Windows file indicators for Octopus Scanner malware artifacts

Alerts on Windows file activity for Octopus Scanner-related filenames (Cache134.dat, ExplorerSync.db) in AppData.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: NVISO (SigmaHQ), DRL 1.1
Published: 2020-06-09
Updated: 2026-07-31

ATT&CK techniques

Initial Access

Recon
Resource Dev
Initial Access
- T1195Supply Chain Compromise
- T1195.001Compromise Software Dependencies and Development Tools
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches Windows file events where the target filename ends with specific artifact paths associated with Octopus Scanner malware. Attackers and malicious installers may use these files during initial access or execution, making their presence a strong indicator of compromise. The detection relies on Windows file event telemetry that records the target filename for filesystem activity.

Reporting behind it

Related detections9 linkedT1195.001 — drag to rearrange

Malicious TeamPCP systemd User Unit Dropper via sysmon.py Persistence (via file_event)

Suspicious Python Startup .pth File Creation for Interpreter Persistence

Malicious Backdoored liblzma XZ Utils Library File via file_event

Suspicious SSH Daemon Spawning Shell via xz Backdoor (via process_creation)

Suspicious XZ Utils Backdoor Kill-Switch Environment String via process_creation

Malicious PyPI Package Installation from Gleaming Pisces Supply Chain (via process_creation)

Malicious TeamPCP LiteLLM .pth Startup Hook and Payload Dropper (via file_event)

Malicious Backdoored liblzma Loaded by sshd (CVE-2024-3094)

GitHub Audit: Dependabot Alerts and Security Updates Disabled

Windows file indicators for Octopus Scanner malware artifacts

Pivot detection · T1195.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-creation-of-octopus-scanner-malware-cache134-dat-or-explorersync-db-805c55d9

title: Windows file indicators for Octopus Scanner malware artifacts
id: ff0e62c4-65e7-4e4a-9332-7ede4c671502
status: test
description: This rule matches Windows file events where the target filename ends with specific artifact paths associated with Octopus Scanner malware. Attackers and malicious installers may use these files during initial access or execution, making their presence a strong indicator of compromise. The detection relies on Windows file event telemetry that records the target filename for filesystem activity.
references:
  - https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_mal_octopus_scanner.yml
author: NVISO, Huntrule Team
date: 2020-06-09
modified: 2021-11-27
tags:
  - attack.initial-access
  - attack.t1195
  - attack.t1195.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - \AppData\Local\Microsoft\Cache134.dat
      - \AppData\Local\Microsoft\ExplorerSync.db
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 805c55d9-31e6-4846-9878-c34c75054fe9
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL