malware

GoBear S1197

Type: malware
Platform: Windows
Created: 17 January 2025
Last modified: 17 January 2025

GoBear is a Go-based backdoor that abuses legitimate, stolen certificates for defense evasion purposes. GoBear is exclusively linked to Kimsuky operations.[1][2]

TechniquesBottom 12%

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S1197

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Standing S1197

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
Splunk	This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Command and Control Protocol Tunneling Command and Control Proxy	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	8654314d-8e4d-4971-9f35-b9d477bf668e
	Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-21	7050bba1-1aed-454e-8f73-3f46f09ce56a
	Detects execution of the "cloudflared" tool to connect back to a tunnel. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-20	9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	3ab65069-d82a-4d44-a759-466661a082d1
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	c4568f5d-131f-4e78-83d4-45b2da0ec4f1
	Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfi (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	—	19bf6fdb-7721-4f3d-867f-53467f6a5db6
	Detects an executable initiating a network connection to "ngrok" tunneling domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	2024-02-02	1d08ac94-400d-4469-a82f-daee9a908849
	Detects setting proxy configuration	Generic	test	process_creation	linux	Sysmon	Command and Control Proxy	-	low	Ömer Günal	2020-06-17	2022-10-05	72f4ab3f-787d-495d-a55d-68c2ff46cf4c	-
	Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	a80d927d-ac6e-443f-a867-e8d6e3897318
	Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	CVE-2015-1641	critical	Florian Roth (Nextron Systems)	2018-02-22	2021-11-27	7993792c-5ce2-4475-a3db-a3a5539827ef
	Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-06-24	—	13c02350-4177-4e45-ac17-cf7ca628ff5e
	Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)	2020-05-26	2026-07-28	d5866ddf-ce8f-4aea-b28e-d96485a20d3d
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Syma (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Stealth Masquerading Match Legitimate Resource Name or Location	-	critical	Florian Roth (Nextron Systems)	2020-05-20	2023-03-09	3711eee4-a808-4849-8a14-faf733da3612
	Detects executable names or flags used by Htran or Htran-like tools (e.g. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	high	Florian Roth (Nextron Systems)	2022-12-27	2023-02-04	f5e3b62f-e577-4e59-931e-0a15b2b94e1e
	Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter PowerShell Command and Control Encrypted Channel Command and Control Proxy	-	high	Arda Buyukkaya (EclecticIQ)	2025-02-11	—	e99375eb-3ee0-407a-9f90-79569cc6a01c
	Detects binaries used by the Lazarus group which use system names but are executed and launched from (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)	2020-06-03	2023-03-10	3f7f5b0b-5b16-476c-a85f-ab477f6dd24b
Splunk	The following analytic detects the use of Ngrok on a Linux operating system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Michael Haag, Splunk	2023-01-12	2026-05-13	bc84d574-708c-467d-b78a-4c1e20171f97
Splunk	The following analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`. (...)	Generic	stable	process_creation	linux	Sysmon	Command and Control Non-Application Layer Protocol Command and Control Proxy	-	medium	Michael Haag, Splunk, 0xC0FFEEEE, Github Community	2022-07-29	2026-06-04	bd596c22-ad1e-44fc-b242-817253ce8b08
	Indicates sign-in from a malicious IP address based on high failure rates.	Generic	test	-	-	Azure Risk Detection · Azure	Command and Control Proxy	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-07	—	a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd
	Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.	Generic	test	-	-	Azure Risk Detection · Azure	Command and Control Proxy	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-07	—	36440e1c-5c22-467a-889b-593e66498472
	Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	medium	Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel	2019-01-29	2023-09-01	322ed9ec-fcab-4f67-9a34-e7c6aef43614
	Detects the modification of the PortProxy registry key which is used for port forwarding.	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	medium	Andreas Hunkeler (@Karneades)	2021-06-22	2024-03-25	a54f842a-3713-4b45-8c84-5f136fdebd3c
Splunk	The following analytic detects DNS queries to common Ngrok domains, indicating potential use of the Ngrok reverse proxy tool. (...)	Anomaly	stable	dns	windows	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Michael Haag, Splunk	2022-11-16	2026-05-13	5790a766-53b8-40d3-a696-3547b978fcf0
	Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which cou (...)	Generic	test	-	windows	Terminal Services	Command and Control Proxy	-	high	Florian Roth (Nextron Systems)	2022-04-29	—	64d51a51-32a6-49f0-9f3d-17e34d640272
Splunk	Remote Employment Fraud (REF) actors will often use virtual private networks (VPNs) to conceal their true physical location. (...)	Generic	experimental	authentication	-	Okta	Command and Control Protocol Tunneling Command and Control Proxy Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Marissa Bower, Raven Tait	2025-06-12	2026-05-13	58eb9f80-896c-42f8-86c6-27ab59026c9c	-
	Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.	Generic	test	-	-	OpenCanary	Command and Control Proxy	-	high	Security Onion Solutions	2024-03-08	—	5498fc09-adc6-4804-b9d9-5cca1f0b8760
	Detects binaries that use the same name as legitimate sysinternals tools to evade detection. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Indirect Command Execution Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	medium	frack113, Swachchhanda Shrawan Poudel (Nextron Systems)	2021-12-20	2025-04-12	7cce6fc8-a07f-4d84-a53e-96e1879843c9
	Detects the execution of msiexec.exe from an uncommon directory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Florian Roth (Nextron Systems)	2019-11-14	2023-02-21	e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144
	Detects files that have extensions commonly seen while SDelete is used to wipe files.	Generic	test	-	windows	WinEventLog Security	Impact Data Destruction Stealth Indicator Removal File Deletion Stealth Obfuscated Files or Information Indicator Removal from Tools Defense Impairment Subvert Trust Controls Code Signing	-	medium	Thomas Patzke	2017-06-14	2024-12-13	39a80702-d7ca-4a83-b776-525b1f86a36d
	Detects the modification of the wsl.exe binary from its installed location. (...)	Generic	experimental	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	medium	Liran Ravich, Swachchhanda Shrawan Poudel (Nextron Systems)	2026-05-05	—	2f400434-01e1-416b-b52c-bb5bfbb9eb78
	Detects potentially suspicious execution of the Qemu utility in a Windows environment. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy	-	medium	Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)	2024-06-03	—	5fc297ae-25b6-488a-8f25-cc12ac29b744
	Detects the use of Fast Reverse Proxy. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	high	frack113, Florian Roth	2022-09-02	2024-11-23	32410e29-5f94-4568-b6a3-d91a8adad863
	Detects the use of NPS, a port forwarding and intranet penetration proxy server	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	high	Florian Roth (Nextron Systems)	2022-10-08	2024-11-23	68d37776-61db-42f5-bf54-27e87072d17e
	Detects the use of IOX - a tool for port forwarding and intranet proxy purposes	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	high	Florian Roth (Nextron Systems)	2022-10-08	2024-11-23	d7654f02-e04b-4934-9838-65c46f187ebc
	Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	high	Florian Roth (Nextron Systems), oscd.community	2019-01-29	2023-02-13	782d6f3e-4c5d-4b8c-92a3-1d05fed72e63
	Detects two stages of the RedSun post-exploitation process chain that deliver a SYSTEM-level shell to the attacker's interactive session. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Create Process with Token Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost	2026-04-17	—	2ad78473-6978-40f5-b8f1-89c7e1c27a1a
	Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.ex (...)	Emerging	experimental	-	windows	Windows Defender	Defense Impairment Disable or Modify Tools Stealth Masquerading Match Legitimate Resource Name or Location Privilege Escalation, Stealth Process Injection	-	critical	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-17	—	a7c3e5f2-8b1d-4e9a-b6c2-3d7f5e8a9b4c
	Detects the creation of a file named TieringEngineService.exe inside a directory whose path contains (...)	Emerging	experimental	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	critical	Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost	2026-04-17	—	f2e4b7d9-5c3a-4f8b-9e1d-7a6c2b3f4e5d
	Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Masquerade Task or Service Match Legitimate Resource Name or Location Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-02-05	—	9f8573c9-22b4-40e3-89c1-72bc2b8d49ab
	Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.	Generic	test	-	-	Azure Risk Detection · Azure	Command and Control Proxy	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	821b4dc3-1295-41e7-b157-39ab212dd6bd
	Detects filename indicators that contain a specific typo seen used by the Small Sieve malware.	Emerging	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)	2023-05-19	—	39466c42-c189-476a-989f-8cdb135c163a
	Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	elhoim	2022-04-28	—	5f87308a-0a5b-4623-ae15-d8fa1809bc60
	Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Swachchhanda Shrawan Poudel	2024-08-07	—	be58d2e2-06c8-4f58-b666-b99f6dc3b6cd
	Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task	-	medium	Swachchhanda Shrawan Poudel, Elastic (idea)	2023-04-20	2024-12-01	dd2a821e-3b07-4d3b-a9ac-929fe4c6ca0c
	Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling act (...)	Generic	test	ps_script	windows	PowerShell	Command and Control Proxy	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-07-08	—	bd33d2aa-497e-4651-9893-5c5364646595
	Detects C:\Windows\System32\wsl.exe spawning a child wsl.exe process from outside the legitimate WSL install locations. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-05-05	—	88d306e9-8e2d-4025-9768-28757d2732db
	Detects execution of masqueraded wsl.exe binary. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Stealth System Binary Proxy Execution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-05-05	—	530576ee-3b62-4bce-9a03-9aac6c61788a
	Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location Privilege Escalation, Stealth Process Injection Process Hollowing	-	high	Liran Ravich	2025-11-14	2026-03-23	f17211f1-1f24-4d0c-829f-31e28dc93cdd

Title

Description

GoBear S1197

GoBear S1197

GoBear MITRE reference S1197

Standing S1197

Reach

Coverage

GoBear MITRE reference S1197

Standing S1197

Reach

Coverage

GoBear detections S1197