SplatCloak has used a revoked certificate to exploit Windows driver execution policy where certificates issued before a specific date could still load.2
tool
SplatCloak S1234
- Type
- malware
- Platform
- Windows
- Created
- 12 September 2025
- Last modified
- 21 October 2025
SplatCloak is a malware that disables EDR-related routines used by Windows Defender and Kaspersky to aid in evading detection. SplatCloak has been deployed by SplatDropper and is known to be leveraged by Mustang Panda since 2025.[1]
6
Techniques29th pct
4
Tactics32nd pct
1
Threat groupunranked
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference S1234
SplatCloak has collected the Windows build number using the windows kernel API RtlGetVersion to determine if the response is 19000 or higher (Windows 10 version 2004 or later).3
SplatCloak has used Windows API to identify files associated with Windows Defender and Kaspersky.4
SplatCloak has utilized Native Windows API calls dynamically through ZwQuerySystemInformation.5
SplatCloak has identified drivers of AV solutions by searching for related filenames, keywords and signed certificates.6
SplatCloak has identified and disabled API callback features of Windows Defender and Kaspersky.7
Standing S1234
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques629th pct
29th percentile · 71% of 825 ATT&CK software entries have more Enterprise techniques.
Tactics432nd pct
32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.
Threat group161% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaigns085% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique21.5med50th pct
50th percentile · 50% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique10.5med
Detection coverage S1234
388 distinct rules cover the 6 techniques recorded for this tool. The 394 technique-to-rule mappings resolve to 388 distinct rules, because one rule can cover several techniques. 243 Sigma · 145 Splunk.
5 covered by at least one rule1 with no coverage388 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org