Skip to main content

Liontail

This is a defensive tool-intelligence page. It is intended for analyst navigation, source review, and hunt planning. It is not a malware-analysis report and does not contain sample code or binaries.

Summary

  • Associated actor(s): Scarred Manticore
  • Tool type(s): Passive backdoor framework
  • Confidence level(s): High
  • Source ID(s): SRC-CP-SCARRED-MANTICORE-2023

Behavior

ActorBehavior Summary
Scarred ManticoreCheck Point reports Liontail as Scarred Manticore passive server-side tooling using IIS/native-module or HTTP.sys-adjacent access patterns for stealthy inbound-controlled access rather than standard webshell request/response behavior.

Hash And IOC Status

ActorStatusReference
Scarred ManticoreHash not committed; use Check Point source report references and local IIS module baselines.SRC-CP-SCARRED-MANTICORE-2023

Hashes and IOCs on this page are source pointers or representative public indicators. They SHOULD be refreshed from the linked source before operational use and MUST NOT be used alone for actor attribution.

Defensive Hunting Notes

ActorHunting Notes
Scarred ManticoreHunt IIS/native-module integrity changes, appcmd module registration, unexpected DLLs in IIS paths, HTTP.sys listener anomalies, worker-process child processes, and suspicious server DLL/service changes.

Handling Notes

ActorHandling Notes
Scarred ManticoreDo not conflate generic phantom-DLL hijacking with Liontail unless source-backed.

Mapped ATT&CK Techniques For Associated Actor(s)

ActorTechniqueTacticMapping QualitySource
Scarred ManticoreT1190 Exploit Public-Facing ApplicationInitial AccessM2SRC-CP-VOID-2024
Scarred ManticoreT1505.004 IIS ComponentsPersistenceM2SRC-CP-VOID-2024
Scarred ManticoreT1505.003 Web ShellPersistenceM2SRC-CP-VOID-2024
Scarred ManticoreT1071.001 Web ProtocolsCommand and ControlM2SRC-CP-VOID-2024
Scarred ManticoreT1199 Trusted RelationshipInitial AccessM2SRC-CP-VOID-2024

These detections are mapped through the associated actor or scenario and are not automatically tool-specific. Promote a tool-specific detection only after the behavior is tied to telemetry and test evidence.

ActorDetectionRelease StatusDRLRule
Scarred ManticoreDET-003 - Unitronics PLC HMI Web Interface AccessHunt4detections/sigma/unitronics-plc-hmi-web-access.yml

These hunts are mapped through the associated actor or scenario and may need narrowing before they are used for this specific tool.

ActorHuntHypothesisQuery
Scarred ManticoreHUNT-003If exposed PLC/HMI surfaces are targeted then OT management paths or ports will show external accessdetections/sigma/unitronics-plc-hmi-web-access.yml

Source Review

SourcePublisherDateReliabilityTypeLast Reviewed
SRC-CP-SCARRED-MANTICORE-2023Check Point Research2023-10-31AVendor CTI2026-05-14

If a source publishes a large or frequently changing IOC appendix, keep the current IOC list in the source system or TIP and store only the pointer here.