Threat report

www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations

https://www.mandiant.com/resources/blog/tracking-evolution-gootloader-operations

Published on: www.mandiant.com

ATT&CK techniques those detections carry

T1027.011Fileless Storage
T1059.001PowerShell
T1105Ingress Tool Transfer
T1036.008Masquerade File Type
T1053.005Scheduled Task
T1059Command and Scripting Interpreter
T1204.002Malicious File

5 published detections cite this

Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.

Detections citing this reference
Detection	Severity	Source	Published	Licence
Windows Scheduled Task Service Spawned Shell	Medium	Splunk security content	Oct 10, 2026	Apache License 2.0
Windows Registry Payload Injection	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
Suspicious Process Executed From Container File	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
PowerShell WebRequest Using Memory Stream	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0
PowerShell Script Block With URL Chain	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 5 of 5

Filter in the catalogue