Loader

Decrypts, injects and runs follow-on payloads in memory

categoryMalwareseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Example: Latrodectus, BazaLoader, DarkGate

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1055 · Dirty Vanity process Injection · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1055 -Tool atomic -RunId <run-id> -Command 'Invoke-AtomicTest T1055 -TestGuids 49543237-25db-497b-90df-d0a0a6e8fe2c -TimeoutSeconds 120'

ATT&CK T1055 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1055 -Tool atomic -RunId run-2026-10-14-017 -Command 'Invoke-AtomicTest T1055 -TestGuids 49543237-25db-497b-90df-d0a0a6e8fe2c -TimeoutSeconds 120'

ATT&CK T1055 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1055 -Tool atomic -RunId run-2026-10-18-018 -Command 'Invoke-AtomicTest T1055 -TestGuids 49543237-25db-497b-90df-d0a0a6e8fe2c -TimeoutSeconds 120'

+ 2 more test variant(s) in the corpus.

What our lab measured

detected windows · 2026-10-30 · detected in 54s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Dirty Vanity process-reflection injection tool (redVanity / RtlCreateProcessReflection) launched from PowerShell -- T1055
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
Security · EID 4624	Non network or service local logon.
Security · EID 4634	Non service account logged off.
… and 5 more event type(s)

Detection that fired

✓ Wazuh 100434 (level 10) lab rule — Dirty Vanity process-reflection injection tool (redVanity / RtlCreateProcessReflection) launched from PowerShell -- T1055
✓ Wazuh 100435 (level 10) lab rule — Dirty Vanity process-reflection injection tool (redVanity / RtlCreateProcessReflection) launched from PowerShell (Security 4688 arm) -- T1055

Plus 11 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~5588 incidental alerts/hour — tune against this.

partially detected windows · 2026-10-27 · detected in 60s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 1	Powershell process spawned powershell instance
Event · EID 1014	Name resolution for the name wpad timed out
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
PowerShell · EID 4104	Powershell script used "Invoke-command" cmdlet to execute sub script
… and 5 more event type(s)

Detection that fired

✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent

Plus 12 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~70813 incidental alerts/hour — tune against this.

Classification

31 values: 2 lab-measured, 16 imported, 1 derived, 12 machine-classified. What do these mean?

Exploitability

Attack vector	Malware
Reach (CVSS)	Local
Attack complexity	Low
Privileges required	None
User interaction	Active
Attacker skill required	Medium
Resources required	Medium
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	Integrity
Platform	LinuxmacOSWindows
Environment	On-premises
Target asset class	Endpoint
Kill-chain phase (tactic)	Privilege EscalationStealth

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	File AccessModule LoadOS API ExecutionProcess AccessProcess CreationProcess MetadataProcess ModificationScript Execution
Defense bypassed	Anti-virusApplication control

Detection & response

Mitigated by 26

M1026 attack-mitigation
M1040 attack-mitigation
D3-CF d3fend
D3-CM d3fend
D3-CQ d3fend
D3-DA d3fend
D3-DF d3fend
D3-EAL d3fend
D3-EDL d3fend
D3-EFA d3fend
D3-FA d3fend
D3-FE d3fend
D3-FEV d3fend
D3-FIM d3fend
D3-HBPI d3fend
D3-LFP d3fend
D3-MBT d3fend
D3-PCSV d3fend
D3-PSA d3fend
D3-PSEP d3fend
D3-RF d3fend
D3-RFAM d3fend
D3-SAOR d3fend
D3-SCA d3fend
D3-SCF d3fend
D3-SFA d3fend

Detected by 61

DET0300 attack-detection-strategy
DET0508 attack-detection-strategy
02d1d718-dd13-41af-989d-ea85c7fab93f sigma
03d83090-8cba-44a0-b02f-0b756a050306 sigma
052ec6f6-1adc-41e6-907a-f1c813478bee sigma
0e7163d4-9e19-4fa7-9be6-000c61aad77a sigma
0fa66f66-e3f6-4a9c-93f8-4f2610b00171 sigma
148431ce-4b70-403d-8525-fcc2993f29ea sigma
16b37b70-6fcf-4814-a092-c36bd3aafcbd sigma
16c37b52-b141-42a5-a3ea-bbe098444397 sigma
19b3806e-46f2-4b4c-9337-e3d8653245ea sigma
1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd sigma
250ae82f-736e-4844-a68b-0b5e8cc887da sigma
2e4e488a-6164-4811-9ea1-f960c7359c40 sigma
33a2d1dd-f3b0-40bd-8baf-7974468927cc sigma
340a090b-c4e9-412e-bb36-b4b16fe96f9b sigma
396f6630-f3ac-44e3-bfc8-1b161bc00c4e sigma
3c1b5fb0-c72f-45ba-abd1-4d4c353144ab sigma
409f8a98-4496-4aaa-818a-c931c0a8b832 sigma
4508a70e-97ef-4300-b62b-ff27992990ea sigma
4cad6c64-d6df-42d6-8dae-eb78defdc415 sigma
4d0083b3-580b-40da-9bba-626c19fe4033 sigma
4f73421b-5a0b-4bbf-a892-5a7fb99bea66 sigma
62b7ccc9-23b4-471e-aa15-6da3663c4d59 sigma
6309645e-122d-4c5b-bb2b-22e4f9c2fa42 sigma
6345b048-8441-43a7-9bed-541133633d7a sigma
637f689e-b4a5-4a86-be0e-0100a0a33ba2 sigma
66d31e5f-52d6-40a4-9615-002d3789a119 sigma
6fe1719e-ecdf-4caf-bffe-4f501cb0a561 sigma
71158e3f-df67-472b-930e-7d287acaa3e1 sigma
744a188b-0415-4792-896f-11ddb0588dbc sigma
7bdde3bf-2a42-4c39-aa31-a92b3e17afac sigma
85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7 sigma
85d23b42-9a9d-4f8f-b3d7-d2733c1d58f5 sigma
89e1490f-1a3e-452a-bbb8-b68a5f58072f sigma
9b4e7c2a-3f6d-4a8b-b5e9-1c7d3f2e6a4b sigma
9f2cc74d-78af-4eb2-bb64-9cd1d292b87b sigma
a1a144b7-5c9b-4853-a559-2172be8d4a03 sigma
a24e5861-c6ca-4fde-a93c-ba9256feddf0 sigma
a7c3e5f2-8b1d-4e9a-b6c2-3d7f5e8a9b4c sigma
… and 21 more in the database

Tested by 35

0128e48e-8c1a-433a-a11a-a5304734f1e1 atomic
0128e48e-8c1a-433a-a11a-a5387384f1e1 atomic
114c2b95-d992-4c03-8c38-fc58420a3eb5 atomic
1c91e740-1729-4329-b779-feba6e71d048 atomic
2315ce15-38b6-46ac-a3eb-5e21abef2545 atomic
2871ed59-3837-4a52-9107-99500ebc87cb atomic
2a3c7035-d14f-467a-af94-933e49fe6786 atomic
2a4ab5c1-97ad-4d6d-b5d3-13f3a6c94e39 atomic
3203ad24-168e-4bec-be36-f79b13ef8a83 atomic
3ad4a037-1598-4136-837c-4027e4fa319b atomic
3d9e332e-60c9-407a-af4c-a9ae43c4f1d0 atomic
3f452c87-25b5-47c0-81d8-01908df1b927 atomic
4383bbd3-aa6c-49fd-a1a9-cf112c95982c atomic
49543237-25db-497b-90df-d0a0a6e8fe2c atomic
4cc571b1-f450-414a-850f-879baf36aa06 atomic
4f3c7502-b111-4dfe-8a6e-529307891a59 atomic
50859b3b-b088-4c7b-973d-03a0365a9bf9 atomic
562427b4-39ef-4e8c-af88-463a78e70b9c atomic
5696f417-30e5-4942-988d-0b9dcfe3a929 atomic
56b9589c-9170-4682-8c3d-33b86ecb5119 atomic
578025d5-faa9-4f6d-8390-aae527d503e1 atomic
578025d5-faa9-4f6d-8390-aae739d503e1 atomic
5fabf878-7dd4-48d3-9995-408fac68e166 atomic
611b39b7-e243-4c81-87a4-7145a90358b1 atomic
69534efc-d5f5-4550-89e6-12c6457b9edd atomic
7362ecef-6461-402e-8716-7410e1566400 atomic
73785dd2-323b-4205-ab16-bb6f06677e14 atomic
74496461-11a1-4982-b439-4d87a550d254 atomic
7c3e0b89-09e6-4f3c-a1e8-1c1dfa9288ce atomic
8b56f787-73d9-4f1d-87e8-d07e89cbc7f5 atomic
93ca40d2-336c-446d-bcef-87f14d438018 atomic
94903cc5-d462-498a-b919-b1e5ab155fee atomic
a0c1725f-abcd-40d6-baac-020f3cf94ecd atomic
c6952f41-6cf0-450a-b352-2ca8dae7c178 atomic
c8f98fe1-c89b-4c49-a7e3-d60ee4bc2f5a atomic

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-14-017`	partially-detected	atomic	windows	2026-10-14
`run-2026-10-18-018`	partially-detected	atomic	windows	2026-10-18
`run-2026-10-27-012`	partially-detected	atomic	windows	2026-10-27
`run-2026-10-30-002`	detected	atomic	windows	2026-10-30

run-2026-10-14-017 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=13). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1055 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=14 max_level=15 dwell_s=90
run-2026-10-18-018 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=13). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1055 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1484 max_level=15 dwell_s=90
run-2026-10-27-012 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=13). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1055 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1849 max_level=15 dwell_s=90
run-2026-10-30-002 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=13). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1055 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=149 max_level=15 dwell_s=90

Framework references

Primary source: https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
attack: T1620 (primary)
attack: T1055

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 93 of Cyber-Attack-Taxonomy.md
ev-0002 (Seeded-record enrichment run 2026-09-30 (crosswalk + facet classification)) — Crosswalk to attack:T1620, attack:T1055 as the nearest framework entries; ids verified to exist in the cached catalogues.
ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 32 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0004 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 87 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0005 (Phase 4 detection lab - detonation runs 2026-10-14) — Lab detonation run-2026-10-14-017 (partially-detected) for T1055: no alert matched the expected technique
ev-0006 (Phase 4 detection lab - detonation runs 2026-10-18) — Lab detonation run-2026-10-18-018 (partially-detected) for T1055: no alert matched the expected technique
ev-0007 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-012 (partially-detected) for T1055: no alert matched the expected technique
ev-0008 (Phase 4 detection lab - detonation runs 2026-10-30) — Lab detonation run-2026-10-30-002 (detected): Wazuh rule(s) 100434, 100435 fired on T1055 within the detonation window
Dirty Vanity process-reflection injection tool (redVanity / RtlCreateProcessReflection) launched from PowerShell -- T1055