Skip to content

Rocke

IntrusionSet · ATTACK:enterprise:G0106

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G0106",
  "title": "Rocke",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0106",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--44102191-3a31-45f8-acbe-34bdb441d5ad",
  "external_id": "G0106",
  "domain": "enterprise",
  "created": "2020-05-26T14:20:20.623Z",
  "modified": "2026-07-31T18:47:51.614Z",
  "version": "1.0",
  "aliases": [
    "Rocke"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Talos Rocke August 2018",
      "url": "https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"
    }
  ]
}

Explicit source assertions (36)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06508c23-746d-4894-b414-cff925692bd5

Talos Rocke August 2018 · Unit 42 Rocke January 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1014

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2107aab0-0191-46d1-abec-8d98ac916c21

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--277971c7-d42e-497f-8df4-be5b4bc094f8

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29552ed5-ecfd-4a97-a6c9-d6da25181e1a

Anomali Rocke March 2019 · Talos Rocke August 2018

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31e01486-8827-41cd-a21b-dc420554d1bb

Talos Rocke August 2018

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--322876d6-1b49-43d8-9e4a-590919d1f930

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37327da8-efd3-48c0-9f91-38f384f8579e

Talos Rocke August 2018

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e039f64-08da-4bb3-b8d5-1ed6428980ac

Talos Rocke August 2018

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1496.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46c37037-00da-4cf5-bde1-4296e10e6483

Talos Rocke August 2018 · Unit 42 Rocke January 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1027.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47440b3d-e6ef-4f7d-b732-453d1684424a

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1574.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47b95300-a51c-4d91-9bbe-e40956df2081

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48141016-3fc6-46af-9f93-b52439ed78ea

Talos Rocke August 2018 · Unit 42 Rocke January 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1053.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49a68076-c596-412d-a8af-3e238dfef960

Talos Rocke August 2018 · Unit 42 Rocke January 2019 · Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1059.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--521c66b9-fe52-4c2b-bc32-8ed3d98c7a71

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d8e9a49-f534-4cb6-9e3e-aebacb3c1dd0

Talos Rocke August 2018 · Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1055.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5de38b67-dbc7-46bf-bb73-91cd0e069d05

Talos Rocke August 2018

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--674031ea-4fff-4669-b44b-d289fa1cc36e

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1037

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b1cc49f-8d94-4f59-a723-2a70c3edf760

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1027.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78fc38f6-88ee-4f26-84e1-7532d95a4fbe

Talos Rocke August 2018 · Unit 42 Rocke January 2019 · Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1956344-1a2d-4193-bb20-0f65c98776fe

Talos Rocke August 2018

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1222.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a2f88508-4177-4294-b287-6a3494f6e738

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3d2ef4a-2bca-482d-897b-99da14b16b52

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1543.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a430e3fa-bfc0-4ea8-8264-217f6aa015fc

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--beae1b73-f369-4443-8e59-eb9e99665e8d

Talos Rocke August 2018

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfb5e752-4fc0-44c8-91a5-58a9d70119f0

Talos Rocke August 2018

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8fdab57-1e10-4f66-a1de-59a876c99ab1

Talos Rocke August 2018

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1685.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cdd5ccf4-a6cd-4642-a101-98c24ccc55a5

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de8fefef-bfe7-4720-a443-66713a47b439

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dec705fd-139b-49d6-b0d8-888b2b922a12

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8095f70-12de-4330-a293-25c4b4f22ffc

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--edea1ba7-228e-49db-a340-081c0e207495

Talos Rocke August 2018 · Unit 42 Rocke January 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7f947cd-6e0c-499c-8cdf-293e38657e31

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa69ac7a-8031-4fac-91e2-65e90f378cd1

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff14431c-bf82-44be-b12a-a65e88d5347a

Anomali Rocke March 2019

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff438715-ffa8-4fa2-a69e-7126dd60bfb3

Talos Rocke August 2018

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffb03265-d9d6-4dc7-ba8e-71498be4e131

Talos Rocke August 2018 · Unit 42 Rocke January 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.