BACKUPOSINT v9.0 APEX PREDATOR S9045

Type: malware
Platforms: Linux, Windows, IaaS, Containers
Created: 2 September 2026
Last modified: 9 October 2026

BACKUPOSINT v9.0 APEX PREDATOR is a 49-module Python malware developed entirely by Anthropic’s Claude Code as part of the AI-Assisted Breach of Mexico's Government Infrastructure campaign. BACKUPOSINT v9.0 APEX PREDATOR leverages publicly available techniques for network enumeration, credential harvesting, Active Directory interrogation, database access, privilege escalation, cloud metadata extraction, and lateral movement.[1]

Techniques72nd pct

TacticsTop 20%

Threat groupsNone recorded

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

BACKUPOSINT v9.0 APEX PREDATOR MITRE reference S9045

Remote System Discovery T1018 ↗

BACKUPOSINT v9.0 APEX PREDATOR has performed remote system discovery mapping harvested credentials to systems within the target environment.2

Discovery39 detection rules

Network Service Discovery T1046 ↗

BACKUPOSINT v9.0 APEX PREDATOR has enumerated the ports on victim systems within the victim environment.3

Discovery33 detection rules

Cron T1053.003 ↗

BACKUPOSINT v9.0 APEX PREDATOR has the ability to abuse Sudo/Cron for privilege escalation.4

Execution · Persistence · Privilege Escalation16 detection rules

Process Discovery T1057 ↗

BACKUPOSINT v9.0 APEX PREDATOR has the ability to enumerate the processes running within the victim environment.5

Discovery10 detection rules

Cloud API T1059.009 ↗

BACKUPOSINT v9.0 APEX PREDATOR has leveraged OpenAI’s GPT-4.1 API to analyze extracted data.6

Execution4 detection rules

System Information Discovery T1082 ↗

BACKUPOSINT v9.0 APEX PREDATOR has discovered system configurations on victim devices.7

Discovery54 detection rules

Standing S9045

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 842 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques1772nd pct

72nd percentile · 72% of 842 ATT&CK software entries have this many Enterprise techniques or fewer.

Tactics8Top 20%

80th percentile · 80% of 842 ATT&CK software entries have this many tactics spanned or fewer.

Threat groups062% tie · 22 values

62% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaign186% tie · 8 values

86% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique16med38th pct

38th percentile · 62% of 842 ATT&CK software entries have more detection rules per technique.

Tests / technique4med

BACKUPOSINT v9.0 APEX PREDATOR detections S9045

278 distinct rules cover the 17 techniques recorded for this malware. 148 Sigma · 130 Splunk.

15 covered by at least one rule2 with no coverage278 distinct rules in total

Showing 1-50 of 200+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
Splunk	The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-10-24	2026-05-13	9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
	Detects the use of Advanced IP Scanner. (...)	Generic	test	file_event	windows	Sysmon	Discovery Network Service Discovery	-	medium	@ROxPinTeddy	2020-05-12	2022-11-29	fed85bf9-e075-4280-9159-fbe8a023d6fa
	Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.	Generic	test	-	-	Azure Risk Detection · Azure	Credential Access Steal Application Access Token	-	high	Mark Morowczynski '@markmorow'	2023-08-07	—	6555754e-5e7f-4a67-ad1c-4041c413a007
	Indicates sign-ins from an anonymous IP address, for example, using an anonymous browser or VPN.	Generic	test	-	-	Azure Risk Detection · Azure	Credential Access Steal Application Access Token	-	high	Gloria Lee, '@gleeiamglo'	2023-08-22	—	53acd925-2003-440d-a1f3-71a5253fe237
	Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchan (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Steal Application Access Token	-	high	Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'	2022-07-10	—	c1d147ae-a951-48e5-8b41-dcd0170c7213
	Detects when a configuration change is made to an applications URI. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Steal Application Access Token Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	0055ad1f-be85-4798-83cf-a6da17c993b3
	Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Exfiltration Exfiltration Over Web Service	-	medium	frack113	2021-11-26	2022-05-16	1f0f6176-6482-4027-b151-00071af39d7e
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Automated Collection Credential Access Unsecured Credentials Credentials In Files	-	medium	frack113	2021-07-28	2022-11-11	f576a613-2392-4067-9d1a-9345fb58d8d1
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-b1d3-46bd-ba26-133337c0ffee
	Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-7375-4f4e-b83b-133337c0ffee
	Detects S3 Browser utility creating IAM User or AccessKey.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-d9d9-4792-91e5-133337c0ffee
Splunk	The following analytic identifies Azure Device Code Phishing attacks, which can lead to Azure Account Take-Over (ATO). (...)	Generic	stable	authentication	-	Microsoft 365	Initial Access Phishing Spearphishing Link Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2023-11-16	2026-05-13	d68d8732-6f7e-4ee5-a6eb-737f2b990b91
Splunk	The following analytic detects when a user in an Azure AD environment grants consent to an OAuth application. (...)	Generic	stable	account_management	-	Microsoft 365	Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-09-24	10ec9031-015b-4617-b453-c0c1ab729007
Splunk	The following analytic detects instances where Azure AD has blocked a user's attempt to grant consent to a risky or potentially malicious application. (...)	Generic	stable	account_management	-	Microsoft 365	Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-09-24	06b8ec9a-d3b5-4882-8f16-04b4d10f5eab
Splunk	The following analytic identifies instances where a user has denied consent to an OAuth application seeking permissions within the Azure AD environment. (...)	Generic	stable	authentication	-	Microsoft 365	Credential Access Steal Application Access Token	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	bb093c30-d860-4858-a56e-cd0895d5b49c
	Identifies when a key vault is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	459a2970-bb84-4e6a-a32e-ff0fbd99448d
	Identifies when a Keyvault Key is modified or deleted in Azure.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	80eeab92-0979-4152-942d-96749e11df40
	Identifies when secrets are modified or deleted in Azure.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	b831353c-1971-477b-abb6-2828edc3bca1
	Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Austin Songer @austinsonger	2021-11-22	2022-12-18	1c71e254-6655-42c1-b2d6-5e4718d7fc0a
	Detects user data export activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	5259cbf2-0a75-48bf-b57a-c54d6fabaef3
	Detects user permission data export attempt.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Collection Data from Information Repositories Reconnaissance Gather Victim Org Information Identify Roles Discovery System Information Discovery	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	87cc6698-3e07-4ba2-9b43-a85a73e151e2
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
Splunk	This analytic detects potential reconnaissance activities on Cisco ASA devices by identifying execution of multiple information-gathering "show" commands within a short timeframe. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Gather Victim Network Information Domain Properties IP Addresses Discovery System Information Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	6e9d4f7a-3c8b-4a9e-8d2f-7b5c9e1a6f3d
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of Cisco IOS or NX-OS discovery commands associated with Salt Typhoon tradecraft. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Reconnaissance Gather Victim Network Information Discovery System Information Discovery Discovery System Network Configuration Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	71ac5328-2364-40cf-8381-92b8dc531399
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
Splunk	The following analytic detects workloads accessing the cloud instance metadata service at 169.254.169.254. (...)	Anomaly	stable	network_device	-	Cisco	Credential Access Unsecured Credentials Cloud Instance Metadata API	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-05-13	7f2e1a9a-1e8e-4d2e-8b7c-5f2c3d6a9b21
Splunk	The following analytic detects the creation of a cron job within the Cisco Isovalent environment. (...)	Anomaly	stable	process_creation	-	Cisco	Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron Container Orchestration Job	-	medium	Bhavin Patel, Splunk	2026-01-05	2026-05-13	94531a31-a041-4777-909f-cd92ed3b71ad
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage Command and Control Ingress Tool Transfer Resource Development Obtain Capabilities Tool Command and Control Proxy External Proxy	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	f7e5e792-d907-46c1-a58e-4ff974dc462a
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
Splunk	The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter Command and Control Ingress Tool Transfer Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	173a1cb9-1814-4128-a9dc-f29dade89957
	See what commands are being input into the device by other people, full credentials can be in the hi (...)	Generic	test	authentication	-	Cisco AAA · Cisco	Credential Access Unsecured Credentials Shell History	-	medium	Austin Clark	2019-08-11	2023-01-04	b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b	-
Splunk	This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. (...)	Generic	stable	configuration_change	-	Cisco IOS · Cisco	Collection Data from Local System Exfiltration Exfiltration Over Web Service	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	1abce487-f480-4d5f-a551-01de0bece0bd
	Detects the use of the redirection character ">" to redirect information on the command line. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery System Information Discovery	-	low	frack113	2022-01-22	2024-03-19	4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
	Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfi (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	—	19bf6fdb-7721-4f3d-867f-53467f6a5db6
	Detects an executable initiating a network connection to "ngrok" tunneling domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	2024-02-02	1d08ac94-400d-4469-a82f-daee9a908849
	Detects potential container discovery via listing of certain kernel features in the "/proc" virtual (...)	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	746c86fb-ccda-4816-8997-01386263acc4
	Detects when the file "passwd" or "shadow" is copied from tmp path	Generic	test	process_creation	linux	Sysmon	Credential Access Unsecured Credentials Credentials In Files	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-01-31	—	fa4aaed5-4fe0-498d-bbc0-08e3346387ba
	Detecting attempts to extract passwords with grep and laZagne	Generic	test	process_creation	macos	-	Credential Access Unsecured Credentials Credentials In Files	-	high	Igor Fits, Mikhail Larin, oscd.community	2020-10-19	2021-11-27	53b1b378-9b06-4992-b972-dde6e423d2b4
	Detecting attempts to extract passwords with grep	Generic	test	process_creation	linux	Linux Auditd	Credential Access Unsecured Credentials Credentials In Files	-	high	Igor Fits, oscd.community	2020-10-15	2023-04-30	df3fcaea-2715-4214-99c5-0056ea59eb35
	Detects when highly privileged delegated permissions are granted on behalf of all users	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Steal Application Access Token	-	high	Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'	2022-07-28	—	a6355fbe-f36f-45d8-8efc-ab42465cbc52
Splunk	The following analytic identifies specific GET or HEAD requests to web servers that indicate reconnaissance attempts to find vulnerable JBoss servers. (...)	Generic	experimental	webserver	-	-	Initial Access, Persistence External Remote Services Discovery System Information Discovery	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	104658f4-afdc-499e-9719-17243f982681	-
	Enumerates Active Directory to determine computers that are joined to the domain	Generic	test	ps_script	windows	PowerShell	Discovery Remote System Discovery	-	medium	frack113	2022-02-12	—	1f6399cf-2c80-4924-ace1-6fcff3393480
	Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery	Generic	test	process_creation	linux	Sysmon	Discovery System Information Discovery	-	low	Seth Hanford	2023-08-23	—	11701de9-d5a5-44aa-8238-84252f131895
Splunk	The following analytic detects the execution of `nltest.exe` with command-line arguments `/dclist:` or `/dsgetdc:` to discover domain controllers. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-07-20	41243735-89a7-4c83-bcdd-570aa78f00a1
Splunk	The following analytic identifies the execution of `wmic.exe` with command-line arguments used to discover domain controllers in a Windows domain. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Remote System Discovery	-	medium	Mauricio Velazco, Splunk	2021-09-01	2026-05-13	64c7adaa-48ee-483c-b0d6-7175bc65e6cc