malware

UPSTYLE S1164

Type: malware
Platforms: Network Devices, Linux
Created: 20 November 2024
Last modified: 15 April 2025

UPSTYLE is a Python-based backdoor associated with exploitation of Palo Alto firewalls using CVE-2024-3400 in early 2024. UPSTYLE has only been observed in relation to this exploitation activity, which involved attempted install on compromised devices by the threat actor UTA0218.[1][2]

Techniques54th pct

Tactics68th pct

Threat groupsNone recorded

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S1164

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
	See what files are being deleted from flash file systems	Generic	test	authentication	-	Cisco AAA · Cisco	Impact Disk Wipe Disk Content Wipe Disk Structure Wipe Stealth Indicator Removal File Deletion	-	medium	Austin Clark	2019-08-12	2023-01-04	71d65515-c436-43c0-841b-236b1f32c21e	-
Splunk	This analytic detects network connections initiated by binaries that are not typically associated wi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Stealth Masquerading Privilege Escalation, Stealth Process Injection	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	c6db35af-8a0e-4b61-88ed-738e66f15715
	Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR), (4 is SYSLOG_ACTIO (...)	Generic	experimental	process_creation	linux	Linux Auditd	Defense Impairment Disable or Modify Tools Clear Linux or Mac System Logs	-	medium	Milad Cheraghi	2025-05-27	2025-12-05	eca5e022-d368-4043-98e5-9736fb01f72f
Splunk	The following analytic detects the execution of `cipher.exe` with the `/w` flag to clear unallocated sectors on a disk. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2021-06-10	2026-05-13	cd80a6ac-c9d9-11eb-8839-acde48001122
	Detects a CodePage modification using the "mode.com" utility. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	low	Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk	2024-01-19	—	d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e
	Detects a CodePage modification using the "mode.com" utility to Russian language. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	medium	Joseliyo Sanchez, @Joseliyo_Jstnk	2024-01-17	—	12fbff88-16b5-4b42-9754-cd001a789fb3
	Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Persistence, Privilege Escalation Event Triggered Execution	-	high	Omkar Gudhate	2020-09-27	2023-09-28	07743f65-7ec9-404a-a519-913db7118a8d
	Detects the malicious use of a control panel item	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution Stealth System Binary Proxy Execution Control Panel	-	high	Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)	2020-06-22	2023-10-11	0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
	Detects uses of the createdump.exe LOLOBIN utility to dump process memory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-01-04	2022-08-19	515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
	Detects execution of the builtin "rmdir" command in order to delete directories. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	low	frack113	2022-01-15	2023-03-07	41ca393d-538c-408a-ac27-cf1e038be80c
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of t (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	medium	Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)	2022-04-06	2023-04-12	dee0a7a3-f200-4112-a99b-952196d81e42
	Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022. (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Python	-	high	@kostastsale	2022-04-22	2024-08-15	1f32d820-1d5c-43fe-8fe2-feef0c952eb7
Splunk	This detection identifies a significant change to the system clock on an ESXi host, which may indica (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Stealth Indicator Removal Timestomp	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	910df401-b215-4675-88c5-2ad7b06d82a5	-
Splunk	The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. (...)	Anomaly	stable	file_event	windows	Sysmon	Stealth Masquerading	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-08-14	a7e3f0f0-ae42-11eb-b245-acde48001122
Splunk	The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. (...)	Anomaly	stable	file_event	windows	Sysmon	Stealth Masquerading	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-08-14	e0422b71-2c05-4f32-8754-01fb415f49c9
	Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, whic (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	medium	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber	2019-06-29	2025-10-31	949f1ffb-6e85-4f00-ae1e-c3c5b190d605
	Detects when the file creation time is changed to a year before 2020. (...)	Hunting	test	file_change	windows	Sysmon	Stealth Indicator Removal Timestomp	-	low	frack113, Florian Roth (Nextron Systems)	2022-08-12	2026-01-20	558eebe5-f2ba-4104-b339-36f7902bcc1a
	Detects the deletion of files by the Sysinternals SDelete utility. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2023-02-15	6ddab845-b1b8-49c2-bbf7-1a11967f64bc
	Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries t (...)	Generic	stable	process_creation	linux	Sysmon	Stealth Indicator Removal File Deletion	-	informational	Ömer Günal, oscd.community	2020-10-07	2022-09-15	30aed7b6-d2c1-4eaf-9382-b6bc43e50c57
	Detects execution of the builtin "del"/"erase" commands in order to delete files. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	low	frack113	2022-01-15	2024-03-05	379fa130-190e-4c3f-b7bc-6c8e834485f3
	Detect file time attribute change to hide new or changes to existing files	Generic	test	process_creation	macos	-	Stealth Indicator Removal Timestomp	-	medium	Igor Fits, Mikhail Larin, oscd.community	2020-10-19	2022-01-12	88c0f9d8-30a8-4120-bb6b-ebb54abcf2a0
	Detect file time attribute change to hide new or changes to existing files.	Generic	test	process_creation	linux	Linux Auditd	Stealth Indicator Removal Timestomp	-	medium	Igor Fits, oscd.community	2020-10-15	2022-11-28	b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b
	Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indirect Command Execution Stealth Masquerading Stealth Obfuscated Files or Information Steganography	-	medium	Trent Liffick	2020-05-01	2024-01-15	33339be3-148b-4e16-af56-ad16ec6c7e7b
	Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading	-	high	Nasreddine Bencherchali (Nextron Systems), Anish Bogati	2024-01-05	—	f53714ec-5077-420e-ad20-907ff9bb2958
	Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indicator Removal File Deletion	-	medium	frack113 , X__Junior (Nextron Systems)	2021-12-02	2023-09-11	204b17ae-4007-471b-917b-b917b315c5db
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	Detects suspicious use of XORDump process memory dumping utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-01-28	2023-02-08	66e563f9-1cbd-4a22-a957-d8b7c0f44372
	Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exch (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution Execution, Persistence, Privilege Escalation Scheduled Task/Job	-	critical	Florian Roth (Nextron Systems)	2021-03-09	2023-03-09	bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7
	Detects deletion of local audit logs	Generic	test	process_creation	macos	-	Defense Impairment Disable or Modify Tools Clear Linux or Mac System Logs	-	medium	remotephone, oscd.community	2020-10-11	2022-09-16	acf61bd8-d814-4272-81f0-a7a269aa69aa
	Detects suspicious interactive bash as a parent to rather uncommon child processes	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Stealth Masquerading	-	medium	Florian Roth (Nextron Systems)	2022-03-14	—	ea3ecad2-db86-4a89-ad0b-132a10d2db55
Splunk	The following analytic detects the deletion of SSH keys on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	73a56508-1cf5-4df7-b8d9-5737fbdc27d2
Splunk	The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Deobfuscate/Decode Files or Information	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	5890ba10-4e48-4dc0-8a40-3e1ebe75e737
	Detects suspicious process command line that uses base64 encoded input for execution with a shell	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	pH-T (Nextron Systems)	2022-07-26	2023-06-16	ba592c6d-6888-43c3-b8c6-689b8fe47337
	Detects the presence of a base64 version of the shebang in the commandline, which could indicate a m (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-15	—	fe2f9663-41cb-47e2-b954-8a228f3b9dff
Splunk	The following analytic detects the deletion of cron jobs on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	3b132a71-9335-4f33-9932-00bb4f6ac7e8
Splunk	The following analytic detects the deletion of init daemon scripts on a Linux machine. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	729aab57-d26f-4156-b97f-ab8dda8f44b1
Splunk	The following analytic detects the deletion of services on a Linux machine. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	b509bbd3-0331-4aaa-8e4a-d2affe100af6
Splunk	The following analytic detects the deletion of SSL certificates on a Linux machine. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	839ab790-a60a-4f81-bfb3-02567063f615
Splunk	The following analytic detects a high frequency of file deletions in the /boot/ folder on Linux systems. (...)	Generic	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	e27fbc5d-0445-4c4a-bc39-87f060d5c602
Splunk	The following analytic detects a high frequency of file deletions in the /etc/ folder on Linux systems. (...)	Anomaly	stable	file_event	linux	Sysmon	Impact Data Destruction Stealth Indicator Removal File Deletion	-	medium	Teoderick Contreras, Splunk	2022-04-12	2026-05-13	9d867448-2aff-4d07-876c-89409a752ff8

Title

Description

UPSTYLE S1164

UPSTYLE S1164

UPSTYLE MITRE reference S1164

Standing S1164

Reach

Coverage

UPSTYLE detections S1164