malware

GLASSTOKEN S1117

Type: malware
Platform: Network Devices
Created: 6 March 2024
Last modified: 15 April 2025

GLASSTOKEN is a custom web shell used by threat actors during Cutting Edge to execute commands on compromised Ivanti Secure Connect VPNs.[1]

TechniquesBottom 17%

Tactics32nd pct

Threat groupsNone recorded

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S1117

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Detects a highly relevant Antivirus alert that reports a web shell. (...)	Generic	test	antivirus	-	-	Persistence Server Software Component Web Shell	-	high	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-29	fdf135a2-9241-4f96-a114-bb404948f736
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cob (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	critical	ok @securonix invrep_de, oscd.community	2020-10-09	2022-12-25	8d31a8ce-46b5-4dd6-bdc3-680931f1db86
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects powershell execution with that make use of to the bxor (Bitwise XOR). (...)	Hunting	test	ps_classic_start	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	low	Teymur Kheirkhabarov, Harish Segar	2020-06-29	2024-12-11	812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
	Detects calls to cmdlets that are used to export certificates from the local certificate store. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Credential Access Unsecured Credentials Private Keys	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-18	—	9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
	Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be u (...)	Generic	test	-	windows	Exchange	Persistence Server Software Component Web Shell	-	critical	Max Altgelt (Nextron Systems)	2021-08-23	2023-01-23	b7bc7038-638b-4ffd-880c-292c692209ef
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-11-01	2025-10-07	87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-10-20	2023-12-14	61d0475c-173f-4844-86f7-f3eebae1c66b
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
Splunk	This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. (...)	Hunting	stable	configuration_change	-	Cisco IOS · Cisco	Persistence, Privilege Escalation Account Manipulation Defense Impairment Disable or Modify Tools Persistence Server Software Component Web Shell	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	f52d5c0b-d45d-4304-b300-a4f6a1130dec
Splunk	The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Command and Control Non-Standard Port Privilege Escalation, Stealth Process Injection Command and Control Remote Access Tools Lateral Movement Remote Services	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
Splunk	This analytic detects HTTP requests to privileged execution paths on Cisco routers, specifically targeting the `/level/15/exec/-/*` endpoint using Cisco Secure Firewall Intrusion Events. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter Persistence Server Software Component Web Shell	-	medium	Nasreddine Bencherchali, Michael Haag, Splunk	2026-01-12	2026-05-13	0c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
	Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	high	Florian Roth (Nextron Systems)	2022-08-23	2026-05-13	a16980c2-0c56-4de0-9a79-17971979efdd
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	Detects the use of qoperation.exe with the -file argument to write a JSP file to the webroot, indicating a webshell drop. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence Server Software Component Web Shell	CVE-2025-57790	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-10-20	—	bd3b3fff-a018-4994-9876-68af5809160f
	Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton	2020-10-11	2023-02-01	74403157-20f5-415d-89a7-c505779585cf
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
	Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).	Emerging	test	webserver	-	-	Initial Access Exploit Public-Facing Application Persistence Server Software Component Web Shell	CVE-2021-40539	critical	Sittikorn S, Nuttakorn Tungpoonsup	2021-09-10	2023-01-02	fcbb4a77-f368-4945-b046-4499a1da69d1
	Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected (...)	Emerging	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	CVE-2022-24527	high	Florian Roth (Nextron Systems)	2022-04-13	—	e0a41412-c69a-446f-8e6e-0e6d7483dad7
Splunk	The following analytic detects the use of the Certify tool via an in-memory PowerShell function to enumerate Active Directory Certificate Services (AD CS) environments. (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Credential Access Steal or Forge Authentication Certificates	-	medium	Steven Dick	2023-07-28	2026-05-13	f533ca6c-9440-4686-80cb-7f294c07812a
Splunk	The following analytic detects suspicious PowerShell execution indicative of PowerShell-Empire activity. (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Michael Haag, Splunk	2021-06-09	2026-05-13	bc1dc6b8-c954-11eb-bade-acde48001122
Splunk	The following analytic identifies the creation of suspicious .aspx files in known drop locations for Exchange exploitation, specifically targeting paths associated with HAFNIUM group and vulnerabilities like ProxyShell and ProxyNotShell. (...)	Generic	stable	file_event	windows	Sysmon	Initial Access Exploit Public-Facing Application Initial Access, Persistence External Remote Services Persistence Server Software Component Web Shell	-	medium	Michael Haag, Shannon Davis, David Dorsey, Splunk	2021-03-18	2026-05-13	8c14eeee-2af1-4a4b-bda8-228da0f4862a
Splunk	The following analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Credential Access OS Credential Dumping	-	medium	Michael Haag, Splunk	2021-06-09	2026-05-13	8148c29c-c952-11eb-9255-acde48001122
	This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Stealth Trusted Developer Utilities Proxy Execution	-	medium	Agro (@agro_sev) oscd.community	2020-10-10	2022-12-09	0152550d-3a26-4efd-9f0e-54a0b28ae2f3
	Detects access to DEWMODE webshell as described in FIREEYE report	Emerging	test	webserver	-	-	Persistence Server Software Component Web Shell	-	high	Florian Roth (Nextron Systems)	2021-02-22	2023-01-02	fdf96c90-42d5-4406-8a9c-14a2c9a016b5
	Well-known DNS Exfiltration tools execution	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol DNS Command and Control Data Encoding Standard Encoding Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Symmetric Encrypted Non-C2 Protocol	-	high	Daniil Yugoslavskiy, oscd.community	2019-10-24	2021-11-27	98a96a5a-64a0-4c42-92c5-489da3866cb0
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects execution and usage of the DSInternals PowerShell module. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	high	Nasreddine Bencherchali (Nextron Systems), Nounou Mbeiri	2024-06-26	—	43d91656-a9b2-4541-b7e2-6a9bd3a13f4e
	Detects execution and usage of the DSInternals PowerShell module. (...)	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	high	Nasreddine Bencherchali (Nextron Systems)	2024-06-26	—	846c7a87-8e14-4569-9d49-ecfd4276a01c
Splunk	The following analytic detects the usage of specific Exchange PowerShell modules, such as New-MailboxExportRequest, New-ManagementRoleAssignment, New-MailboxSearch, and Get-Recipient. (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Michael Haag, Splunk	2021-08-25	2026-05-13	2d10095e-05ae-11ec-8fdf-acde48001122
	Detects adding and using Exchange PowerShell snap-ins to export mailbox data. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Collection Email Collection	-	high	FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems)	2021-03-03	2023-03-24	25676e10-2121-446e-80a4-71ff8506af47
	Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchang (...)	Generic	test	-	windows	Exchange	Persistence Server Software Component Web Shell	-	high	Jose Rodriguez @Cyb3rPandaH	2021-03-15	2023-01-23	9db37458-4df2-46a5-95ab-307e7f29e675
	Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth System Script Proxy Execution	-	medium	Julia Fomina, oscd.community	2020-10-08	2023-11-09	59e938ff-0d6d-4dc3-b13f-36cc28734d4e
	Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth System Script Proxy Execution	-	medium	frack113, Nasreddine Bencherchali	2022-08-20	—	18988e1b-9087-4f8a-82fe-0414dce49878
	Detects a program executing from a web server root folder. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence Server Software Component Web Shell	-	medium	Florian Roth (Nextron Systems)	2019-01-16	2024-01-18	35efb964-e6a5-47ad-bbcd-19661854018d
	This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	high	Max Altgelt (Nextron Systems)	2022-04-06	2022-07-14	fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4
Splunk	The following analytic detects attempts to exploit the CVE-2022-42889 vulnerability in the Apache Commons Text Library, known as Text4Shell. (...)	Anomaly	stable	webserver	-	Nginx	Initial Access Exploit Public-Facing Application Initial Access, Persistence External Remote Services Persistence Server Software Component Web Shell	CVE-2022-42889	medium	Michael Haag, Splunk	2022-10-26	2026-05-13	19a481e0-c97c-4d14-b1db-75a708eb592e
	Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability rep (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2020-10189	high	Florian Roth (Nextron Systems)	2020-03-25	2023-01-21	846b866e-2a57-46ee-8e16-85fa92759be7
	Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	high	@kostastsale	2022-06-16	2024-08-23	97805087-93ab-4203-b5cb-287cda6aecaa
Splunk	The following analytic detects the execution of the Get-ForestTrust command from PowerSploit using PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery	-	medium	Michael Haag, Splunk	2021-09-02	2026-05-13	70fac80e-0bf1-11ec-9ba0-acde48001122
Splunk	The following analytic detects the execution of the `Get-LocalUser` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). (...)	Hunting	stable	ps_script	windows	PowerShell	Discovery Account Discovery Local Account Execution Command and Scripting Interpreter PowerShell	-	medium	Mauricio Velazco, Splunk	2021-08-24	2026-05-13	2e891cbe-0426-11ec-9c9c-acde48001122

Title

Description

GLASSTOKEN S1117

GLASSTOKEN S1117

GLASSTOKEN MITRE reference S1117

Standing S1117

Reach

Coverage

GLASSTOKEN detections S1117