H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[DarkWatchman](https://attack.mitre.org/software/S0673) is a lightweight JavaScript-based remote access tool (RAT) that avoids file operations; it was first observed in November 2021.(Citation: Prevailion DarkWatchman 2021)

Labels

malware

34 recorded

Relationships

uses

to Application Window Discovery

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Browser Information Discovery

Technique

uses

to Command Obfuscation

Technique

uses

to Compile After Delivery

Technique

uses

to Compression

Technique

uses

to Data from Local System

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to Domain Generation Algorithms

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Fileless Storage

Technique

uses

to Indicator Removal

Technique

uses

to Inhibit System Recovery

Technique

uses

to JavaScript

Technique

uses

to Keylogging

Technique

uses

to Local Data Staging

Technique

uses

to Masquerading

Technique

uses

to Modify Registry

Technique

uses

to Peripheral Device Discovery

Technique

uses

to PowerShell

Technique

uses

to Query Registry

Technique

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

to Shared Modules

Technique

uses

to Spearphishing Attachment

Technique

uses

to Standard Encoding

Technique

uses

to System Information Discovery

Technique

uses

to System Location Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Web Protocols

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

2 external

References

mitre-attack

S0673

open

Prevailion DarkWatchman 2021

https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/

open