malware

Caminho S9016

Type: malware
Platform: Windows
Created: 16 April 2026
Last modified: 12 May 2026

Caminho is a downloader that has been used by threat actors since at least 2025 to deliver various strains of malware such as XWorm.[1]

Techniques29th pct

Tactics32nd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Caminho MITRE reference S9016

Binary Padding T1027.001 ↗

Caminho can use junk code for obfuscation.2

Stealth3 detection rules

Encrypted/Encoded File T1027.013 ↗

Caminho can use code flattening for payload obfuscation.3

Stealth1 detection rules

Process Hollowing T1055.012 ↗

Caminho has launched and hollowed out MSBuild.exe to host malicious code.4

Privilege Escalation · Stealth6 detection rules

Ingress Tool Transfer T1105 ↗

Caminho has the ability to download files onto compromised hosts.5

Command and Control131 detection rules

Native API T1106 ↗

Caminho can use System.Net.WebClient.downloadString() for file download.6

Execution14 detection rules

Deobfuscate/Decode Files or Information T1140 ↗

Caminho can deobfuscate downloaded files prior to execution.7

Stealth20 detection rules

Standing S9016

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques629th pct

29th percentile · 71% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics432nd pct

32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.

Threat group161% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns085% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique10medBottom 15%

15th percentile · 85% of 825 ATT&CK software entries have more detection rules per technique.

Tests / technique4.5med32nd pct

32nd percentile · 68% of 825 ATT&CK software entries have more atomic tests per technique.

Data comps / technique4med54% tie · 11 values

54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.

Mitigations / technique1.5med65th pct

65th percentile · 65% of 825 ATT&CK software entries have this many mitigations per technique or fewer.

5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 6 Enterprise techniques.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 127Splunk ESCU (cumulative) · 48

Standing S9016

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	Detects file creation events linked to the Axios NPM supply chain compromise. (...)	Emerging	experimental	file_event	linux	Sysmon	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	b7cb840c-11f6-47f7-b3ef-5524739c9077
	Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. (...)	Emerging	experimental	file_event	macos	-	Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	2db0458c-05c9-4069-a26f-77becd9c8c13
	Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. (...)	Emerging	experimental	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Unix Shell Python Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	0a23a62d-c5b3-468b-a072-25064a9a8c87
	Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.	Emerging	experimental	process_creation	macos	-	Execution Command and Scripting Interpreter AppleScript Unix Shell Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	a09ee860-31b3-4586-8a68-0ebd74ce0e5f
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Adversaries may use binary padding to add junk data and change the on-disk representation of malware. (...)	Generic	test	process_creation	linux	Linux Auditd	Stealth Obfuscated Files or Information Binary Padding	-	high	Igor Fits, oscd.community	2020-10-13	2023-05-03	c52a914f-3d8b-4b2a-bb75-b3991e75f8ba
	Adversaries may use binary padding to add junk data and change the on-disk representation of malware. (...)	Generic	test	process_creation	macos	-	Stealth Obfuscated Files or Information Binary Padding	-	high	Igor Fits, Mikhail Larin, oscd.community	2020-10-19	2023-02-17	95361ce5-c891-4b0a-87ca-e24607884a96
Splunk	The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer	-	medium	Michael Haag, Sittikorn S	2021-03-30	2026-10-02	80630ff4-8e4c-11eb-aab5-acde48001122
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
	Detects execution of Chromium based browser in headless mode	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Hide Artifacts Hidden Window Command and Control Ingress Tool Transfer	-	low	Nasreddine Bencherchali (Nextron Systems)	2023-09-12	—	ef9dcfed-690c-4c5d-a9d1-482cd422225c
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
Splunk	The following analytic detects the execution of curl commands with insecure flags within the Cisco Isovalent environment. (...)	Anomaly	stable	process_creation	-	Cisco	Command and Control Ingress Tool Transfer	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-10-02	c16c4899-d3f7-461b-92c2-cc0ef5758855
Splunk	This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument. (...)	Generic	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	cd0e816f-f67d-4dbe-a153-480b546e867e
Splunk	This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. (...)	Generic	stable	network_connection	-	Cisco NVM · Cisco	Initial Access Exploit Public-Facing Application Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	1984f997-3b49-4d4b-a7e9-dc5dbf88370e
Splunk	The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Command and Control Non-Standard Port Privilege Escalation, Stealth Process Injection Command and Control Remote Access Tools Lateral Movement Remote Services	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
Splunk	The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage Command and Control Ingress Tool Transfer Resource Development Obtain Capabilities Tool Command and Control Proxy External Proxy	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	f7e5e792-d907-46c1-a58e-4ff974dc462a
Splunk	The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Command and Control Non-Standard Port	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	f26445a8-a6a2-4855-bec0-0c39e52e5b8f
Splunk	The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Command and Control Encrypted Channel Asymmetric Cryptography Exfiltration Exfiltration Over C2 Channel Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	8c15183e-2e70-4db4-86c3-88f8d9129b66
Splunk	The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Exploitation for Client Execution Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	3cc93f52-5aa6-4b7f-83b9-3430b1436813
Splunk	The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-09	2026-09-22	aeff2bb5-3483-48d4-9be8-c8976194be1e
Splunk	This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	a4c76d0a-56b6-44be-814b-939746c4d406
Splunk	The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter Command and Control Ingress Tool Transfer Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	173a1cb9-1814-4128-a9dc-f29dade89957
	Various protocols maybe used to put data on the device for exfil or infil	Generic	test	authentication	-	Cisco AAA · Cisco	Collection Archive Collected Data Archive via Utility Collection Data Staged Command and Control Ingress Tool Transfer	-	low	Austin Clark	2019-08-12	2023-01-04	5e51acb2-bcbe-435b-99c6-0e3cd5e2aa59	-
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	Adversaries can use curl to download payloads remotely and execute them. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer Stealth System Binary Proxy Execution	-	high	Sreeman, Nasreddine Bencherchali (Nextron Systems)	2020-01-13	2024-03-05	21dd6d38-2b18-4453-9404-a0fe4a0cc288
Splunk	The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...)	Anomaly	stable	process_creation	windows · linux	CrowdStrike · Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer Stealth Obfuscated Files or Information	-	medium	Nasreddine Bencherchali, Splunk	2026-03-03	2026-05-13	9a8d5516-4c5e-11ef-9d42-acde48001122
	Detects a curl process start on linux, which indicates a file download from a remote location or a s (...)	Generic	test	process_creation	linux	Sysmon	Command and Control Ingress Tool Transfer	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-09-15	—	ea34fb97-e2c4-4afb-810f-785e4459b194
	Detects a curl process start on Windows, which could indicates a file download from a remote locatio (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	low	Florian Roth (Nextron Systems)	2022-07-05	2023-02-21	bbeaed61-1990-4773-bf57-b81dbad7db2d
	Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. (...)	Emerging	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Command and Control Ingress Tool Transfer	-	medium	Micah Babinski	2023-10-15	—	1a433e1d-03d2-47a6-8063-ece992cf4e73
Splunk	The following analytic detects the use of Certify or Certipy tools to enumerate Active Directory Certificate Services (AD CS) environments. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Command and Control Ingress Tool Transfer Credential Access Steal or Forge Authentication Certificates	-	medium	Steven Dick	2023-07-28	2026-05-13	e6d2dc61-a8b9-4b03-906c-da0ca75d71b8
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects the use of wget to download content to a suspicious directory	Generic	test	process_creation	linux	Sysmon	Command and Control Ingress Tool Transfer	-	medium	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	—	cf610c15-ed71-46e1-bdf8-2bd1a99de6c4
Splunk	The following analytic detects suspicious file downloads by the Telegram application on a Windows system. (...)	Generic	stable	create_stream_hash	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	Teoderick Contreras, Splunk	2021-05-07	2026-05-13	58194e28-ae5e-11eb-8912-acde48001122
	Detects download of certain file types from hosts with dynamic DNS names (selected list)	Generic	test	proxy	-	-	Command and Control Dynamic Resolution Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems)	2017-11-08	2023-05-18	195c1119-ef07-4909-bb12-e66f5e07bf3c
	Detects executable access via webdav6. (...)	Generic	test	-	-	HTTP · Zeek	Command and Control Ingress Tool Transfer	-	medium	SOC Prime, Adam Swan	2020-05-01	2021-11-27	aac2fd97-bcba-491b-ad66-a6edf89c71bf
	Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. (...)	Generic	stable	-	windows	WinEventLog Security	Stealth Obfuscated Files or Information Binary Padding	-	informational	Thomas Patzke	2019-12-03	2025-01-19	470ec5fa-7b4e-4071-b200-4c753100f49b
	Detects execution of the IEExec utility to download and execute files	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-05-16	2023-11-09	9801abb8-e297-4dbf-9fbd-57dde0e830ad
	Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-01-11	2025-10-27	94771a71-ba41-4b6e-a757-b531372eaab6
	Detects when a user downloads a file from an IP based URL using CertOC.exe	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-10-18	—	b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a
Splunk	The following analytic detects the use of download or file reading utilities from Windows, Linux or MacOS to download or read the contents of a file from a remote or local source and pipe it directly to a shell for execution. (...)	Generic	stable	process_creation	windows · linux	Sysmon · WinEventLog Security · CrowdStrike	Command and Control Ingress Tool Transfer	CVE-2021-44228	medium	Michael Haag, Nasreddine Bencherchali, Splunk, DipsyTipsy	2025-10-24	2026-09-01	26f86252-1549-45e1-a212-eb26840e86bc
	Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-10	2023-03-02	44143844-0631-49ab-97a0-96387d6b2d7c
	Detects usage of bitsadmin downloading a file	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer Stealth Masquerading Rename Legitimate Utilities	-	medium	Michael Haag, FPT.EagleEye	2017-03-09	2023-02-15	d059842b-6b9d-4ed1-b5c3-5b89143c6ede
	Detects usage of bitsadmin downloading a file to a suspicious target folder	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Persistence, Stealth BITS Jobs Command and Control Ingress Tool Transfer Stealth Masquerading Rename Legitimate Utilities	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-06-28	2025-12-10	2ddef153-167b-4e89-86b6-757a9e65dcac
	Detects when a user downloads a file by using CertOC.exe	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-05-16	2023-10-18	70ad0861-d1fe-491c-a45f-fa48148a300d
	Detects file download using curl.exe	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems)	2022-07-05	2023-02-21	9a517fca-4ba3-4629-9278-a68694697b81
	Detects the execution of the nscurl utility in order to download files.	Generic	test	process_creation	macos	-	Command and Control Ingress Tool Transfer	-	medium	Daniel Cortez	2024-06-04	—	6d8a7cf1-8085-423b-b87d-7e880faabbdf
	Detects the use of Windows Defender MpCmdRun.EXE to download files	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer Stealth System Binary Proxy Execution	-	high	Matthew Matchen	2020-09-04	2023-11-09	46123129-1024-423e-9fae-43af4a0fa9a5

Title

Description