malware

RAPIDPULSE S1113

Type: malware
Platforms: Network Devices, Linux
Created: 13 February 2024
Last modified: 15 April 2025

RAPIDPULSE is a web shell that exists as a modification to a legitimate Pulse Secure file that has been used by APT5 since at least 2021.[1]

TechniquesBottom 17%

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S1113

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
	Detects a highly relevant Antivirus alert that reports a web shell. (...)	Generic	test	antivirus	-	-	Persistence Server Software Component Web Shell	-	high	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-29	fdf135a2-9241-4f96-a114-bb404948f736
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be u (...)	Generic	test	-	windows	Exchange	Persistence Server Software Component Web Shell	-	critical	Max Altgelt (Nextron Systems)	2021-08-23	2023-01-23	b7bc7038-638b-4ffd-880c-292c692209ef
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
Splunk	This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Cloud Storage Collection Data from Local System	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
Splunk	This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. (...)	Hunting	stable	configuration_change	-	Cisco IOS · Cisco	Persistence, Privilege Escalation Account Manipulation Defense Impairment Disable or Modify Tools Persistence Server Software Component Web Shell	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	f52d5c0b-d45d-4304-b300-a4f6a1130dec
Splunk	This analytic detects HTTP requests to privileged execution paths on Cisco routers, specifically targeting the `/level/15/exec/-/*` endpoint using Cisco Secure Firewall Intrusion Events. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter Persistence Server Software Component Web Shell	-	medium	Nasreddine Bencherchali, Michael Haag, Splunk	2026-01-12	2026-05-13	0c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
Splunk	This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...)	Generic	stable	configuration_change	-	Cisco IOS · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Web Service	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	1abce487-f480-4d5f-a551-01de0bece0bd
	Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence Server Software Component Web Shell	CVE-2025-57790	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-10-20	—	bd3b3fff-a018-4994-9876-68af5809160f
	Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.	Generic	experimental	-	windows	WinEventLog System	Collection Data from Local System Credential Access OS Credential Dumping Security Account Manager	-	medium	Jason Mull	2025-05-12	—	882fbe50-d8d7-4e29-ae80-0648a8556866
	Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application Persistence Server Software Component Web Shell	CVE-2021-40539	critical	Sittikorn S, Nuttakorn Tungpoonsup	2021-09-10	2023-01-02	fcbb4a77-f368-4945-b046-4499a1da69d1
Splunk	The following analytic identifies the creation of suspicious .aspx files in known drop locations for Exchange exploitation, specifically targeting paths associated with HAFNIUM group and vulnerabilities like ProxyShell and ProxyNotShell. (...)	Generic	stable	file_event	windows	Sysmon	Initial Access Exploit Public-Facing Application Initial Access, Persistence External Remote Services Persistence Server Software Component Web Shell	-	medium	Michael Haag, Shannon Davis, David Dorsey, Splunk	2021-03-18	2026-05-13	8c14eeee-2af1-4a4b-bda8-228da0f4862a
	Detects access to DEWMODE webshell as described in FIREEYE report	Emerging	test	webserver	-	-	Persistence Server Software Component Web Shell	-	high	Florian Roth (Nextron Systems)	2021-02-22	2023-01-02	fdf96c90-42d5-4406-8a9c-14a2c9a016b5
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and M (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Local System	-	medium	frack113	2022-02-13	2024-03-05	6a69f62d-ce75-4b57-8dce-6351eb55b362
Splunk	This detection identifies access to sensitive system and configuration files on an ESXi host, including authentication data, service configurations, and VMware-specific management settings. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Collection Data from Local System Credential Access OS Credential Dumping /etc/passwd and /etc/shadow	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	6fa0073d-6ca0-4f93-913d-fb420c9de15b	-
Splunk	This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Collection Data from Local System	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	2e155547-aaac-49d3-b0ef-ceabc31fd364	-
	Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchang (...)	Generic	test	-	windows	Exchange	Persistence Server Software Component Web Shell	-	high	Jose Rodriguez @Cyb3rPandaH	2021-03-15	2023-01-23	9db37458-4df2-46a5-95ab-307e7f29e675
	Detects a program executing from a web server root folder. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence Server Software Component Web Shell	-	medium	Florian Roth (Nextron Systems)	2019-01-16	2024-01-18	35efb964-e6a5-47ad-bbcd-19661854018d
Splunk	The following analytic detects attempts to exploit the CVE-2022-42889 vulnerability in the Apache Commons Text Library, known as Text4Shell. (...)	Anomaly	stable	webserver	-	Nginx	Initial Access Exploit Public-Facing Application Initial Access, Persistence External Remote Services Persistence Server Software Component Web Shell	CVE-2022-42889	medium	Michael Haag, Splunk	2022-10-26	2026-05-13	19a481e0-c97c-4d14-b1db-75a708eb592e
	Detects suspicious IIS native-code module installations via command line	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence Server Software Component Web Shell	-	medium	Florian Roth (Nextron Systems)	2019-12-11	2024-03-13	9465ddf4-f9e4-4ebd-8d98-702df3a93239
Splunk	The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Deobfuscate/Decode Files or Information	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	5890ba10-4e48-4dc0-8a40-3e1ebe75e737
	Detects suspicious process command line that uses base64 encoded input for execution with a shell	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	pH-T (Nextron Systems)	2022-07-26	2023-06-16	ba592c6d-6888-43c3-b8c6-689b8fe47337
	Detects the presence of a base64 version of the shebang in the commandline, which could indicate a m (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-15	—	fe2f9663-41cb-47e2-b954-8a228f3b9dff
	Detects suspicious process command line that starts with a shell that executes something and finally (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Florian Roth (Nextron Systems)	2022-03-14	2022-07-26	880973f3-9708-491c-a77b-2a35a1921158
	Detects suspicious sub processes of web server processes	Generic	test	process_creation	linux	Sysmon	Persistence Server Software Component Web Shell	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2021-10-15	2026-08-19	818f7b24-0fba-4c49-a073-8b755573b9c7
	Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix w (...)	Generic	test	-	windows	Exchange	Persistence Server Software Component Web Shell	-	critical	Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems)	2021-08-09	2023-04-30	516376b4-05cd-4122-bae0-ad7641c38d48
	Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362	Emerging	test	webserver	-	-	Persistence Server Software Component Web Shell	CVE-2023-34362	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-03	2023-07-28	435e41f2-48eb-4c95-8a2b-ed24b50ec30b
Splunk	The following analytic identifies the creation of suspicious .aspx files in specific directories associated with Exchange exploitation by the HAFNIUM group and the ProxyShell vulnerability. (...)	Generic	experimental	process_creation	windows	Sysmon	Initial Access Exploit Public-Facing Application Initial Access, Persistence External Remote Services Persistence Server Software Component Web Shell	-	medium	Michael Haag, Splunk	2021-03-18	2026-05-13	985f322c-57a5-11ec-b9ac-acde48001122
	Detects execution of mshta.exe with file types that looks like they do not typically represent HTA ( (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Stealth Deobfuscate/Decode Files or Information Stealth System Binary Proxy Execution Mshta	CVE-2020-1599	high	Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)	2019-02-22	2025-05-12	cc7abbd0-762b-41e3-8a26-57ad50d2eea3
	Detects instances where an SMB service on an OpenCanary node has had a file open request.	Generic	test	-	-	OpenCanary	Collection Data from Local System Lateral Movement Remote Services	-	high	Security Onion Solutions	2024-03-08	—	22777c9e-873a-4b49-855f-6072ab861a52
	Detects access to a webshell dropped into a keystore folder on the WebLogic server	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application Persistence Server Software Component Web Shell	CVE-2018-2894	critical	Florian Roth (Nextron Systems)	2018-07-22	2023-01-02	37e8369b-43bb-4bf8-83b6-6dd43bda2000
	Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. (...)	Generic	test	process_creation	macos	-	Execution Command and Scripting Interpreter Stealth Deobfuscate/Decode Files or Information Execution User Execution	-	medium	Tim Rauch (rule), Elastic (idea)	2022-10-17	—	234dc5df-40b5-49d1-bf53-0d44ce778eca
	Detects a ping command that uses a hex encoded IP address	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2018-03-23	2025-10-17	1a0d4aba-7668-4365-9ce4-6d79ab088dfd
	Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. (...)	Generic	test	process_creation	macos	-	Stealth Deobfuscate/Decode Files or Information	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-20	—	09a910bf-f71f-4737-9c40-88880ba5913d
	Detects command line patterns used by BlackByte ransomware in different operations	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Impact Data Destruction Stealth Deobfuscate/Decode Files or Information Impact Network Denial of Service	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-02-08	999e8307-a775-4d5f-addc-4855632335be
	Detects potential commandline obfuscation using known escape characters	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information	-	medium	juju4	2018-12-11	2023-03-03	f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd
	Detects a command used by conti to dump database	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Local System	-	high	frack113	2021-08-16	2023-05-04	2f47f1fd-0901-466e-a770-3b7092834a1b
	This rule detects potential exfiltration by looking for a few compression extensions in the uri and (...)	Unsupported	unsupported	-	-	HTTP · Zeek	Collection Archive Collected Data Archive via Utility Collection Data from Local System	-	medium	Greg Howell, OTR (Open Threat Research)	2020-04-05	2023-03-24	0d47e3f6-357f-4534-928c-202631d065fa
	Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions. (...)	Emerging	experimental	webserver	-	-	Persistence Server Software Component Web Shell	CVE-2025-31324	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-05-14	—	639b893f-f93a-4e53-a7c8-f08cf73fe7f7
	Detects potential command execution via webshell in SAP NetViewer through JSP files with cmd parameter. (...)	Emerging	experimental	webserver	-	-	Initial Access Exploit Public-Facing Application Persistence Server Software Component Web Shell	CVE-2025-31324	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-05-14	—	94e12f41-6cb3-45c5-97b1-c783a7bf2e72
	Detects the creation of files with certain extensions on a static web site. (...)	Generic	test	file_event	windows	Sysmon	Persistence Server Software Component Web Shell	-	medium	Beyu Denis, oscd.community, Tim Shelton, Thurein Oo	2019-10-22	2023-10-15	39f1f9f2-9636-45de-98f6-a4046aa8e4b9
	Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information	-	high	Florian Roth (Nextron Systems)	2019-08-24	2023-04-06	fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c
	A General detection for specific decompress commands in PowerShell logs. (...)	Generic	test	ps_module	windows	PowerShell	Stealth Deobfuscate/Decode Files or Information	-	informational	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2022-12-25	1ddc1472-8e52-4f7d-9f11-eab14fc171f5
Splunk	This analytic detects Windchill MethodServer log4j events showing suspicious `c=` command execution or `p=` file read parameters sent to Windchill gateway paths associated with CVE-2026-4681 exploitation. (...)	Anomaly	stable	network_connection	-	Windchill Log4j	Execution Command and Scripting Interpreter Collection Data from Local System Initial Access Exploit Public-Facing Application	CVE-2026-4681	medium	Nasreddine Bencherchali, Splunk	2026-06-14	2026-06-14	d725b390-fe86-47df-b9a1-57497915403e

Title

Description

RAPIDPULSE S1113

RAPIDPULSE S1113

RAPIDPULSE MITRE reference S1113

Standing S1113

Reach

Coverage

RAPIDPULSE detections S1113