LIGHTRAIL S9061

Type: malware
Platform: Windows
Created: 30 September 2026
Last modified: 1 October 2026

LIGHTRAIL is a tunneler malware.[1] LIGHTRAIL has been known to communicate with C2 SOCKS4A Websocket communications.[1] LIGHTRAIL was first observed in 2022. LIGHTRAIL has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1][2]

Techniques33rd pct

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

defection.io

malware

LIGHTRAIL S9061

Type: malware
Platform: Windows
Created: 30 September 2026
Last modified: 1 October 2026

Techniques33rd pct

TacticsBottom 21%

Threat groupunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

LIGHTRAIL MITRE reference S9061

Protocol or Service Impersonation T1001.003 ↗

LIGHTRAIL has leveraged hard-coded User Agent strings to blend in with traffic to include Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136.5 6

Command and Control3 detection rules

Browser Fingerprint T1036.012 ↗

LIGHTRAIL has leveraged hard-coded User Agent strings to mimic legitimate browser traffic. 7 8

Stealthno detection rules

Web Protocols T1071.001 ↗

LIGHTRAIL has communicated over websockets to cloud C2 infrastructure.9 10

Command and Control60 detection rules

External Proxy T1090.002 ↗

LIGHTRAIL has utilized SOCKS4A proxies to communicate with the C2.11 12

Command and Control3 detection rules

Native API T1106 ↗

LIGHTRAIL has leveraged Windows API calls to establish the WebSocket to include WinHTTP.13

Execution14 detection rules

Protocol Tunneling T1572 ↗

LIGHTRAIL has used SOCKS4A proxies to tunnel traffic.14

Command and Control37 detection rules

LIGHTRAIL detections S9061

225 distinct rules cover the 7 techniques recorded for this malware. 175 Sigma · 50 Splunk.

6 covered by at least one rule1 with no coverage225 distinct rules in total

Showing 1-50 of 200+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.	Generic	test	file_event	windows	Sysmon	Command and Control Data Obfuscation Protocol or Service Impersonation	-	medium	xknow @xknow_infosec, Tim Shelton	2019-03-24	2023-10-18	75bf09fa-1dd7-4d18-9af9-dd9e492562eb
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	critical	Florian Roth (Nextron Systems)	2018-09-03	2023-03-09	9aa01d62-7667-4d3b-acb8-8cb5103e2014
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
	Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-22	2023-03-15	90ae0469-0cee-4509-b67f-e5efcef040f7
	Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. (...)	Emerging	experimental	dns	-	-	Command and Control Application Layer Protocol Web Protocols Command and Control Dynamic Resolution	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	73e5d24f-493f-4092-bd2f-c72cabda40ee
	Detects Bitsadmin connections to IP addresses instead of FQDN names	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems)	2022-06-10	2022-08-24	8ccd35a2-1c7c-468b-b568-ac6cdf80eec3
	Detects Bitsadmin connections to domains with uncommon TLDs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Execution, Persistence, Stealth BITS Jobs	-	high	Florian Roth (Nextron Systems), Tim Shelton	2019-03-07	2026-09-30	9eb68894-7476-4cd6-8752-23b51f5883a7
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
	Detects HTTP request used by Chafer malware to receive data from its C2.	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2019-01-31	2024-02-15	fb502828-2db0-438e-93e6-801c7548686d
	Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. (...)	Generic	test	ps_script	windows	PowerShell	Command and Control Application Layer Protocol Web Protocols	-	medium	frack113	2022-01-23	2025-07-18	d4488827-73af-4f8d-9244-7b7662ef046e
Splunk	This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Command and Control Protocol Tunneling Command and Control Proxy	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	8654314d-8e4d-4971-9f35-b9d477bf668e
Splunk	This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds). (...)	Anomaly	stable	network_connection	-	Cisco NVM · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter AppleScript	-	medium	Radka Viskova, Splunk	2026-09-18	2026-09-22	6bc88a9d-f7de-4257-b526-acf15bc5a517
Splunk	The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Resource Development Develop Capabilities Code Signing Certificates Command and Control Encrypted Channel Asymmetric Cryptography Resource Development Obtain Capabilities Digital Certificates	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-09-22	c43f7b49-2dab-4e76-892e-7f971c2f20f1
Splunk	The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage Command and Control Ingress Tool Transfer Resource Development Obtain Capabilities Tool Command and Control Proxy External Proxy	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	f7e5e792-d907-46c1-a58e-4ff974dc462a
Splunk	The following analytic detects connections with a high Encrypted Visibility Engine (EVE) threat confidence score, indicating potentially malicious behavior within encrypted traffic. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Command and Control Encrypted Channel Asymmetric Cryptography Exfiltration Exfiltration Over C2 Channel Command and Control Ingress Tool Transfer	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	8c15183e-2e70-4db4-86c3-88f8d9129b66
Splunk	The following analytic detects outbound connections initiated by command-line tools such as curl or wget. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter Command and Control Ingress Tool Transfer Execution, Persistence, Privilege Escalation Scheduled Task/Job Cron	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	173a1cb9-1814-4128-a9dc-f29dade89957
	Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-21	7050bba1-1aed-454e-8f73-3f46f09ce56a
	Detects execution of the "cloudflared" tool to connect back to a tunnel. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-20	9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
	Detects DNS requests to Cloudflared tunnels domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Command and Control Protocol Tunneling	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-12-20	—	a1d9eec5-33b2-4177-8d24-27fe754d0812
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	3ab65069-d82a-4d44-a759-466661a082d1
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	c4568f5d-131f-4e78-83d4-45b2da0ec4f1
	Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfi (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	—	19bf6fdb-7721-4f3d-867f-53467f6a5db6
	Detects an executable initiating a network connection to "ngrok" tunneling domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	2024-02-02	1d08ac94-400d-4469-a82f-daee9a908849
	Detects Turla ComRAT network communication.	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2020-05-26	2024-02-26	7857f021-007f-4928-8b2c-7aedbe64bb82
	Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2020-7315	medium	Nasreddine Bencherchali (Nextron Systems), fornotes	2022-12-01	2026-01-24	df6ecb8b-7822-4f4b-b412-08f524b4576c
	Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	frack113	2022-05-09	2026-05-18	28a452f3-786c-4fd8-b8f2-bddbe9d616d1
	Detects suspicious user agent strings used by crypto miners in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2019-10-21	2021-11-27	fa935401-513b-467b-81f4-f9e77aa0dd78
	Detects execution of curl.exe with custom useragent options	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Web Protocols	-	medium	frack113	2022-01-23	2023-02-21	3286d37a-00fd-41c2-a624-a672dcd34e60
	Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Dimitrios Slamaris	2017-05-15	2023-08-17	9d3436ef-9476-4c43-acca-90ce06bdf33a
	This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be lo (...)	Generic	test	-	windows	WinEventLog System	Execution, Stealth Hijack Execution Flow DLL	-	high	Dimitrios Slamaris, @atc_project (fix)	2017-05-15	2022-12-25	75edd3fd-7146-48e5-9848-3013d7f0282c
	This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded	Generic	test	-	windows	WinEventLog System	Execution, Stealth Hijack Execution Flow DLL	-	high	Dimitrios Slamaris	2017-05-15	2022-12-25	13fc89a9-971e-4ca6-b9dc-aa53a445bf40
	Detects DLL sideloading activity seen used by Diamond Sleet APT	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2023-42793	high	Nasreddine Bencherchali (Nextron Systems)	2023-10-24	—	d1b65d98-37d7-4ff6-b139-2d87c1af3042
	Hunts known SVR-specific DLL names.	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	CISA	2023-12-18	—	e64c8ef3-9f98-40c8-b71e-96110991cb4c
	Detects when an attacker create a similar folder structure to windows system folders such as (Window (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	frack113, Nasreddine Bencherchali (Nextron Systems)	2022-07-30	—	b6f91281-20aa-446a-b986-38a92813a18f
	Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which m (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-08-02	—	ebea773c-a8f1-42ad-a856-00cb221966e8
	Detects processes loading the non-existent DLL "ShellChromeAPI". (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-12-01	—	ee4c5d06-3abc-48cc-8885-77f1c20f4451
	Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.	Generic	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Lateral Movement Exploitation of Remote Services	-	low	Muhammad Faisal (@faisalusuf)	2024-12-19	—	882e858a-3233-4ba8-855e-2f3d3575803d
	Detects DNS query requests to Devtunnels domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols Command and Control Protocol Tunneling	-	medium	citron_ninja	2023-10-25	2023-11-20	1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b
	Detects DNS query requests to Visual Studio Code tunnel domains. (...)	Generic	test	dns	windows	Sysmon	Command and Control Application Layer Protocol Web Protocols	-	medium	citron_ninja	2023-10-25	2023-11-20	b3e6418f-7c7a-4fad-993a-93b65027a9f1
	Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded	Generic	test	-	windows	DNS Server	Execution, Stealth Hijack Execution Flow DLL	-	high	Florian Roth (Nextron Systems)	2017-05-08	2023-02-05	cbe51394-cd93-4473-b555-edf0144952d9
	The PowerShell implementation of DNSCat2 calls nslookup to craft queries. (...)	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol DNS Command and Control Data Obfuscation Protocol or Service Impersonation Exfiltration Exfiltration Over C2 Channel	-	high	Cian Heasley	2020-08-08	2023-02-24	b11d75d6-d7c1-11ea-87d0-0242ac130003
	Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy (...)	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2017-07-08	2025-01-18	fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f
	The Fax service attempts to load ualapi.dll, which is non-existent. (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	NVISO	2020-05-04	2022-06-02	828af599-4c53-4ed2-ba4a-a9f835c434ea
	Detects Baby Shark C2 Framework default communication patterns	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	critical	Florian Roth (Nextron Systems)	2021-06-09	2024-02-15	304810ed-8853-437f-9e36-c4975c3dfd7e
	Detects a typical pattern of a CobaltStrike BOF which inject into other processes	Generic	test	process_access	windows	Sysmon	Defense Impairment Disable or Modify Tools Execution Native API	-	high	Christian Burkard (Nextron Systems)	2021-08-04	2023-11-28	09706624-b7f6-455d-9d02-adee024cee1d
	Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Markus Neis, Florian Roth (Nextron Systems)	2024-02-15	—	f3f21ce1-cdef-4bfc-8328-ed2e826f5fac
	Detects user agent and URI paths used by empire agents	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems)	2020-07-13	2024-02-26	b923f7d6-ac89-4a50-a71a-89fb846b4aa8
	Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening an (...)	Generic	test	process_access	windows	Sysmon	Execution Native API Credential Access OS Credential Dumping LSASS Memory	-	high	Bhabesh Raj (rule), @thefLinkk	2022-06-27	2023-11-28	b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5
	Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Subhash Popuri (@pbssubhash)	2021-08-21	2024-06-27	602a1f13-c640-4d73-b053-be9a2fa58b96

LIGHTRAIL S9061

LIGHTRAIL S9061

LIGHTRAIL MITRE reference S9061

LIGHTRAIL MITRE reference S9061

Standing S9061

Reach

Coverage

LIGHTRAIL detections S9061