TSCookie

AV

Stats

First seen: August 2024
Last seen: October 2026

MITRE ATT&CK techniques

13 techniques across 5 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
T1204User Execution
- T1204.001Malicious Link

TA0005 Stealth

T1055Process Injection
T1140Deobfuscate/Decode Files or Information

TA0006 Credential Access

T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers

TA0007 Discovery

T1016System Network Configuration Discovery
T1057Process Discovery
T1083File and Directory Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1090Proxy
T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

Associated groups

G0098BlackTech

Alert name variants

Alert Name	Engine
Gen:Variant.Linux.TSCookie.1	AV
Gen:Variant.Trojan.Linux.TSCookie.1	AV

Related families

NETWIRE QakBot Bazar Bisonal Cobalt Strike