CRASHPAD S9057

Type: malware
Platform: Windows
Created: 28 September 2026
Last modified: 1 October 2026

CRASHPAD is a Windows executable written in C++ that gathers data from web browsers.[1] CRASHPAD was first observed in 2025 and has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

TechniquesBottom 17%

Tactics32nd pct

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

CRASHPAD detections S9057

59 distinct rules cover the 4 techniques recorded for this malware. 48 Sigma · 11 Splunk.

4 covered by at least one rule59 distinct rules in total

Showing 1-50 of 59 rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_event	windows	WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	low	Daniel Koifman (@Koifsec), Nasreddine Bencherchali	2024-10-21	—	4b60e527-ec73-4b47-8cb3-f02ad927ca65
	Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	frack113	2022-01-30	—	fc028194-969d-4122-8abe-0470d5b8f12f
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects a typical pattern of a CobaltStrike BOF which inject into other processes	Generic	test	process_access	windows	Sysmon	Defense Impairment Disable or Modify Tools Execution Native API	-	high	Christian Burkard (Nextron Systems)	2021-08-04	2023-11-28	09706624-b7f6-455d-9d02-adee024cee1d
	Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening an (...)	Generic	test	process_access	windows	Sysmon	Execution Native API Credential Access OS Credential Dumping LSASS Memory	-	high	Bhabesh Raj (rule), @thefLinkk	2022-06-27	2023-11-28	b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5
	Detects execution of the Impersonate tool. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Make and Impersonate Token	-	medium	Sai Prashanth Pulisetti @pulisettis	2022-12-21	2024-11-23	cf0c254b-22f1-4b2b-8221-e137b3c0af94
	Detects creation of default named pipes used by the Koh tool	Generic	test	pipe_created	windows	Sysmon	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Credential Access Steal Application Access Token	-	critical	Nasreddine Bencherchali (Nextron Systems)	2022-07-08	2023-08-07	0adc67e0-a68f-4ffd-9c43-28905aad5d6a
	Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escal (...)	Generic	test	-	windows	WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft	-	high	Stamatis Chatzimangou (st0pp3r)	2024-01-05	—	7b14c76a-c602-4ae6-9717-eff868153fc0
	Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Execution Native API Stealth System Binary Proxy Execution Rundll32	-	high	Alexander Rausch	2020-06-24	2023-03-01	95022b85-ff2a-49fa-939a-d7b8f56eeb9b
	Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Make and Impersonate Token	-	high	Nasreddine Bencherchali (Nextron Systems)	2024-06-26	—	c7d33b50-f690-4b51-8cfb-0fb912a31e57
	Detects execution of the SharpImpersonation tool. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Make and Impersonate Token	-	high	Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems)	2022-12-27	2023-02-13	f89b08d0-77ad-4728-817b-9b16c5a69c7a
	Detects commandline keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	d557dc06-62e8-4468-a8e8-7984124908ce
	Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. (...)	Generic	test	ps_script	windows	PowerShell	Privilege Escalation Abuse Elevation Control Mechanism Bypass User Account Control Credential Access Credentials from Password Stores Credentials from Web Browsers Execution Native API Discovery Network Service Discovery Discovery Software Discovery Discovery System Information Discovery Credential Access Unsecured Credentials Credentials In Files	-	high	Swachchhanda Shrawan Poudel	2023-12-04	—	851fd622-b675-4d26-b803-14bc7baa517a
Splunk	The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Deobfuscate/Decode Files or Information	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	5890ba10-4e48-4dc0-8a40-3e1ebe75e737
	Detects suspicious process command line that uses base64 encoded input for execution with a shell	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	pH-T (Nextron Systems)	2022-07-26	2023-06-16	ba592c6d-6888-43c3-b8c6-689b8fe47337
	Detects the presence of a base64 version of the shebang in the commandline, which could indicate a m (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-15	—	fe2f9663-41cb-47e2-b954-8a228f3b9dff
	Detects suspicious process command line that starts with a shell that executes something and finally (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Florian Roth (Nextron Systems)	2022-03-14	2022-07-26	880973f3-9708-491c-a77b-2a35a1921158
	Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service insta (...)	Unsupported	unsupported	driver_load	windows	Sysmon	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Create Process with Token	-	critical	Teymur Kheirkhabarov, Ecco, Florian Roth	2019-10-26	2022-12-22	d585ab5a-6a69-49a8-96e8-4a726a54de46
	Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service insta (...)	Generic	test	service	windows	WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Create Process with Token	-	high	Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)	2019-10-26	2023-11-15	ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34
	Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service insta (...)	Generic	test	service	windows	WinEventLog System	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Create Process with Token	-	high	Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)	2019-10-26	2023-11-15	843544a7-56e0-4dcc-a44f-5cc266dd97d6
	Detects execution of mshta.exe with file types that looks like they do not typically represent HTA ( (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Stealth Deobfuscate/Decode Files or Information Stealth System Binary Proxy Execution Mshta	CVE-2020-1599	high	Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)	2019-02-22	2025-05-12	cc7abbd0-762b-41e3-8a26-57ad50d2eea3
Splunk	The following analytic detects a non-Chrome process accessing files in the Chrome user default folder. (...)	Anomaly	stable	file_event	windows	WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	Teoderick Contreras, Splunk	2021-09-15	2026-08-14	81263de4-160a-11ec-944f-acde48001122	-
Splunk	The following analytic detects non-Firefox processes accessing the Firefox profile directory, which contains sensitive user data such as login credentials, browsing history, and cookies. (...)	Anomaly	stable	file_event	windows	WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	Teoderick Contreras, Splunk	2021-09-15	2026-08-14	e6fc13b0-1609-11ec-b533-acde48001122	-
	Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. (...)	Generic	test	process_creation	macos	-	Execution Command and Scripting Interpreter Stealth Deobfuscate/Decode Files or Information Execution User Execution	-	medium	Tim Rauch (rule), Elastic (idea)	2022-10-17	—	234dc5df-40b5-49d1-bf53-0d44ce778eca
	Detects a ping command that uses a hex encoded IP address	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2018-03-23	2025-10-17	1a0d4aba-7668-4365-9ce4-6d79ab088dfd
	Detects potential token impersonation and theft. (...)	Generic	test	authentication	windows	WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft	-	medium	Michaela Adams, Zach Mathis	2022-11-06	2023-04-26	02f7c9c1-1ae8-4c6a-8add-04693807f92f
	Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. (...)	Generic	test	process_creation	macos	-	Stealth Deobfuscate/Decode Files or Information	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-12-20	—	09a910bf-f71f-4737-9c40-88880ba5913d
	Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Native API Stealth System Binary Proxy Execution Execution, Stealth Trusted Developer Utilities Proxy Execution	-	medium	Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2019-10-26	2024-04-22	b5c7395f-e501-4a08-94d4-57fe7a9da9d2
	Detects command line patterns used by BlackByte ransomware in different operations	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Impact Data Destruction Stealth Deobfuscate/Decode Files or Information Impact Network Denial of Service	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-02-08	999e8307-a775-4d5f-addc-4855632335be
	Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-12-23	2025-03-19	47147b5b-9e17-4d76-b8d2-7bac24c5ce1b
	Detects potential commandline obfuscation using known escape characters	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information	-	medium	juju4	2018-12-11	2023-03-03	f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd
	Detects potential calls to NtOpenProcess directly from NTDLL.	Generic	test	process_access	windows	Sysmon	Execution Native API	-	medium	Christian Burkard (Nextron Systems), Tim Shelton (FP)	2021-07-28	2023-12-13	3f3f3506-1895-401b-9cc3-e86b16e630d0
	Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service start (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft Create Process with Token	-	high	Teymur Kheirkhabarov, Ecco, Florian Roth	2019-10-26	2023-02-05	15619216-e993-4721-b590-4c520615a67d
	Detects the use of WinAPI Functions via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Native API	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-06	2025-03-06	ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
	Detects usage of WinAPI functions in PowerShell scripts. (...)	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Execution Native API Stealth Reflective Code Loading	-	high	Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community	2020-10-06	2026-04-29	03d83090-8cba-44a0-b02f-0b756a050306
	Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information	-	high	Florian Roth (Nextron Systems)	2019-08-24	2023-04-06	fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c
	A General detection for specific decompress commands in PowerShell logs. (...)	Generic	test	ps_module	windows	PowerShell	Stealth Deobfuscate/Decode Files or Information	-	informational	Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)	2020-05-02	2022-12-25	1ddc1472-8e52-4f7d-9f11-eab14fc171f5
	Detects the execution of WebBrowserPassView.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	frack113	2022-08-20	2023-02-14	d0dae994-26c6-4d2d-83b5-b3c8b79ae513
Splunk	The following analytic detects the execution of the runas.exe process with administrator user options. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Privilege Escalation, Stealth Access Token Manipulation Token Impersonation/Theft	-	medium	Teoderick Contreras, Splunk	2021-11-17	2026-05-13	4807e716-43a4-11ec-a0e7-acde48001122
	Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers Collection Data from Local System Credential Access Steal Web Session Cookie	-	high	TropChaud	2022-12-19	2023-01-19	24c77512-782b-448a-8950-eddb0785fc71
	Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. (...)	Generic	experimental	file_access	windows	-	Discovery Browser Information Discovery Credential Access Credentials from Password Stores Credentials from Web Browsers	-	low	frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore	2025-05-22	—	a1dfd976-4852-41d4-9507-dc6590a3ccd0
	Detects suspicious rules that delete or move messages or folders are set on a user's inbox.	Generic	test	-	-	Azure Risk Detection · Azure	Stealth Deobfuscate/Decode Files or Information	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	ceb55fd0-726e-4656-bf4e-b585b7f7d572
	Detects suspicious mshta process execution patterns	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Native API	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2021-07-17	2023-02-21	e32f92d1-523e-49c3-9374-bdb13b46a3ba
	Detects presence of a potentially xor encoded powershell command	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	medium	Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali	2018-09-05	2023-01-30	bb780e0c-16cf-4383-8383-1e5471db6cf9
	Detects a named pipe used by Turla group samples	Emerging	test	pipe_created	windows	Sysmon	Execution Native API	-	critical	Markus Neis	2017-11-06	2021-11-27	739915e4-1e70-4778-8b8a-17db02f66db1
	Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". (...)	Emerging	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-16	—	60d050c4-e253-4d9a-b673-5ac100cfddfb
	Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. (...)	Emerging	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-06-16	—	23835beb-ec38-4e74-a5d4-b99af6684e91

CRASHPAD S9057

CRASHPAD S9057

CRASHPAD MITRE reference S9057

CRASHPAD MITRE reference S9057

Standing S9057

Reach

Coverage

CRASHPAD detections S9057