malware

MgBot S1146

Type: malware
Platform: Windows
Created: 25 July 2024
Last modified: 10 October 2024

MgBot is a modular malware framework exclusively associated with Daggerfly operations since at least 2012. MgBot was developed in C++ and features a module design with multiple available plugins that have been under active development through 2024.[1][2][3]

Techniques72nd pct

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_access	windows	-	Credential Access OS Credential Dumping	-	low	frack113, X__Junior (Nextron Systems)	2022-04-09	2024-07-29	91cb43db-302a-47e3-b3c8-7ede481e27bf
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_event	windows	WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	low	Daniel Koifman (@Koifsec), Nasreddine Bencherchali	2024-10-21	—	4b60e527-ec73-4b47-8cb3-f02ad927ca65
	Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	frack113	2022-01-30	—	fc028194-969d-4122-8abe-0470d5b8f12f
	Detects file access requests to chromium based browser sensitive files by uncommon processes. (...)	Hunting	test	file_access	windows	-	Credential Access OS Credential Dumping	-	low	X__Junior (Nextron Systems)	2024-07-29	—	c5f37810-a85f-4186-81e9-33f23abb4141
	Detects file access requests to crypto currency files by uncommon processes. (...)	Generic	test	file_access	windows	-	Credential Access OS Credential Dumping	-	medium	X__Junior (Nextron Systems)	2024-07-29	—	f41b0311-44f9-44f0-816d-dd45e39d4bc8
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	9212f354-7775-4e28-9c9f-8f0a4544e664
	Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	—	e5d36acd-acb4-4c6f-a13f-9eb203d50099
	Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs	Generic	test	-	windows	WinEventLog Security	Discovery Account Discovery Domain Account	-	high	Samir Bousseaden	2019-04-03	2022-07-13	35ba1d85-724d-42a3-889f-2e2362bcaf23
	Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)	Generic	experimental	file_event	windows	Sysmon	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Arnim Rupp (Nextron Systems), Thomas Patzke	2025-07-09	—	0a1255c5-d732-4b62-ac02-b5152d34fb83
	Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...)	Generic	test	pipe_created	windows	Sysmon	Collection Data from Local System	-	medium	Roberto Rodriguez @Cyb3rWard0g	2021-10-08	2023-11-30	1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
Splunk	The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-25	2026-10-02	de7fcadc-04f3-11ec-a241-acde48001122
Splunk	The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-10-24	2026-05-13	9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
	Detects the use of Advanced IP Scanner. (...)	Generic	test	file_event	windows	Sysmon	Discovery Network Service Discovery	-	medium	@ROxPinTeddy	2020-05-12	2022-11-29	fed85bf9-e075-4280-9159-fbe8a023d6fa
	Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)	Generic	stable	antivirus	-	-	Credential Access OS Credential Dumping LSASS Memory Security Account Manager Credential Access Steal or Forge Kerberos Tickets	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	78cc2dd2-7d20-4d32-93ff-057084c38b93
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
	Detects attempts to record audio using the arecord and ecasound utilities.	Generic	test	process_creation	linux	Linux Auditd	Collection Audio Capture	-	low	Pawel Mazur, Milad Cheraghi	2021-09-04	2025-12-05	a7af2487-9c2f-42e4-9bb9-ff961f0561d5
	Detects audio capture via PowerShell Cmdlet.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-10-24	2023-04-06	932fb0d8-692b-4b0f-a26e-5643a50fe7d6
	Detect attacker collecting audio via SoundRecorder application.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Audio Capture	-	medium	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2021-11-27	83865853-59aa-449e-9600-74b9d89a6d6e
	An attempt to export an AWS EC2 instance has been detected. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Collection Data from Local System Exfiltration Transfer Data to Cloud Account	-	low	Diogo Braz	2020-04-16	2022-10-05	54b9a76a-3c71-4673-b4b3-2edb4566ea7b
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping	-	medium	Julia Fomina, oscd.community	2020-10-09	2025-10-31	93671f99-04eb-4ab4-a161-70d446a84003
Splunk	The following analytic identifies the execution of the "whoami" command with the "/group" flag, where the results are passed to the "find" command in order to look for a the string "12288". (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery System Owner/User Discovery	-	medium	Teoderick Contreras, Splunk	2021-09-14	2026-05-13	a9079b18-1633-11ec-859c-acde48001122	-
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
Splunk	This analytic detects file copy activity on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Cloud Storage Collection Data from Local System	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	4d7e8f3a-9c2b-4e6f-8a1d-5b9c7e2f4a8c
Splunk	This analytic detects file copy operations to remote locations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Alternative Protocol Exfiltration Over Unencrypted Non-C2 Protocol Exfiltration Exfiltration Over C2 Channel	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	8a9e5f2b-6d4c-4e7f-9b3a-1c8d7f5e2a9b
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Initial Access Exploit Public-Facing Application Execution Exploitation for Client Execution Credential Access OS Credential Dumping Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	ec99bb81-c31b-4837-8c7d-1b32aa70b337
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
Splunk	This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...)	Generic	stable	configuration_change	-	Cisco IOS · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Web Service	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	1abce487-f480-4d5f-a551-01de0bece0bd
	Detects access to clipboard content via osascript, which may be used for data collection but also oc (...)	Generic	test	process_creation	macos	-	Collection Clipboard Data Execution Command and Scripting Interpreter AppleScript	-	medium	Sohan G (D4rkCiph3r)	2023-01-31	2026-05-22	7794fa3c-edea-4cff-bec7-267dd4770fd7
	Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. (...)	Generic	test	process_creation	linux	Linux Auditd	Collection Clipboard Data	-	low	Pawel Mazur	2021-10-01	2022-10-09	f200dc3f-b219-425d-a17e-c38467364816
	Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. (...)	Generic	test	process_creation	linux	Sysmon	Collection Clipboard Data	-	low	Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-10-15	2022-09-15	ec127035-a636-4b9a-8555-0efd4e59f316
	Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. (...)	Generic	test	process_creation	linux	Linux Auditd	Collection Clipboard Data	-	low	Pawel Mazur	2021-09-24	2022-11-26	214e7e6c-f21b-47ff-bb6f-551b2d143fcf
	Detects execution of the "pbpaste" utility, which retrieves the contents of the clipboard (a.k.a. (...)	Hunting	test	process_creation	macos	-	Collection Clipboard Data	-	medium	Daniel Cortez	2024-07-30	—	d8af0da1-2959-40f9-a3e4-37a6aa1228b7
	Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Owner/User Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-11-10	2022-11-17	435e10e4-992a-4281-96f3-38b11106adde
	Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file	Generic	test	ps_script	windows	PowerShell	Discovery System Owner/User Discovery	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-11-17	—	db885529-903f-4c5d-9864-28fe199e6370
	Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.	Generic	experimental	-	windows	WinEventLog System	Collection Data from Local System Credential Access OS Credential Dumping Security Account Manager	-	medium	Jason Mull	2025-05-12	—	882fbe50-d8d7-4e29-ae80-0648a8556866
	Detects suspicious processes based on name and location that access the windows credential manager and vault. (...)	Generic	test	file_access	windows	-	Credential Access OS Credential Dumping	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-11	2026-07-28	407aecb1-e762-4acf-8c7b-d087bcff3bb6
	Detects the execution of clip.exe in order to copy data to the clipboard. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Clipboard Data	-	low	frack113	2021-07-27	2023-02-21	ddeff553-5233-4ae9-bbab-d64d2bd634be
Splunk	The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	26f02e96-c300-11eb-b611-acde48001122
Splunk	The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	1c34549e-c31b-11eb-996b-acde48001122
Splunk	The following analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Credential Access OS Credential Dumping	-	medium	Michael Haag, Splunk	2021-06-09	2026-05-13	8148c29c-c952-11eb-9255-acde48001122
Splunk	The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	a0bdd2f6-c2ff-11eb-b918-acde48001122
Splunk	The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	42b4b438-beed-11eb-ba1d-acde48001122
Splunk	The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	dd04b29a-beed-11eb-87bc-acde48001122
	Enumerates Active Directory to determine computers that are joined to the domain	Generic	test	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	frack113	2022-02-12	—	1f6399cf-2c80-4924-ace1-6fcff3393480

Title

Description

Category

Status

Event

Product

MITRE ATT&CK

CVEs

Severity

Author

Created

Updated

Refs

Detects file access requests to browser credential stores by uncommon processes. (...)

Hunting

test

file_access

windows

Credential Access

OS Credential Dumping

low

frack113, X__Junior (Nextron Systems)

2022-04-09

2024-07-29

91cb43db-302a-47e3-b3c8-7ede481e27bf

Detects file access requests to browser credential stores by uncommon processes. (...)

Hunting

test

file_event

windows

WinEventLog Security

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

low

Daniel Koifman (@Koifsec), Nasreddine Bencherchali

2024-10-21

—

4b60e527-ec73-4b47-8cb3-f02ad927ca65

Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)

Generic

test

ps_script

windows

PowerShell

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

medium

frack113

2022-01-30

—

fc028194-969d-4122-8abe-0470d5b8f12f

Detects file access requests to chromium based browser sensitive files by uncommon processes. (...)

Hunting

test

file_access

windows

Credential Access

OS Credential Dumping

low

X__Junior (Nextron Systems)

2024-07-29

—

c5f37810-a85f-4186-81e9-33f23abb4141

Detects file access requests to crypto currency files by uncommon processes. (...)

Generic

test

file_access

windows

Credential Access

OS Credential Dumping

medium

X__Junior (Nextron Systems)

2024-07-29

—

f41b0311-44f9-44f0-816d-dd45e39d4bc8

Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

Generic

test

ps_script

windows

PowerShell

MgBot MITRE reference S1146

MgBot MITRE reference S1146

Reach

Coverage