malware

PAKLOG S1233

Type: malware
Platform: Windows
Created: 12 September 2025
Last modified: 21 October 2025

PAKLOG is a keylogger known to be leveraged by Mustang Panda and was first observed utilized in 2024. PAKLOG is deployed via a RAR archive (e.g., key.rar), which contains two files: a signed, legitimate binary (PACLOUD.exe) and the malicious PAKLOG DLL (pa_lang2.dll). The PACLOUD.exe binary is used to side-load the PAKLOG DLL which starts with the keylogger functionality.[1]

Techniques47th pct

Tactics53rd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S1233

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	critical	Florian Roth (Nextron Systems)	2018-09-03	2023-03-09	9aa01d62-7667-4d3b-acb8-8cb5103e2014
	Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-22	2023-03-15	90ae0469-0cee-4509-b67f-e5efcef040f7
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
	Detects access to clipboard content via osascript, which may be used for data collection but also oc (...)	Generic	test	process_creation	macos	-	Collection Clipboard Data Execution Command and Scripting Interpreter AppleScript	-	medium	Sohan G (D4rkCiph3r)	2023-01-31	2026-05-22	7794fa3c-edea-4cff-bec7-267dd4770fd7
	Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. (...)	Generic	test	process_creation	linux	Linux Auditd	Collection Clipboard Data	-	low	Pawel Mazur	2021-10-01	2022-10-09	f200dc3f-b219-425d-a17e-c38467364816
	Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. (...)	Generic	test	process_creation	linux	Sysmon	Collection Clipboard Data	-	low	Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC	2021-10-15	2022-09-15	ec127035-a636-4b9a-8555-0efd4e59f316
	Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. (...)	Generic	test	process_creation	linux	Linux Auditd	Collection Clipboard Data	-	low	Pawel Mazur	2021-09-24	2022-11-26	214e7e6c-f21b-47ff-bb6f-551b2d143fcf
	Detects execution of the "pbpaste" utility, which retrieves the contents of the clipboard (a.k.a. (...)	Hunting	test	process_creation	macos	-	Collection Clipboard Data	-	medium	Daniel Cortez	2024-07-30	—	d8af0da1-2959-40f9-a3e4-37a6aa1228b7
	Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2020-7315	medium	Nasreddine Bencherchali (Nextron Systems), fornotes	2022-12-01	2026-01-24	df6ecb8b-7822-4f4b-b412-08f524b4576c
	Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	frack113	2022-05-09	2026-05-18	28a452f3-786c-4fd8-b8f2-bddbe9d616d1
	Detects the execution of clip.exe in order to copy data to the clipboard. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Clipboard Data	-	low	frack113	2021-07-27	2023-02-21	ddeff553-5233-4ae9-bbab-d64d2bd634be
	Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Dimitrios Slamaris	2017-05-15	2023-08-17	9d3436ef-9476-4c43-acca-90ce06bdf33a
	This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be lo (...)	Generic	test	-	windows	WinEventLog System	Execution, Stealth Hijack Execution Flow DLL	-	high	Dimitrios Slamaris, @atc_project (fix)	2017-05-15	2022-12-25	75edd3fd-7146-48e5-9848-3013d7f0282c
	This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded	Generic	test	-	windows	WinEventLog System	Execution, Stealth Hijack Execution Flow DLL	-	high	Dimitrios Slamaris	2017-05-15	2022-12-25	13fc89a9-971e-4ca6-b9dc-aa53a445bf40
	Detects DLL sideloading activity seen used by Diamond Sleet APT	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2023-42793	high	Nasreddine Bencherchali (Nextron Systems)	2023-10-24	—	d1b65d98-37d7-4ff6-b139-2d87c1af3042
	Identifies use of various commands to query a systems time. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Time Discovery	-	low	E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community	2019-10-24	2022-06-28	b243b280-65fe-48df-ba07-6ddea7646427
	Hunts known SVR-specific DLL names.	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	CISA	2023-12-18	—	e64c8ef3-9f98-40c8-b71e-96110991cb4c
	Detects when an attacker create a similar folder structure to windows system folders such as (Window (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	frack113, Nasreddine Bencherchali (Nextron Systems)	2022-07-30	—	b6f91281-20aa-446a-b986-38a92813a18f
	Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which m (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-08-02	—	ebea773c-a8f1-42ad-a856-00cb221966e8
	Detects processes loading the non-existent DLL "ShellChromeAPI". (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-12-01	—	ee4c5d06-3abc-48cc-8885-77f1c20f4451
	Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded	Generic	test	-	windows	DNS Server	Execution, Stealth Hijack Execution Flow DLL	-	high	Florian Roth (Nextron Systems)	2017-05-08	2023-02-05	cbe51394-cd93-4473-b555-edf0144952d9
	The Fax service attempts to load ualapi.dll, which is non-existent. (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	NVISO	2020-05-04	2022-06-02	828af599-4c53-4ed2-ba4a-a9f835c434ea
	Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data Staged Local Data Staging	-	medium	Nasreddine Bencherchali (Nextron Systems), frack113	2021-07-20	2022-10-09	85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98
	Detects a typical pattern of a CobaltStrike BOF which inject into other processes	Generic	test	process_access	windows	Sysmon	Defense Impairment Disable or Modify Tools Execution Native API	-	high	Christian Burkard (Nextron Systems)	2021-08-04	2023-11-28	09706624-b7f6-455d-9d02-adee024cee1d
	Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening an (...)	Generic	test	process_access	windows	Sysmon	Execution Native API Credential Access OS Credential Dumping LSASS Memory	-	high	Bhabesh Raj (rule), @thefLinkk	2022-06-27	2023-11-28	b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5
	Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, ker (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery File and Directory Discovery Discovery Process Discovery Discovery Query Registry Discovery System Information Discovery Discovery System Service Discovery	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-10-10	2024-11-23	fca949cc-79ca-446e-8064-01aa7e52ece5
	Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Subhash Popuri (@pbssubhash)	2021-08-21	2024-06-27	602a1f13-c640-4d73-b053-be9a2fa58b96
	Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Execution Native API Stealth System Binary Proxy Execution Rundll32	-	high	Alexander Rausch	2020-06-24	2023-03-01	95022b85-ff2a-49fa-939a-d7b8f56eeb9b
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a
	Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospa (...)	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Thurein Oo, Nasreddine Bencherchali (Nextron Systems)	2023-10-18	—	24007168-a26b-4049-90d0-ce138e13a5cf
Splunk	The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Collection Clipboard Data	-	medium	Teoderick Contreras, Splunk	2022-06-17	2026-10-02	9ddfe470-c4d0-4e60-8668-7337bd699edd
Splunk	The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. (...)	Anomaly	stable	process_creation	linux	Sysmon	Collection Clipboard Data	-	medium	Michael Haag, Splunk	2022-06-17	2026-10-02	7173b2ad-6146-418f-85ae-c3479e4515fc
	Detect attempt to enable auditing of TTY input	Generic	test	file_event	linux	Linux Auditd	Credential Access, Collection Input Capture Keylogging Credential Access OS Credential Dumping	-	high	Pawel Mazur	2021-05-24	2022-12-18	49aae26c-450e-448b-911d-b3c13d178dfc
	Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upo (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	frack113	2022-08-12	—	1908fcc1-1b92-4272-8214-0fbaf2fa5163
	Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) fro (...)	Generic	test	-	windows	Security Mitigations	Execution, Stealth Hijack Execution Flow DLL	-	high	Bhabesh Raj	2022-08-02	2022-09-28	0b0ea3cc-99c8-4730-9c53-45deee2a4c86
	Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)	2022-08-17	2023-03-15	829a3bdf-34da-4051-9cf4-8ed221a8ae4f
Splunk	The following analytic detects the loading of `msi.dll` by a binary not located in `system32`, `syswow64`, `winsxs`, or `windows` directories. (...)	Hunting	stable	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2021-41379	medium	Michael Haag, Splunk	2021-12-08	2026-05-13	ccb98a66-5851-11ec-b91c-acde48001122
Splunk	The following analytic detects the suspicious creation of msmpeng.exe or mpsvc.dll in non-default Windows Defender folders. (...)	Generic	stable	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	Teoderick Contreras, Splunk, Sanjay Govind	2021-07-05	2026-05-13	8bb3f280-dd9b-11eb-84d5-acde48001122
	Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which c (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Florian Roth (Nextron Systems)	2017-05-08	2023-08-17	e61e8a88-59a9-451c-874e-70fcc9740d67
	Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which c (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Florian Roth (Nextron Systems)	2017-05-08	2023-02-05	f63b56ee-3f79-4b8a-97fb-5c48007e8573
	Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave r (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	high	Bhabesh Raj	2021-05-05	2023-02-17	b2400ffb-7680-47c0-b08a-098a7de7e7a9
	Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave r (...)	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Bhabesh Raj	2021-05-05	2023-02-17	35a7dc42-bc6f-46e0-9f83-81f8e56c8d4b
	Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave r (...)	Emerging	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Bhabesh Raj	2021-05-05	2023-02-17	2bd63d53-84d4-4210-80ff-bf0658f1bf78
	Detects potential DLL sideloading of "7za.dll"	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	low	X__Junior	2023-06-09	—	4f6edb78-5c21-42ab-a558-fd2a6fc1fd57
	Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symante (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)	2022-08-17	2025-10-07	552b6b65-df37-4d3e-a258-f2fc4771ae54
	Detects potential DLL sideloading of "appverifUI.dll"	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	X__Junior (Nextron Systems)	2023-06-20	—	ee6cea48-c5b6-4304-a332-10fc6446f484
	Detects potential DLL sideloading of "AVKkid.dll"	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	X__Junior (Nextron Systems)	2023-08-03	—	952ed57c-8f99-453d-aee0-53a49c22f95d
	Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	low	Den Iuzvyk	2020-07-15	2023-04-18	50f852e6-af22-4c78-9ede-42ef36aa3453

Title

Description

PAKLOG S1233

PAKLOG S1233

PAKLOG MITRE reference S1233

Standing S1233

Reach

Coverage

PAKLOG detections S1233