S1017: OutSteel

OutSteel matters because ATT&CK describes it as a Windows AutoIT-based file uploader and document stealer. For leaders, the practical risk is not just malware execution: it is targeted document theft following phishing or user-driven execution, with automated collection and exfiltration behaviors that can affect sensitive files, legal/compliance evidence, and incident containment decisions.

Executive priority

Prioritize OutSteel as a validation case for phishing resilience, Windows endpoint visibility, document data-loss monitoring, and incident response readiness. ATT&CK links it to Saint Bear and to behaviors including spearphishing attachments/links, AutoIT execution, file and process discovery, automated collection, C2 over web protocols, and exfiltration. Executives should ask whether the organization can prove collection-to-exfiltration visibility, not only whether email security blocks an initial lure.

Technical view

For SOC and IR teams, treat this as a Windows-focused malware profile with relationship-driven behaviors across initial access, execution, discovery, collection, command-and-control, lateral transfer, stealth, and exfiltration. Validate visibility for AutoIT/AutoHotKey and Windows command shell execution, user opening malicious files or links, file and directory enumeration, process discovery, file staging or deletion, ingress/lateral file transfer, HTTP/S-like C2, and automated document collection/exfiltration. ATT&CK does not provide an official detection analytic for OutSteel, so coverage should be built from these related techniques and tested against local baselines.

Likely telemetry

Email security and mail gateway logs for spearphishing attachments and links
Endpoint process creation telemetry for cmd.exe and AutoIT/AutoHotKey-related execution
File system telemetry for document enumeration, staging, copying, upload preparation, and deletion
EDR alerts and host artifacts for unusual process discovery and file/directory discovery
Network proxy, DNS, firewall, and web telemetry for outbound web-protocol communications

Detection direction

Because no official ATT&CK detection text is supplied, validate detections at the technique level rather than relying on a named OutSteel signature.
Correlate phishing delivery or user-click/open events with AutoIT/script execution, command shell activity, rapid file discovery, and outbound web traffic.
Tune for document-focused enumeration and collection patterns while accounting for legitimate indexing, backup, eDiscovery, and administrative scripts as false-positive sources.
Review whether encrypted web traffic, unmanaged endpoints, and limited endpoint command-line logging create blind spots for exfiltration over C2 or web protocols.
Use the Saint Bear relationship as threat-intelligence context for prioritization, but do not treat it as attribution without incident-specific evidence.

Mitigation priorities

Strengthen email and web controls for malicious attachments and links, including user-reporting workflows and rapid takedown/blocking processes.
Reduce script abuse exposure on Windows by controlling or monitoring AutoIT/AutoHotKey and command shell execution where business use is limited.
Ensure EDR and logging capture process creation, command lines, file activity, and outbound network context needed to reconstruct collection and exfiltration.
Apply least privilege and data access controls so a compromised user context has limited access to sensitive document stores.
Validate DLP/egress monitoring for unusual document movement and outbound uploads over web protocols.

Additional notes and limits

This take is based on the ATT&CK S1017 OutSteel software object, its official description, the Palo Alto Unit 42 external reference, and supplied ATT&CK relationships. The relationship set is especially important because the object itself has no tactic list and no official detection guidance.

ATT&CK identifies OutSteel as Windows malware but several related techniques have broader platform lists because they are generic ATT&CK techniques; platform assumptions should therefore remain Windows-focused for this malware. Local telemetry, prevalence, specific indicators, and confirmed targeting must come from the organization’s own evidence and current intelligence.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

OutSteel

OutSteel is a file uploader and document stealer developed with the scripting language AutoIT that has been used by Saint Bear since at least March 2021.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques17 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1059.003	Windows Command ShellSub-technique	OutSteel has used `cmd.exe` to scan a compromised host for specific file extensions.[1]
Enterprise	T1041	Exfiltration Over C2 Channel	OutSteel can upload files from a compromised host over its C2 channel.[1]
Enterprise	T1566.002	Spearphishing LinkSub-technique	OutSteel has been distributed through malicious links contained within spearphishing emails.[1]
Enterprise	T1204.001	Malicious LinkSub-technique	OutSteel has relied on a user to click a malicious link within a spearphishing email.[1]
Enterprise	T1005	Data from Local System	OutSteel can collect information from a compromised host.[1]
Enterprise	T1020	Automated Exfiltration	OutSteel can automatically upload collected files to its C2 server.[1]
Enterprise	T1059.010	AutoHotKey & AutoITSub-technique	OutSteel was developed using the AutoIT scripting language.[1]
Enterprise	T1083	File and Directory Discovery	OutSteel can search for specific file extensions, including zipped files.[1]
Enterprise	T1119	Automated Collection	OutSteel can automatically scan for and collect files with specific extensions.[1]
Enterprise	T1204.002	Malicious FileSub-technique	OutSteel has relied on a user to execute a malicious attachment delivered via spearphishing.[1]
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	OutSteel has been distributed as a malicious attachment within a spearphishing email.[1]
Enterprise	T1070.004	File DeletionSub-technique	OutSteel can delete itself following the successful execution of a follow-on payload.[1]
Enterprise	T1570	Lateral Tool Transfer	OutSteel can download the Saint Bot malware for follow-on execution.[1]
Enterprise	T1071.001	Web ProtocolsSub-technique	OutSteel has used HTTP for C2 communications.[1]
Enterprise	T1105	Ingress Tool Transfer	OutSteel can download files from its C2 server.[1]
Enterprise	T1057	Process Discovery	OutSteel can identify running processes on a compromised host.[1]
Enterprise	T1036.005	Match Legitimate Resource Name or LocationSub-technique	OutSteel attempts to download and execute Saint Bot to a statically-defined location attempting to mimic svchost: `%TEMP%\\svjhost.exe`.[1]

Associated objects

Groups, software, and campaigns

G1031: Saint Bear

Saint Bear is a Russian-nexus threat actor active since early 2021, primarily targeting entities in Ukraine and Georgia. The group is notable for a specific remote access tool, Saint Bot, and information stealer, OutSteel in campaigns. Saint Bear typically relies on phishing or web staging of malicious documents and related file types for initial access, spoofing government or related entities.[1][2] Saint Bear has previously been confused with Ember Bear operations, but analysis of behaviors, tools, and targeting indicates these are distinct clusters.

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 2.0
Created: Jun 9, 2022, 16:07 UTC (UTC+00:00)
Modified: Oct 8, 2024, 20:11 UTC (UTC+00:00)
Raw hash: 07bdaa10c1bf1063...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.0	Oct 8, 2024, 20:11 UTC (UTC+00:00)	Current bundle	`07bdaa10c1bf…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[2]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[3]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[4]
mitre-attackS1017
Open source URL
[5]
mitre-attackS1017
Open source URL
[6]
mitre-attackS1017
Open source URL
[7]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[8]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[9]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[10]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[11]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[12]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[13]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[14]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[15]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[16]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[17]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[18]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[19]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[20]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[21]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[22]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[23]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[24]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[25]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[26]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[27]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[28]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[29]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[30]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[31]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[32]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[33]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[34]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[35]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[36]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[37]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[38]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL
[39]
Palo Alto Unit 42 OutSteel SaintBot February 2022
Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use