malware

ROAMINGHOUSE S9026

Type: malware
Platform: Windows
Created: 17 April 2026
Last modified: 12 May 2026

ROAMINGHOUSE is a dropper malware used by MirrorFace to extract and execute embedded payloads including UPPERCUT components.[1]

Techniques51st pct

Tactics41st pct

Threat groupunranked

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S9026

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects the removal or uninstallation of an application via "Wmic.EXE".	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	frack113	2022-01-28	2024-07-02	b53317a0-8acf-4fd1-8de8-a5401e776b96
	Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-11	—	49d9671b-0a0a-4c09-8280-d215bfd30662
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	critical	Florian Roth (Nextron Systems)	2018-09-03	2023-03-09	9aa01d62-7667-4d3b-acb8-8cb5103e2014
	Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-22	2023-03-15	90ae0469-0cee-4509-b67f-e5efcef040f7
Splunk	The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). (...)	Generic	stable	authentication	-	Microsoft 365	Initial Access Phishing Spearphishing Link Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2023-11-16	2026-05-13	d68d8732-6f7e-4ee5-a6eb-737f2b990b91
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the creation of a batch file (.bat) within the Windows system directory tree, specifically in the System32 or SysWOW64 folders. (...)	Anomaly	stable	file_event	windows	Sysmon	Execution User Execution Malicious File	-	medium	Steven Dick, Michael Haag, Rico Valdez, Splunk	2020-04-29	2026-07-02	503d17cb-9eab-4cf8-a20e-01d5c6987ae3	-
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2022-10-09	c3198a27-23a0-4c2c-af19-e5328d49680e
	Attempts to detect system changes made by Blue Mockingbird	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Defense Impairment Modify Registry Execution Windows Management Instrumentation	-	high	Trent Liffick (@tliffick)	2020-05-14	2023-08-17	92b0b372-a939-44ed-a11b-5136cf680e27
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
Splunk	This analytic detects script execution (`wscript.exe` or `cscript.exe`) triggered from compressed fi (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Execution Command and Scripting Interpreter Visual Basic Execution User Execution Malicious File	-	medium	Nasreddine Bencherchali, Splunk	2025-07-01	2026-09-22	8b07c2c9-0cde-4c44-9fa6-59dcf2b25777
	Detects CLR DLL being loaded by an Office Product	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	medium	Antonlovesdnb	2020-02-19	2023-03-29	d13c43f0-f66b-4279-8b2c-5912077c1780
	Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-08	2023-02-14	9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f
	Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2020-7315	medium	Nasreddine Bencherchali (Nextron Systems), fornotes	2022-12-01	2026-01-24	df6ecb8b-7822-4f4b-b412-08f524b4576c
	Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	frack113	2022-05-09	2026-05-18	28a452f3-786c-4fd8-b8f2-bddbe9d616d1
	Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Dimitrios Slamaris	2017-05-15	2023-08-17	9d3436ef-9476-4c43-acca-90ce06bdf33a
	This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be lo (...)	Generic	test	-	windows	WinEventLog System	Execution, Stealth Hijack Execution Flow DLL	-	high	Dimitrios Slamaris, @atc_project (fix)	2017-05-15	2022-12-25	75edd3fd-7146-48e5-9848-3013d7f0282c
	This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded	Generic	test	-	windows	WinEventLog System	Execution, Stealth Hijack Execution Flow DLL	-	high	Dimitrios Slamaris	2017-05-15	2022-12-25	13fc89a9-971e-4ca6-b9dc-aa53a445bf40
	Detects DLL sideloading activity seen used by Diamond Sleet APT	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2023-42793	high	Nasreddine Bencherchali (Nextron Systems)	2023-10-24	—	d1b65d98-37d7-4ff6-b139-2d87c1af3042
	Hunts known SVR-specific DLL names.	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	CISA	2023-12-18	—	e64c8ef3-9f98-40c8-b71e-96110991cb4c
	Detects when an attacker create a similar folder structure to windows system folders such as (Window (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	frack113, Nasreddine Bencherchali (Nextron Systems)	2022-07-30	—	b6f91281-20aa-446a-b986-38a92813a18f
	Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which m (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-08-02	—	ebea773c-a8f1-42ad-a856-00cb221966e8
	Detects processes loading the non-existent DLL "ShellChromeAPI". (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-12-01	—	ee4c5d06-3abc-48cc-8885-77f1c20f4451
	Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded	Generic	test	-	windows	DNS Server	Execution, Stealth Hijack Execution Flow DLL	-	high	Florian Roth (Nextron Systems)	2017-05-08	2023-02-05	cbe51394-cd93-4473-b555-edf0144952d9
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects any assembly DLL being loaded by an Office Product	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	medium	Antonlovesdnb	2020-02-19	2023-03-29	ff0f2b05-09db-4095-b96d-1b75ca24894a
	Detects download of certain file types from hosts in suspicious TLDs	Generic	test	proxy	-	-	Execution Exploitation for Client Execution Initial Access Phishing Execution User Execution Malicious File	-	low	Florian Roth (Nextron Systems)	2017-11-07	2023-05-18	00d0b5ab-1f55-4120-8e83-487c0a7baf19
	Detects executable downloads from suspicious remote systems	Generic	test	proxy	-	-	Execution Exploitation for Client Execution Initial Access Phishing Execution User Execution Malicious File	-	low	Florian Roth (Nextron Systems)	2017-03-13	2023-05-18	b5de2919-b74a-4805-91a7-5049accbaefe
Splunk	The following analytic detects the dropping of a suspicious file named "license.dat" in %appdata% or %programdata%. (...)	Hunting	stable	file_event	windows	Sysmon	Execution User Execution Malicious File	-	medium	Teoderick Contreras, Splunk	2021-08-05	2026-05-13	b7a045fc-f14a-11eb-8e79-acde48001122
	Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.ex (...)	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution Initial Access Phishing Spearphishing Attachment Execution User Execution Malicious File	CVE-2017-11882	critical	Florian Roth (Nextron Systems)	2017-11-23	2021-11-27	678eb5f4-8597-4be6-8be7-905e4234b53a
	Detects outbound web proxy requests to URLs matching the EvilTokens Phishing-as-a-Service (PhaaS) kit infrastructure. (...)	Emerging	experimental	proxy	-	-	Initial Access Phishing Spearphishing Link	-	low	uniqu3-us3r	2026-04-28	—	e0e121d0-be4d-4281-af7e-17abbba4a408
	Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and C (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution Initial Access Phishing Spearphishing Attachment Execution User Execution Malicious File	CVE-2017-0261 CVE-2017-0262	medium	Florian Roth (Nextron Systems)	2018-02-22	2021-11-27	864403a1-36c9-40a2-a982-4c9a45f7d833
	Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Exploitation for Client Execution Initial Access Phishing Spearphishing Attachment Execution User Execution Malicious File	CVE-2017-8759	critical	Florian Roth (Nextron Systems)	2017-09-15	2021-11-27	fdd84c68-a1f6-47c9-9477-920584f94905
	The Fax service attempts to load ualapi.dll, which is non-existent. (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	NVISO	2020-05-04	2022-06-02	828af599-4c53-4ed2-ba4a-a9f835c434ea
	This rule will monitor executable and script file creation by office applications. (...)	Unsupported	experimental	file_event	windows	Sysmon	Stealth System Binary Proxy Execution Regsvr32 Execution User Execution Malicious File Execution Windows Management Instrumentation	-	high	Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule)	2021-08-23	2022-06-02	8c6fd6fc-28fc-4597-a86a-fc1de20b039d
	Detects the creation of files with an executable or script extension by an Office application.	Generic	test	file_event	windows	Sysmon	Execution User Execution Malicious File	-	high	Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems)	2021-08-23	2025-10-17	c7a74c80-ba5a-486e-9974-ab9e682bc5e4
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects any GAC DLL being loaded by an Office Product	Generic	test	image_load	windows	Sysmon	Execution User Execution Malicious File	-	high	Antonlovesdnb	2020-02-19	2023-02-10	90217a70-13fc-48e4-b3db-0d836c5824ac
	This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Brute Force Execution Command and Scripting Interpreter PowerShell Windows Command Shell Discovery Password Policy Discovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-03-08	42a993dd-bb3e-48c8-b372-4d6684c4106c
	Detects various execution patterns of the CrackMapExec pentesting framework	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Thomas Patzke	2020-05-22	2023-11-06	058f4380-962d-40a5-afce-50207d36d7e2
	Detects the process injection of a LittleCorporal generated Maldoc.	Generic	test	process_access	windows	Sysmon	Privilege Escalation, Stealth Process Injection Thread Execution Hijacking Execution User Execution Malicious File	-	high	Christian Burkard (Nextron Systems)	2021-08-09	2023-11-28	7bdde3bf-2a42-4c39-aa31-a92b3e17afac
	Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Remote Services Distributed Component Object Model Execution Windows Management Instrumentation	-	high	Ecco, oscd.community, Jonhnathan Ribeiro, Tim Rauch	2019-09-03	2023-02-21	10c14723-61c7-4c75-92ca-9af245723ad2
	Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Subhash Popuri (@pbssubhash)	2021-08-21	2024-06-27	602a1f13-c640-4d73-b053-be9a2fa58b96
	Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardw (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Windows Management Instrumentation	-	medium	Florian Roth (Nextron Systems)	2023-02-14	—	3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d
	Detects a suspicious child process of a Microsoft HTML Help (HH.exe)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic JavaScript Initial Access Phishing Spearphishing Attachment Stealth System Binary Proxy Execution Compiled HTML File Regsvr32 Rundll32 Execution Windows Management Instrumentation	-	high	Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)	2020-04-01	2023-04-12	52cad028-0ff0-4854-8f67-d25dfcbc78b4
Splunk	The following analytic identifies the use of suspicious command-line parameters associated with Impacket tools, such as `wmiexec.py`, `smbexec.py`, `dcomexec.py`, and `atexec.py`, which are used for lateral movement and remote code execution. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Mauricio Velazco, Splunk	2021-11-19	2026-05-13	8ce07472-496f-11ec-ab3b-3e22fbd008af
Splunk	The following analytic identifies suspicious command-line parameters associated with the use of Impacket's smbexec.py for lateral movement. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Michael Haag, Splunk	2023-04-25	2026-05-13	bb3c1bac-6bdf-4aa0-8dc9-068b8b712a76
Splunk	The following analytic detects the use of Impacket's `wmiexec.py` tool for lateral movement by identifying specific command-line parameters. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Michael Haag, Splunk	2021-11-19	2026-10-09	d6e464e4-5c6a-474e-82d2-aed616a3a492

Title

Description

ROAMINGHOUSE S9026

ROAMINGHOUSE S9026

ROAMINGHOUSE MITRE reference S9026

Standing S9026

Reach

Coverage

ROAMINGHOUSE detections S9026