fa5163 |
19th percentile · 81% of 825 ATT&CK software entries have more atomic tests per technique.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 6 Enterprise techniques.
Technique Campaign use over its cumulative rule count.