Malware

Green Plasma

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1574Hijack Execution FlowEvidence2

With a handle to memory that a SYSTEM process is actively reading and executing, the attacker can manipulate its contents to redirect execution flow and spawn their payload.

Persistence

2 techniques

T1112Modify RegistryEvidence2

Blackfort Technology confirmed the strongest IOCs are the registry artifacts. The BlockedApps key created as a volatile REG_LINK and SymbolicLinkValue pointing to ...\Policies\System showed the best signal-to-noise ratio in testing.

T1543Create or Modify System ProcessEvidence1

The exploit calls NtCreateSymbolicLinkObject to plant a malicious symlink at that location before the desktop switch completes.

Privilege Escalation

3 techniques

T1068Exploitation for Privilege EscalationEvidence1

The attacker pre-plants a symbolic link, at that exact path. The SYSTEM process follows it blindly, creating the memory object at the attacker’s chosen destination instead. The attacker’s unprivileged process grabs that handle the moment it appears, and that’s the foothold.

T1543Create or Modify System ProcessEvidence1

The exploit calls NtCreateSymbolicLinkObject to plant a malicious symlink at that location before the desktop switch completes.

T1548.002Bypass User Account ControlEvidence2

The attacker executes conthehost.exe using the runas verb (ShellExecuteEx). This then forces Windows to switch desktops to show the UAC elevation prompt.

Stealth

1 technique

T1574Hijack Execution FlowEvidence2

With a handle to memory that a SYSTEM process is actively reading and executing, the attacker can manipulate its contents to redirect execution flow and spawn their payload.

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

malware newsNews

May 23, 2026

Detection Logic Bugs, Developing Context to Bypass MiniPlasma Rules - Malware News - Malware Analysis, News and Indicators

A Windows local privilege escalation exploit/variant that abuses a predictable hardcoded shared memory object path during a UAC secure desktop switch. It pre-creates a symbolic link so a SYSTEM process creates a section object at an attacker-controlled destination, allowing a low-privileged process to obtain a handle and manipulate execution to gain SYSTEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Green Plasma

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1574Hijack Execution FlowEvidence2

With a handle to memory that a SYSTEM process is actively reading and executing, the attacker can manipulate its contents to redirect execution flow and spawn their payload.

Persistence

2 techniques

T1112Modify RegistryEvidence2

T1543Create or Modify System ProcessEvidence1

The exploit calls NtCreateSymbolicLinkObject to plant a malicious symlink at that location before the desktop switch completes.

Privilege Escalation

3 techniques

T1068Exploitation for Privilege EscalationEvidence1

T1543Create or Modify System ProcessEvidence1

The exploit calls NtCreateSymbolicLinkObject to plant a malicious symlink at that location before the desktop switch completes.

T1548.002Bypass User Account ControlEvidence2

The attacker executes conthehost.exe using the runas verb (ShellExecuteEx). This then forces Windows to switch desktops to show the UAC elevation prompt.

Stealth

1 technique

T1574Hijack Execution FlowEvidence2

With a handle to memory that a SYSTEM process is actively reading and executing, the attacker can manipulate its contents to redirect execution flow and spawn their payload.

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

malware newsNews

May 23, 2026

Detection Logic Bugs, Developing Context to Bypass MiniPlasma Rules - Malware News - Malware Analysis, News and Indicators

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.