Skip to main content

TEMPLELOCK

This is a defensive tool-intelligence page. It is intended for analyst navigation, source review, and hunt planning. It is not a malware-analysis report and does not contain sample code or binaries.

Summary

  • Associated actor(s): UNC1860
  • Tool type(s): Defense-evasion utility
  • Confidence level(s): High
  • Source ID(s): SRC-MANDIANT-UNC1860

Behavior

ActorBehavior Summary
UNC1860Mandiant reports TEMPLELOCK as a .NET utility observed in foothold utilities and passive implants, capable of terminating threats associated with Windows Event Log service and restarting service operation on demand.

Hash And IOC Status

ActorStatusReference
UNC1860Hash not committed; use Mandiant activity-level IOC list.SRC-MANDIANT-UNC1860

Hashes and IOCs on this page are source pointers or representative public indicators. They SHOULD be refreshed from the linked source before operational use and MUST NOT be used alone for actor attribution.

Defensive Hunting Notes

ActorHunting Notes
UNC1860Hunt Event Log service stop/start anomalies, log service tampering, and unusual .NET utility execution from compromised servers.

Handling Notes

ActorHandling Notes
UNC1860Treat as behavior trigger, not attribution by itself.

Mapped ATT&CK Techniques For Associated Actor(s)

ActorTechniqueTacticMapping QualitySource
UNC1860T1190 Exploit Public-Facing ApplicationInitial AccessM2SRC-MANDIANT-UNC1860
UNC1860T1505.003 Web ShellPersistenceM2SRC-MANDIANT-UNC1860
UNC1860T1105 Ingress Tool TransferCommand and ControlM2SRC-MANDIANT-UNC1860
UNC1860T1021.001 Remote Services: RDPLateral MovementM2SRC-MANDIANT-UNC1860
UNC1860T1078 Valid AccountsDefense EvasionM2SRC-MANDIANT-UNC1860

These detections are mapped through the associated actor or scenario and are not automatically tool-specific. Promote a tool-specific detection only after the behavior is tied to telemetry and test evidence.

ActorDetectionRelease StatusDRLRule
UNC1860DET-003 - Unitronics PLC HMI Web Interface AccessHunt4detections/sigma/unitronics-plc-hmi-web-access.yml

These hunts are mapped through the associated actor or scenario and may need narrowing before they are used for this specific tool.

ActorHuntHypothesisQuery
UNC1860HUNT-003If exposed PLC/HMI surfaces are targeted then OT management paths or ports will show external accessdetections/sigma/unitronics-plc-hmi-web-access.yml

Source Review

SourcePublisherDateReliabilityTypeLast Reviewed
SRC-MANDIANT-UNC1860Google Cloud / Mandiant2024-09-19AVendor CTI2026-05-14

If a source publishes a large or frequently changing IOC appendix, keep the current IOC list in the source system or TIP and store only the pointer here.