malware

DEADWOOD S1134

Type: malware
Platform: Windows
Created: 22 May 2024
Last modified: 26 August 2024

DEADWOOD is wiper malware written in C++ using Boost libraries. DEADWOOD was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into Agrius operations.[1]

Techniques47th pct

Tactics32nd pct

Threat groupsunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S1134

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic identifies attempts to delete AWS Bedrock Knowledge Bases, which are resources that store and manage domain-specific information for AI models. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	8b4e3d62-f743-11ee-9f6e-acde48001123
	Detects when a EFS Fileshare Mount is modified or deleted. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	medium	Austin Songer @austinsonger	2021-08-15	2022-10-09	6a7ba45c-63d8-473e-9736-2eaabff79964
	Identifies when an EKS cluster is created or deleted.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Data Destruction	-	low	Austin Songer	2021-08-16	2022-10-09	33d50d03-20ec-4b74-a74e-1e65a38af1c0
	Identifies when an ElastiCache security group has been modified or deleted.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Impact Account Access Removal	-	low	Austin Songer @austinsonger	2021-07-24	2022-10-09	7c797da2-9cf2-4523-ba64-33b06339f0cc
	Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Impact Account Access Removal Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Ivan Saakov	2024-12-19	—	ccd6a6c8-bb4e-4a91-9d2a-07e632819374
	Detects when a Container Registry is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	93e0ef48-37c8-49ed-a02c-038aab23628e
	Identifies when a device or device configuration in azure is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Data Manipulation Stored Data Manipulation	-	medium	Austin Songer @austinsonger	2021-09-03	2022-10-09	46530378-f9db-4af9-a9e5-889c177d3881
	Detects when a Azure Kubernetes Cluster is created or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	low	Austin Songer @austinsonger	2021-08-07	2022-08-23	9541f321-7cba-4b43-80fc-fbd1fb922808
	Identifies when a Azure Kubernetes network policy is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	08d6ac24-c927-4469-b3b7-2e422d6e3c43
	Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	25cb259b-bbdc-4b87-98b7-90d7c72f8743
	Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	7ee0b4aa-d8d4-4088-b661-20efdf41a04c
	Identifies when ClusterRoles/Roles are being modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	818fee0c-e0ec-4e45-824e-83e4817b0887
	Identifies when a service account is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Impact Account Access Removal Impact Data Destruction Impact Resource Hijacking Impact Service Stop	-	medium	Austin Songer @austinsonger	2021-08-07	2022-08-23	12d027c3-b48c-4d9d-8bb6-a732200034b2
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
Splunk	This analytic detects deletion of user accounts from Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Impact Account Access Removal Stealth Indicator Removal Clear Mailbox Data	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	2d4b9e7f-5c3a-4d8e-9b1f-8a6c5e2d4f7a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
	See what files are being deleted from flash file systems	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Disk Wipe Disk Content Wipe Disk Structure Wipe Stealth Indicator Removal File Deletion	-	medium	Austin Clark	2019-08-12	2023-01-04	71d65515-c436-43c0-841b-236b1f32c21e	-
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	d7a95147-145f-4678-b85d-d1ff4a3bb3f6
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	5a105d34-05fc-401e-8553-272b45c1522d
Splunk	The following analytic detects modifications to files with extensions commonly associated with ransomware. (...)	Generic	stable	file_event	windows	Sysmon	Impact Data Destruction	-	medium	David Dorsey, Michael Haag, Nasreddine Bencherchali, Splunk, Steven Dick	2019-10-16	2026-09-22	a9e5c5db-db11-43ca-86a8-c852d1b2c0ec
Splunk	The following analytic detects the creation of files with names commonly associated with ransomware notes. (...)	Hunting	stable	file_event	windows	Sysmon	Impact Data Destruction	-	medium	David Dorsey, Splunk	2019-10-16	2026-07-02	ada0f478-84a8-4641-a3f1-d82362d6bd71	-
	Detects the installation of a service named "javamtsup" on the system. (...)	Emerging	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-10-09	cb062102-587e-4414-8efa-dbe3c7bf19c6
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	f0d1feba-4344-4ca9-8121-a6c97bd6df52
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog System	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	4976aa50-8f41-45c6-8b15-ab3fc10e79ed
	Detects default CSExec service filename which indicates CSExec service installation and execution	Generic	test	file_event	windows	Sysmon	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-08-04	—	f0e2b768-5220-47dd-b891-d57b96fc0ec1
	Detects CSExec service installation and execution events	Generic	test	service	windows	WinEventLog System	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-08-07	—	a27e5fa9-c35e-4e3d-b7e0-1ce2af66ad12
	Detects potential overwriting and deletion of a file using DD.	Generic	test	process_creation	linux	Sysmon	Impact Data Destruction	-	low	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-10-15	2022-07-07	2953194b-e33c-4859-b9e8-05948c167447
	Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Impact Data Destruction	-	medium	frack113	2021-12-26	2023-02-21	4b046706-5789-4673-b111-66f25fe99534
Splunk	This detection identifies DNS queries to domains that match previously decommissioned S3 buckets. (...)	Anomaly	experimental	dns	windows	Sysmon	Impact Data Destruction	-	medium	Jose Hernandez, Splunk	2025-02-12	2026-05-13	2f1c5fd1-4b8a-4f5d-a0e9-7d6a8e2f5e1e
Splunk	This detection identifies web requests to domains that match previously decommissioned S3 buckets through web proxy logs. (...)	Anomaly	experimental	webserver	-	AWS	Impact Data Destruction	-	medium	Jose Hernandez, Splunk	2025-02-12	2026-05-13	3a1d8f62-5b9c-4e7d-b8f3-9d6a8e2f5e1f
	Identifies use of various commands to query a systems time. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Time Discovery	-	low	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2022-06-28	b243b280-65fe-48df-ba07-6ddea7646427
	Identifies clients that may be performing DNS lookups associated with common currency mining pools.	Generic	test	-	-	DNS · Zeek	Impact Resource Hijacking Execution System Services Service Execution	-	low	Saw Winn Naung, Azure-Sentinel, @neu5ron	2021-08-19	2022-07-07	bf74135c-18e8-4a72-a926-0e4f47888c19
	Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub pro (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Exploit Public-Facing Application Execution System Services Service Execution	CVE-2020-1350	critical	Florian Roth (Nextron Systems)	2020-07-15	2022-07-12	b5281f31-f9cc-4d0d-95d0-45b91c45b487
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
Splunk	The following analytic detects excessive file deletion events in the Windows Defender folder. (...)	Generic	stable	file_event	windows	Sysmon	Impact Data Destruction	-	medium	Teoderick Contreras, Splunk, Steven Dick	2022-01-21	2026-05-13	b5baa09a-7a05-11ec-8da4-acde48001122
Splunk	The following analytic detects excessive usage of the `sc.exe` service utility on a host machine. (...)	Anomaly	stable	process_creation	windows	Sysmon	Execution System Services Service Execution	-	medium	Teoderick Contreras, Splunk	2021-06-24	2026-05-13	cb6b339e-d4c6-11eb-a026-acde48001122
Splunk	The following analytic detects the first occurrence of a Windows service running in your environment. (...)	Anomaly	experimental	service	windows	WinEventLog System	Execution System Services Service Execution	-	medium	David Dorsey, Splunk	2019-10-16	2026-05-13	823136f2-d755-4b6d-ae04-372b486a5808	-
	Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Impact Data Destruction Stealth Indicator Removal	-	high	Ecco, E.M. Anhaus, oscd.community	2019-09-26	2023-09-09	add64136-62e5-48ea-807e-88638d02df1e
Splunk	The following analytic detects when a user removes an organization from GitHub Enterprise. (...)	Anomaly	stable	-	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	94cb89aa-aec1-4585-91b1-affcdacf357e
Splunk	The following analytic detects when a repository is archived in GitHub Enterprise. (...)	Anomaly	stable	-	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	8367cb99-bae1-4748-ae3b-0927bb381424
Splunk	The following analytic detects when a user deletes a repository in GitHub Enterprise. (...)	Anomaly	stable	-	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	f709e736-3e6c-492f-b865-bc7696cc24a7
Splunk	The following analytic detects when a repository is archived in GitHub Organizations. (...)	Anomaly	stable	cloud_audit	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	4f568a0e-896f-4d94-a2f7-fa6d82ab1f77
Splunk	The following analytic identifies when a repository is deleted within a GitHub organization. (...)	Anomaly	stable	cloud_audit	-	GitHub	Impact Data Destruction Initial Access Supply Chain Compromise	-	medium	Patrick Bareiss, Splunk	2025-01-15	2026-05-13	9ff4ca95-fdae-4eea-9ffa-6d8e1c202a71
	Identifies when a service account is disabled or deleted in Google Cloud.	Generic	test	cloud_audit	-	GCP Audit · Google Cloud	Impact Account Access Removal	-	medium	Austin Songer @austinsonger	2021-08-14	2022-10-09	13f81a90-a69c-4fab-8f07-b5bb55416a9f
	Detects execution of the "groupdel" binary. (...)	Generic	test	process_creation	linux	Sysmon	Impact Account Access Removal	-	medium	Tuan Le (NCSGroup)	2022-12-26	—	8a46f16c-8c4c-82d1-b121-0fdd3ba70a84
	Detects the use of SharpUp, a tool for local privilege escalation	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Group Policy Discovery Execution, Stealth Hijack Execution Flow Executable Installer File Permissions Weakness Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems)	2022-08-20	2023-02-13	c484e533-ee16-4a93-b6ac-f0ea4868b2f1
	Detects installation or execution of services	Generic	test	service	windows	WinEventLog System	Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems)	2022-03-21	2023-08-07	d26ce60c-2151-403c-9a42-49420d87b5e4
Splunk	The following analytic detects the deletion of SSH keys on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	73a56508-1cf5-4df7-b8d9-5737fbdc27d2
Splunk	The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Deobfuscate/Decode Files or Information	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	5890ba10-4e48-4dc0-8a40-3e1ebe75e737

Title

Description

DEADWOOD S1134

DEADWOOD MITRE reference S1134

Standing S1134

Reach

Coverage

DEADWOOD detections S1134