Netskope Threat Labs

DarkWatchman

ATP Sandbox Adv. Heuristics
First seen
February 2024
Last seen
September 2026
Darkwatchman

34 techniques across 8 tactics.

TA0001 Initial Access

TA0002 Execution

TA0005 Stealth

TA0007 Discovery

  • T1010Application Window Discovery
  • T1012Query Registry
  • T1033System Owner/User Discovery
  • T1082System Information Discovery
  • T1083File and Directory Discovery
  • T1120Peripheral Device Discovery
  • T1124System Time Discovery
  • T1217Browser Information Discovery
  • T1518Software Discovery
  • T1614System Location Discovery

TA0009 Collection

TA0011 Command and Control

TA0040 Impact

  • T1490Inhibit System Recovery

TA0112 Defense Impairment

Alert Name
Script-JS.Trojan.DarkWatchman
Win32.Exploit.DarkWatchman
Win32.Trojan.Darkwatchman
Win32.Trojan.DarkWatchman