S0018: Sykipot

Sykipot is a Windows malware family documented by ATT&CK as used in spearphishing campaigns since about 2007, with one reported variant targeting smart cards. Its defensive significance is not just malware removal: the mapped behaviors point to host and network discovery, persistence, process injection, credential collection, MFA/smart-card interception, and encrypted command-and-control. For leaders, this makes Sykipot a useful test case for whether endpoint, identity, and SOC programs can recognize post-compromise discovery and credential risk after an initial phishing-led intrusion.

Executive priority

Prioritize Sykipot-related validation where Windows endpoints, domain accounts, smart-card or MFA-backed access, and sensitive internal networks intersect. The business question is whether existing controls can produce evidence quickly enough to answer: what system was compromised, what accounts or MFA mechanisms may be exposed, what internal systems were enumerated, and whether persistence or encrypted command-and-control was established. Because ATT&CK provides no official detection text for this malware object, coverage should be proven through telemetry and technique-level detections rather than assumed from malware naming alone.

Technical view

SOC and IR teams should validate coverage against the related ATT&CK behaviors: System Service Discovery, System Network Configuration Discovery, Remote System Discovery, System Network Connections Discovery, DLL Injection, Keylogging, Process Discovery, Domain Account Discovery, MFA Interception, Registry Run Keys/Startup Folder persistence, and Asymmetric Cryptography for C2. On Windows, focus on process creation, command-line activity, registry autoruns, module/DLL load and injection indicators, account and domain enumeration, smart-card or MFA interaction evidence where available, and outbound network sessions that may be encrypted outside normal application patterns. Treat detections as behavior-led; the supplied ATT&CK object does not include official indicators or detection logic.

Likely telemetry

Windows endpoint process creation and command-line logs
Windows registry autorun and Startup Folder change events
Endpoint security telemetry for DLL/module loads and process injection behavior
Authentication, domain account enumeration, and directory service logs
Smart-card or MFA-related authentication events where deployed

Detection direction

Validate technique-level analytics for discovery commands and API/tool use rather than relying on a Sykipot malware signature alone.
Tune for suspicious combinations: spearphishing-adjacent endpoint execution followed by service, process, network, remote system, or domain account discovery.
Review autorun persistence detections for user-context Run keys and Startup Folder changes on Windows systems.
Confirm visibility into process injection/DLL injection behaviors and reduce false positives by baselining legitimate security, management, and productivity software.
For environments using smart cards or MFA, confirm that authentication logs can support investigation of interception or abnormal use; do not assume MFA events alone prove compromise.

Mitigation priorities

Harden phishing resistance and endpoint execution controls for Windows users most likely to access sensitive systems.
Ensure least privilege and account segmentation limit the value of domain account discovery and captured credentials.
Protect smart-card and MFA workflows with strong endpoint hygiene, monitoring, and rapid credential revocation procedures when compromise is suspected.
Restrict and monitor autorun persistence locations, especially Run keys and Startup Folder paths.
Maintain EDR or equivalent endpoint visibility for process, registry, module, and network activity needed for incident reconstruction.

Additional notes and limits

The ATT&CK object identifies Sykipot as Windows malware used in spearphishing campaigns and notes a smart-card-hijacking variant. Relationship context supplies the most useful defensive direction: discovery, credential access, persistence, injection, and command-and-control behaviors. This take intentionally emphasizes validation of those behaviors because the malware object itself has no official detection guidance.

The supplied ATT&CK fields do not provide official detection text, indicators of compromise, current activity status, specific victim exposure, or complete procedure details for each related technique. Local environment telemetry, identity architecture, smart-card/MFA deployment details, and endpoint baselines are required to determine actual risk and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Sykipot

Sykipot is malware that has been used in spearphishing campaigns since approximately 2007 against victims primarily in the US. One variant of Sykipot hijacks smart cards on victims. [1] The group using this malware has also been referred to as Sykipot. [2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques11 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1007	System Service Discovery	Sykipot may use `net start` to display running services.[3]
Enterprise	T1573.002	Asymmetric CryptographySub-technique	Sykipot uses SSL for encrypting C2 communications.[2]
Enterprise	T1111	Multi-Factor Authentication Interception	Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.[1]
Enterprise	T1087.002	Domain AccountSub-technique	Sykipot may use `net group "domain admins" /domain` to display accounts in the "domain admins" permissions group and `net localgroup "administrators"` to list local system administrator group membership.[3]
Enterprise	T1057	Process Discovery	Sykipot may gather a list of running processes by running `tasklist /v`.[3]
Enterprise	T1056.001	KeyloggingSub-technique	Sykipot contains keylogging functionality to steal passwords.[1]
Enterprise	T1018	Remote System Discovery	Sykipot may use `net view /domain` to display hostnames of available systems on a network.[3]
Enterprise	T1049	System Network Connections Discovery	Sykipot may use `netstat -ano` to display active network connections.[3]
Enterprise	T1016	System Network Configuration Discovery	Sykipot may use `ipconfig /all` to gather system network configuration details.[3]
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	Sykipot has been known to establish persistence by adding programs to the Run Registry key.[2]
Enterprise	T1055.001	Dynamic-link Library InjectionSub-technique	Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.[3]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 1.1
Created: May 31, 2017, 21:32 UTC (UTC+00:00)
Modified: Apr 25, 2025, 14:43 UTC (UTC+00:00)
Raw hash: 339f79b7b7d4204f...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	Apr 25, 2025, 14:43 UTC (UTC+00:00)	Current bundle	`339f79b7b7d4…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Alienvault Sykipot DOD Smart Cards
Blasco, J. (2012, January 12). Sykipot variant hijacks DOD and Windows smart cards. Retrieved January 10, 2016.
Open source URL
[2]
Blasco 2013
Blasco, J. (2013, March 21). New Sykipot developments [Blog]. Retrieved November 12, 2014.
[3]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[4]
Alienvault Sykipot DOD Smart Cards
Blasco, J. (2012, January 12). Sykipot variant hijacks DOD and Windows smart cards. Retrieved January 10, 2016.
Open source URL
[5]
Alienvault Sykipot DOD Smart Cards
Blasco, J. (2012, January 12). Sykipot variant hijacks DOD and Windows smart cards. Retrieved January 10, 2016.
Open source URL
[6]
Blasco 2013
Blasco, J. (2013, March 21). New Sykipot developments [Blog]. Retrieved November 12, 2014.
[7]
Blasco 2013
Blasco, J. (2013, March 21). New Sykipot developments [Blog]. Retrieved November 12, 2014.
[8]
mitre-attackS0018
Open source URL
[9]
mitre-attackS0018
Open source URL
[10]
mitre-attackS0018
Open source URL
[11]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[12]
Blasco 2013
Blasco, J. (2013, March 21). New Sykipot developments [Blog]. Retrieved November 12, 2014.
[13]
Blasco 2013
Blasco, J. (2013, March 21). New Sykipot developments [Blog]. Retrieved November 12, 2014.
[14]
Alienvault Sykipot DOD Smart Cards
Blasco, J. (2012, January 12). Sykipot variant hijacks DOD and Windows smart cards. Retrieved January 10, 2016.
Open source URL
[15]
Alienvault Sykipot DOD Smart Cards
Blasco, J. (2012, January 12). Sykipot variant hijacks DOD and Windows smart cards. Retrieved January 10, 2016.
Open source URL
[16]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[17]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[18]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[19]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[20]
Alienvault Sykipot DOD Smart Cards
Blasco, J. (2012, January 12). Sykipot variant hijacks DOD and Windows smart cards. Retrieved January 10, 2016.
Open source URL
[21]
Alienvault Sykipot DOD Smart Cards
Blasco, J. (2012, January 12). Sykipot variant hijacks DOD and Windows smart cards. Retrieved January 10, 2016.
Open source URL
[22]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[23]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[24]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[25]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[26]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[27]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL
[28]
Blasco 2013
Blasco, J. (2013, March 21). New Sykipot developments [Blog]. Retrieved November 12, 2014.
[29]
Blasco 2013
Blasco, J. (2013, March 21). New Sykipot developments [Blog]. Retrieved November 12, 2014.
[30]
AlienVault Sykipot 2011
Blasco, J. (2011, December 12). Another Sykipot sample likely targeting US federal agencies. Retrieved March 28, 2016.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use