ATT&CK Technique · Stealth / Discovery
T1497.001 System ChecksMapped by 11 reports, 7 detection rules and 6 tracked actors on The Hunters Ledger. Technique page on attack.mitre.org.
← All techniques and the coverage heatmap
Reports
Each report maps this technique in its own ATT&CK table, at the confidence the report states. The link opens that table.
Detection rules
Rules whose ATT&CK coverage line names this technique, by detection page. The link opens the page's coverage table.
Detection rules
Rovodev AI-Co-Authored Mirai Variant + Matrix C2 (87.106.143.220)MAL_Python_StealthAgent_AntiDebug_AntiVM_AI_Authored (YARA, Hunting)
Detection rules
Shadow RAT & XWorm Open Directory CampaignXWorm 3.0-5.0: Config and Builder Markers (YARA, Detection); XWorm 3.0-5.0: Rijndael-256-ECB Config Crypto Pattern (YARA, Hunting); Non-Browser Process DNS Query to ip-api.com Hosting Detection Endpoint (SIGMA, Hunting); WMI Win32_ComputerSystem Query from User-Writable Directory (SIGMA, Hunting); XWorm Anti-Analysis Hosting Detection via ip-api.com (SURICATA, Hunting)
Detection rules
Houselet.exe — The Go-Based Loader Masquerading as PlayStation Remote PlayCommand Line Referencing Virtualization or Sandbox Artifacts (SIGMA, Hunting)
Tracked actors
Designations whose reports map this technique.
- UTA-2026-001: Sliver C2 operator with an automated ScareCrow, Donut and SysWhispers3 build pipeline
- UTA-2026-003: Commodity MaaS consumer running Shadow RAT and XWorm from one Windows VPS
- UTA-2026-004: Developer of the OpenStrike multi-implant C2 toolkit, with a cracked Cobalt Strike arsenal
- UTA-2026-005: Chaos ransomware builder user with a private five-stage crypter
- UTA-2026-007: HijackLoader customer running a 15-month multi-vector phishing campaign into an AsyncRAT-class RAT
- UTA-2026-014: DDoS-for-hire operator running an AI co-authored C2 framework over a Pandora-Mirai botnet
ATT&CK v19.2. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; technique names are MITRE's and link to MITRE's own pages. The mapping on each linked page is this publication's reading of its own evidence.