Malware family pivot
Syscalls grouped by the malware families and offensive tooling that publicly use them. Attributions are drawn from open threat reports — useful for hunting and report-writing.
145 families referenced across the syscall catalog
- Cobalt Strike36
- Sliver28
- Qakbot16
- Brute Ratel C415
- IcedID15
- Emotet11
- BumbleBee10
- TrickBot10
- Conti9
- Lazarus tooling9
- Bumblebee7
- Havoc7
- LockBit7
- BruteRatel6
- ScareCrow6
- BlackCat / ALPHV5
- Brute Ratel5
- Cobalt Strike (Ekko sleep mask)5
- Cronos sleep mask5
- Foliage sleep mask5
- Royal5
- Donut loader4
- Ekko sleep mask4
- Mimikatz (tooling)4
- RedLine Stealer4
- Themida packed loaders4
- VMProtect packed loaders4
- AgentTesla3
- APT29 / Cozy Bear3
- BlackCat (ALPHV)3
- CVE-2018-8440 ALPC LPE PoC (SandboxEscaper)3
- FIN73
- FIN7 Carbanak3
- GuLoader3
- HermeticWiper3
- JuicyPotato / RoguePotato (tooling)3
- LummaC23
- Mimikatz3
- PrintNightmare exploits (CVE-2021-1675 / 34527)3
- Royal Ransomware3
- ThreatNeedle (Lazarus)3
- Turla3
- Vidar3
- Akira2
- APT29 (Cozy Bear)2
- BlackCat/ALPHV2
- CaddyWiper2
- Cobalt Strike (RPC lateral movement)2
- Cobalt Strike (Sleep Mask Kit)2
- Dridex2
- FIN7 (CARBANAK)2
- FormBook2
- Hancitor2
- HandleKatz2
- Impacket secretsdump2
- Mimikatz (mimidrv)2
- NanoDump2
- PikaBot2
- PrintSpoofer (tooling)2
- QakBot2
- Raccoon Stealer2
- Scattered Spider POORTRY/STONESTOP2
- Snake / Turla2
- Agent Tesla1
- Amadey1
- Astaroth (ADS staging)1
- AsyncRAT1
- Atomic Stealer (Win port)1
- Autoruns-like recon by FIN7 BIRDDOG1
- AvosLocker (asWarPot.sys)1
- AvosLocker (gdrv BYOVD)1
- BabLock1
- BlackByte (BYOVD via RTCore64.sys)1
- BlackByte (RTCore64 BYOVD)1
- BlackByte (RTCore64)1
- BlackCat/ALPHV (junction redirect)1
- BlackEnergy 2 (kernel-driver variant)1
- BumbleBee (loader variants)1
- Chromium sandbox abuse research (PoCs)1
- Cobalt Strike (Early Bird loader variants)1
- Cobalt Strike (Early Bird variants)1
- Cobalt Strike (lateral movement via RPC)1
- Cobalt Strike (lateral RPC tooling)1
- Cobalt Strike (SMB beacon)1
- Cobalt Strike (spawnto / spoof-parent)1
- Conti (raw NTFS shadow extraction)1
- Conti ransomware1
- CrackMapExec / NetExec local-SAM1
- Custom EoP PoCs1
- CVE-2019-1322 SVCMOVER PoC1
- DCSync auxiliaries1
- EDRKillShifter1
- Empire Persistence enumeration1
- Equation GrayFish1
- Equation Group GrayFish1
- FIN7 BIRDDOG1
- FIN7 BOOSTWRITE1
- Finfisher1
- FinFisher1
- Generic capability-probing payloads1
- Generic clean-exit / sandbox-escape PoCs1
- Generic post-ex reconnaissance scripts1
- Generic sandbox-escape PoCs1
- Generic sandboxed-stager red-team tooling1
- Generic token-demotion red-team tooling1
- GodPotato (tooling)1
- HotPotato (tooling)1
- Latrodectus1
- Lazarus1
- Lazarus AppleJeus persistence enumerator1
- LazyScripter / FIN7 (BYOVD chains)1
- LockBit (Backstab + procexp)1
- LockBit (Backstab/Spyboy)1
- Mimikatz (legacy variants)1
- Mimikatz (lsadump::sam)1
- Necurs1
- NotPetya1
- PassTheHash toolkit (legacy)1
- Petya / NotPetya1
- Play1
- PlugX1
- PoolParty PoCs1
- PoshC2 (ADS payload hiding)1
- PoshC2 modules1
- PowerSploit Get-PassHashes1
- Process Hollowing PoCs (generic)1
- PsExec / Impacket psexec1
- Ramnit1
- RemcosRAT1
- RobbinHood1
- RottenPotato (tooling)1
- Rustock (XP/Vista-era rootkit)1
- Ryuk / Conti1
- Scattered Spider (BYOVD tooling)1
- Sednit (APT28) Zebrocy1
- Sliver (named-pipe transport)1
- SmokeLoader1
- Stuxnet1
- Stuxnet (junction abuse)1
- SweetPotato (tooling)1
- TDL4 / Alureon1
- Themida-packed loaders1
- Turla Carbon1
- VMProtect-packed loaders1
- ZeroAccess1