S0064: ELMER
Analyst context for executives and security teams
ELMER matters because it is described as a Windows, proxy-aware HTTP backdoor: a form of malware that can blend command-and-control traffic into normal web traffic and operate in environments where outbound proxy use is expected. For leaders, the practical issue is not a broad malware family claim, but whether the organization can prove it would notice suspicious HTTP-based backdoor activity, related process/file discovery, and post-compromise host activity on Windows systems.
Executive priority
Prioritize this as a coverage-validation item for SOC, incident response, and network monitoring programs. The supplied ATT&CK context links ELMER to APT16 and to process discovery, file/directory discovery, and web-protocol command and control. Executives should ask whether web egress monitoring, proxy logs, Windows endpoint telemetry, and IR playbooks can support timely triage when a backdoor uses ordinary HTTP paths rather than obviously malicious protocols.
Technical view
ELMER is officially described as a non-persistent, proxy-aware HTTP backdoor written in Delphi and used by APT16. ATT&CK relationships indicate use of Process Discovery, File and Directory Discovery, and Web Protocols for command and control. SOC and detection teams should validate visibility across Windows process execution, process enumeration behavior, file/directory enumeration, proxy-aware outbound HTTP traffic, and correlations between unusual host discovery activity and external web communications. Because ATT&CK provides no official detection text for this object, local baselining and environment-specific tuning are required.
Likely telemetry
- Windows endpoint process creation and command-line telemetry
- Process enumeration activity from EDR or host audit sources
- File and directory enumeration telemetry from endpoint sensors
- HTTP web proxy logs, including authenticated user, host, destination, method, URI, status, and user-agent where available
- Network connection metadata for outbound web traffic from Windows endpoints
Detection direction
- Validate whether proxy logs and endpoint telemetry can be joined by host, user, and time to investigate proxy-aware HTTP backdoor behavior.
- Look for suspicious combinations of local discovery activity followed by unusual outbound HTTP communications, rather than relying on a single indicator.
- Tune for false positives from legitimate administration, inventory, backup, search indexing, and software management tools that also enumerate processes or files.
- Confirm monitoring covers Windows endpoints, since Windows is the platform supplied for this malware object.
- Do not assume ATT&CK-provided detections exist for ELMER; build coverage around the related behaviors: Process Discovery, File and Directory Discovery, and Web Protocols.
Mitigation priorities
- Restrict and monitor outbound web access through controlled proxies where feasible, with logging sufficient for incident reconstruction.
- Maintain endpoint detection and response coverage on Windows systems to capture process, discovery, and network context.
- Apply least-privilege and administrative access controls so discovery performed by compromised accounts yields less sensitive operational information.
- Use network segmentation and egress control to reduce the ability of a compromised Windows host to communicate freely over web protocols.
- Prepare IR playbooks for HTTP-based backdoor triage, including host isolation, proxy-log review, process analysis, and scoping of file/process discovery activity.
Analyst notes and limits
The main decision value is coverage assurance: can the organization detect and investigate a Windows backdoor that uses HTTP and is proxy-aware, especially when paired with common discovery behaviors. The relationship to APT16 is sourced from ATT&CK, but this take does not infer current activity, targeting, or customer exposure.
ATT&CK provides no official detection text, no aliases, no listed tactics on the malware object itself, and limited behavioral detail beyond the description and relationships. The related technique platform lists are broader than the malware platform; this assessment treats ELMER as Windows based on the supplied malware platform field. Local telemetry, baselines, and incident evidence are required to determine actual exposure or detection coverage.
ELMER
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1083 | File and Directory Discovery | ELMER is capable of performing directory listings.CitationFireEye EPS Awakens Part 2 |
| Enterprise | T1071.001 | Web Protocols Sub-technique | ELMER uses HTTP for command and control.CitationFireEye EPS Awakens Part 2 |
| Enterprise | T1057 | Process Discovery | ELMER is capable of performing process listings.CitationFireEye EPS Awakens Part 2 |
Groups, software, and campaigns
G0023: APT16
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 120cf8f9fe33… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
FireEye EPS Awakens Part 2
Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.
Open source URL -
[2]
mitre-attack S0064Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.