Detect Felismus by hunting for the behaviours its loaders or payloads create on endpoints and in network traffic, especially unusual process launches, persistence changes, and connections to unfamiliar external hosts. Correlate endpoint alerts with DNS, proxy and authentication logs, and isolate systems that show repeat callbacks or signs of staged malware delivery.
What security teams should look for when Felismus is active
Felismus is best detected through the artefacts it leaves behind, not by a single signature. Watch for short-lived parent-child process chains, odd command lines, new autorun entries, scheduled task changes, services created outside normal change windows, and repeat callbacks to external infrastructure that does not match the environment’s usual business software.
Those patterns matter because loaders and staged payloads often separate delivery from execution. Endpoint telemetry should be reviewed alongside DNS, proxy and authentication data so that a suspicious process on one host can be tied to outbound resolution patterns, login activity, and lateral movement hints elsewhere in the estate.
For the malware context behind those behaviours, Malware Guide is the most useful starting point, because it explains how loaders, payload staging and evasion techniques typically surface in endpoint and network telemetry.
How to separate routine noise from meaningful Felismus activity
A useful detection rule is to look for combinations, not isolated alerts. One strange process launch may be benign, but a strange launch followed by persistence creation, outbound connections to unfamiliar hosts, and repeated retries from the same system deserves immediate review. The goal is to identify a sequence that looks like delivery, execution and re-contact.
Context is critical. Compare the alert chain with approved software inventory, known update channels, typical admin tools and scheduled maintenance windows. If the host is a jump box, developer workstation or server with normal administrative activity, the threshold for action is different, but the burden of explanation still sits with the observed behaviour.
Use a baseline of normal parent-child process relationships and common outbound destinations. If Felismus is present, the cluster will often look out of pattern even when any one event alone seems weak. The strongest detections usually combine process lineage, persistence change, DNS anomalies and authentication activity on the same time window.
For adversary-behaviour mapping, MITRE ATT&CK Enterprise Matrix helps analysts translate suspicious process creation, persistence and callback behaviour into a huntable attack sequence.
What to do once the pattern starts to repeat
When repeat callbacks or staged delivery indicators appear, treat the host as potentially compromised even if the initial payload is not fully identified. Contain the machine first, preserve volatile evidence, and then work outward from the initial endpoint to confirm whether the activity is isolated or part of a broader campaign.
Do not stop at endpoint containment. Check DNS logs for uncommon resolution patterns, proxy logs for unusual outbound sessions, and authentication logs for sign-ins that line up with the suspected execution window. If the host used service credentials, cached sessions or shared admin access, review whether those identities were touched as part of the same activity.
If the environment uses central monitoring and triage workflows, use established incident handling practices to preserve chain of custody while confirming scope. That is especially important when the same callback pattern appears on more than one system, because repeated delivery attempts often indicate a broader intrusion set rather than a single-host incident.
For incident-handling context, FIRST is useful for aligning the detection with coordinated response practice, and SANS Security Resources supports the practical SOC workflow of triage, containment and evidence preservation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1053 — Scheduled Task/Job | Felismus detection includes persistence changes that often surface as scheduled task abuse. |
| T1105 — Ingress Tool Transfer | Loader and staged payload behaviour often involves fetching tools or payloads from external infrastructure. | |
| T1071 — Application Layer Protocol | Repeat callbacks over DNS or web traffic fit common command-and-control patterns used by loaders. | |
| Recommendation — Map suspicious task creation and modification to T1053 and hunt for persistence established through scheduling. Monitor for unsolicited payload retrieval and stage-transfer activity from uncommon external hosts. Inspect application-layer outbound traffic for recurring beaconing and command-and-control patterns. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find potentially adverse events. | The answer depends on monitoring DNS, proxy and endpoint telemetry to spot suspicious behaviour. |
| RS.AN-01 — Investigation is performed to ensure effective response and support for forensics and recovery. | Repeated callbacks and persistence changes require investigation and scoping before recovery. | |
| Recommendation — Correlate endpoint, DNS and proxy telemetry to detect abnormal execution and external contact. Investigate recurring callbacks and persistence changes to determine scope and support containment. | ||
Practitioner Guidance
What to prioritise: Correlate endpoint telemetry with DNS, proxy and authentication logs before deciding whether a single host is noisy or genuinely compromised. The most useful signal is a repeatable chain of execution, persistence and outbound contact, especially when it appears on multiple systems or after normal business hours.
What to verify: Confirm whether the suspicious process tree, autorun change or scheduled task has any legitimate change ticket, deployment record or software-management explanation. If there is no clean operational reason for the behaviour, treat the host as an active investigation candidate rather than waiting for a higher-confidence alert.
What good looks like: Analysts can quickly tie one suspicious endpoint to network evidence, identify whether the callbacks are recurring, and decide whether the issue is isolated delivery or broader staging activity. That is the difference between chasing a one-off alert and containing an intrusion before it spreads.
Practitioner takeaway: For Felismus, detection quality comes from correlation and pattern recognition, not from a single alert type, so build the hunt around repeated behaviour that connects endpoint execution to external contact and identity activity.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org