Attackers use SLOWDRIFT as a backdoor to maintain remote access after initial compromise. It is typically used to run commands, collect host information, and stage follow-on payloads while trying to stay hidden. Defenders should hunt for unexpected persistence, unusual outbound connections, and processes that do not match the normal software estate.
How attackers use SLOWDRIFT to stay on a system
SLOWDRIFT is used as a backdoor, so the attacker’s goal is usually persistence rather than a one-time action. Once it is planted, it gives remote command execution, host reconnaissance, and a path to stage additional payloads while blending into normal activity. The important takeaway is that this is about retaining access and preparing the next move, not just running one malicious command.
That makes SLOWDRIFT operationally similar to other backdoor malware: it gives the intruder a foothold they can return to, reuse, and extend. The malware is most dangerous when defenders treat it as a single endpoint event instead of part of a broader intrusion chain that may already include credential theft, lateral movement, or follow-on deployment.
What SLOWDRIFT does during an intrusion
In practice, attackers use SLOWDRIFT to execute commands on the compromised host, inventory the environment, and gather enough context to decide what to do next. That can include checking installed software, system details, network configuration, and nearby opportunities for deeper access. This kind of reconnaissance helps the attacker avoid noisy actions and choose the next payload or target more carefully.
It also serves as a staging mechanism. Once the attacker has a working backdoor, they can deliver additional tools, expand access, or prepare later exploitation without having to repeat the initial intrusion step. A backdoor is valuable because it shortens the time between access and impact.
Why it is hard to spot
SLOWDRIFT is useful to attackers because it is designed to stay hidden while still being reliable. That usually means low-noise execution, intermittent communication, and behaviour that can look like ordinary administration or software activity if defenders only scan for obvious malware signatures. The real tell is often the pattern of persistence and unusual process behaviour, not a single malicious-looking action.
Defenders should pay attention to unexpected outbound connections, uncommon parent-child process relationships, and executables that do not fit the normal software estate. Those signals matter because backdoors often survive longer than the initial compromise that introduced them.
Risk and Threat Considerations
SLOWDRIFT is risky because a backdoor converts a single intrusion into an ongoing access path. Once an attacker can return remotely, the compromise can persist even if the original entry point is closed, and the attacker can quietly escalate, stage payloads, or move to adjacent systems.
Failure mechanism: The malware maintains remote execution and hides its activity well enough to delay detection, so defenders may see only fragmented telemetry while the attacker continues to operate.
Impact: The result can be prolonged dwell time, repeated access, additional payload delivery, and a higher chance that the intruder reaches sensitive systems before the incident is contained.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1095 — Non-Application Layer Protocol | Covers backdoor-style remote command and control behavior used to sustain access. |
| T1059 — Command and Scripting Interpreter | Directly applies when the backdoor is used to run commands on the host. | |
| T1105 — Ingress Tool Transfer | Relevant because attackers often use a backdoor to stage follow-on payloads. | |
| Recommendation — Map SLOWDRIFT communications to ATT&CK and hunt for anomalous command-and-control traffic. Correlate suspicious script or shell execution with the infected host and isolate it quickly. Look for payload staging from the compromised system and block unexpected transfer paths. | ||
Practitioner Guidance
What to verify: Treat any SLOWDRIFT finding as a persistence investigation, not just an endpoint cleanup task. Confirm whether the host still has active outbound sessions, whether other tools or accounts were used from the same machine, and whether the compromise extended beyond the first executable you found.
Decision rule: If the host has served as a staging point for later payloads or command execution, isolate it and hunt laterally before trusting remediation is complete. If you only remove the malware but do not check what it already enabled, you risk leaving the attacker’s access path intact.
Practitioner takeaway: The critical question is not “what did SLOWDRIFT run?” but “what continued access did it preserve?” Backdoor malware should be handled as an access problem first and a malware problem second.
Related resources from NHI Mgmt Group
- Guide: Malware Guide
- How do attackers turn a supply-chain incident into wider NHI compromise?
- How do attackers operationalise stolen OAuth tokens at scale?
- Why do attackers often check model availability before trying to generate content?
- How do attackers turn stolen npm secrets into broader compromise?