Skip to content

Mimikatz

Software · ATTACK:enterprise:S0002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0002",
  "title": "Mimikatz",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--afc079f3-c0ea-4096-b75d-3f05338b7f60",
  "external_id": "S0002",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:11.544Z",
  "modified": "2026-05-12T15:12:00.740Z",
  "version": "1.11",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Deply Mimikatz",
      "url": "https://github.com/gentilkiwi/mimikatz"
    },
    {
      "source_name": "Adsecurity Mimikatz Guide",
      "url": "https://adsecurity.org/?page_id=1821"
    }
  ]
}

Explicit source assertions (77)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1003.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0209cfd7-95d3-4bc5-8f0e-72a70b245fe9

Deply Mimikatz · GitHub Mimikatz lsadump Module · Directory Services Internals DPAPI Backup Keys Oct 2015 · NCSC Joint Report Public Tools · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--032fb34d-3434-4667-9d5e-6bb9fd6b7d00

FireEye APT32 May 2017 · Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--067814b5-aa57-45e0-9bdf-5536b077c224

F-Secure The Dukes · Microsoft 365 Defender Solorigate · CrowdStrike StellarParticle January 2022

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09c54ed8-4b03-4e39-b364-bf2e751dbe06

TrendMicro EarthLusca 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ea53e8d-743e-4828-8c65-9b610593270a

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11d0f089-6dc7-4468-b186-e1a8b621051b

Deply Mimikatz · GitHub Mimikatz lsadump Module · Directory Services Internals DPAPI Backup Keys Oct 2015 · NCSC Joint Report Public Tools · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1207

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15fe2d8e-9a4e-433e-9dca-d7329e7ca846

Deply Mimikatz · Adsecurity Mimikatz Guide

ATTACK:enterprise:G0079 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17aef45b-9a3c-4192-af31-4a21300a90e0

Unit 42 DarkHydrus July 2018 · Unit 42 Playbook Dec 2017

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1552.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c5b8ff2-400a-4e0f-a819-3cc8f1bc76b8

Adsecurity Mimikatz Guide

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d0d0fe6-f16d-4c69-bbaf-1d5423b852fb

NCC Group TA505

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--243278fe-4f59-42f8-8c39-85a7d64f0fb1

Unit42 Agrius 2023

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28471736-5b62-4132-b4ed-c22ae449b455

Secureworks BRONZE BUTLER Oct 2017 · Symantec Tick Apr 2016 · Trend Micro Tick November 2019

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a02ac13-c551-45ad-a4bc-2641d7f182ff

FoxIT Wocao December 2019

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30c4bdc2-1697-4eb6-ac74-3cfb86d17a5b

Dragos Crashoverride 2018

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b056bef-e49e-4611-8c20-23cc14689b74

Symantec Elfin Mar 2019

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1134.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e5cf341-4707-4de3-bb06-43530ee3e90f

AdSecurity Kerberos GT Aug 2015 · Adsecurity Mimikatz Guide

ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fff8382-175d-44ce-b430-ae32930817ec

Arctic Wolf Akira 2023

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1547.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41f04732-8fdc-4b2f-9e22-7b78ff650e5d

ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--420064ce-0bfd-4daa-9e4c-4b197634be19

Kaspersky CactusPete Aug 2020

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47b76f42-e305-4aac-a1cc-d7cb84b1d8bf

FireEye APT39 Jan 2019 · Dark Reading APT39 JAN 2019 · BitDefender Chafer May 2020 · Symantec Chafer February 2018

ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47e9267e-e84d-43b6-992a-5f42d39c45bb

RedCanary Mockingbird May 2020

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4807dbdc-6bcb-4aed-96f4-a782551eaefe

PTSecurity Cobalt Group Aug 2017 · PTSecurity Cobalt Dec 2016 · Group IB Cobalt Aug 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ce5e752-97d6-4803-a49c-0f905729a133

Talent-Jump Clambling February 2020 · SecureWorks BRONZE UNION June 2017 · Profero APT27 December 2020 · Trend Micro DRBControl February 2020 · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cf4df8f-9eb3-4136-a082-ea1b5d7b398f

NCC Group APT15 Alive and Strong · Microsoft NICKEL December 2021

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51372934-2c81-4db7-aa38-cbb173698cc2

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51b09cc3-d54b-4b22-a354-0e2094851321

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:G0088 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57216102-21aa-402b-b306-79e1dd548716

FireEye TRITON 2019

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cfcbf60-454a-4673-aa93-9020d04efab7

Kaspersky Sofacy

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--630dedba-136b-4ea3-956e-f8f38e96653d

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6392b6f0-7796-4737-9b3b-2560d754b2b5

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66e4c037-f848-4af1-9138-b5bba80acf45

Microsoft SharePoint Exploit JUL 2025

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6736036b-1b05-4857-aded-75a7d42a8be2

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67f2ca97-5949-4503-a55c-1f0d3f3502ca

FireEye APT35 2018

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b83bc1e-edfc-4c6a-961f-d3757ae6a234

Adsecurity Mimikatz Guide · NCSC Joint Report Public Tools · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e641c36-188b-480e-b177-e412cd000b34

Adsecurity Mimikatz Guide · Metcalf 2015

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e79a5b7-c12b-4f4c-a7a2-40141389e40e

CISA Iran Albanian Attacks September 2022 · Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6eba9c1c-e0ee-4efe-9e8a-f1abb7c1e01a

Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023 · Mandiant UNC3944 May 2025 · MSTIC Octo Tempest Operations October 2023

ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70b67b3f-7706-41aa-8330-58323a8553fc

FireEye TRITON 2019

ATTACK:enterprise:G0076 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70e7b609-b57d-4c71-931e-b8a658b0ba0d

Symantec Thrip June 2018

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1550.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76037b22-a3e4-40d3-bd56-699d1ea4e97e

AdSecurity Kerberos GT Aug 2015 · Adsecurity Mimikatz Guide · Harmj0y DCSync Sept 2015 · NCSC Joint Report Public Tools

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1555.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7804d727-91bc-41bd-9b05-686d550e9e04

Deply Mimikatz · GitHub Mimikatz lsadump Module · Directory Services Internals DPAPI Backup Keys Oct 2015 · NCSC Joint Report Public Tools

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a117c20-6bb1-40b7-90c7-f8a01a987921

Costa AvosLocker May 2022 · Cisco Talos Avos Jun 2022

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1558.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b8254f2-bfbb-4775-aaf8-3b5fa3457ee9

GitHub Mimikatz kerberos Module · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d8a984d-676d-47bf-a660-00c43ab49985

CrowdStrike StellarParticle January 2022 · Microsoft 365 Defender Solorigate

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e307ac4-f569-4606-a500-b5ead2d5967f

MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f04a14f-ab65-4ad5-9d67-a4b509ba8087

Deply Mimikatz · GitHub Mimikatz lsadump Module · Directory Services Internals DPAPI Backup Keys Oct 2015 · NCSC Joint Report Public Tools

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80d4d084-46c0-481f-8827-66bfa2a7bbdd

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8329b484-4c42-4c30-8565-a742bff07b0c

CISA AA24-038A PRC Critical Infrastructure February 2024 · Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ac0d84e-76ce-4702-8616-2a2f9b41cfdc

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bdc51e7-d2fd-44fb-bfed-6767b6522405

Crowdstrike Indrik November 2018 · Mandiant_UNC2165

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f66e226-ecc4-408d-becb-4e9ad9c66b57

Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019

ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90a7c108-ea5d-4274-a406-4494de107435

FireEye TRITON 2018

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93642a19-cc8f-4298-9398-8d5d029fe53d

Unit 42 MuddyWater Nov 2017 · TrendMicro POWERSTATS V3 June 2019

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--984a0d7f-407f-4e3b-afd5-1dc107a980d5

Symantec Leafminer July 2018

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9be3defb-cc1d-4d8f-b0a8-bc153b0f1947

FireEye APT41 Aug 2019 · Group IB APT 41 June 2021

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a15517f7-62c1-4b25-b763-e033d44ee41b

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b08e3c96-25a7-412f-bbfb-63e010ef3891

Cylance Cleaver

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b56a1198-e23a-48f4-9744-7a6f087b79a3

FireEye APT38 Oct 2018

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7930db8-2cb9-4ecf-b3d3-7425f99140d8

Deply Mimikatz · GitHub Mimikatz lsadump Module · Directory Services Internals DPAPI Backup Keys Oct 2015 · NCSC Joint Report Public Tools

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8c62d16-4282-4cb4-a279-fb3427a92099

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9c05069-a05f-4b74-9b4d-275c64f2e124

ESET Turla Mosquito May 2018 · Symantec Waterbug Jun 2019

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be49ddce-5925-4fb2-8822-0b665d9aa812

Cycraft Chimera April 2020 · NCC Group Chimera January 2021

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1558.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf080191-d58e-4834-8b4f-7315df4d76bf

GitHub Mimikatz kerberos Module

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c118e50b-4559-4bff-bde5-78aa426f3db4

FireEye KEGTAP SINGLEMALT October 2020 · DHS/CISA Ransomware Targeting Healthcare October 2020

ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4bea2b7-e8a2-45d0-bac2-4d82576c1521

Kaspersky Carbanak

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1555.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c92047b8-50d6-4fde-8acd-98132dcdc32f

Delpy Mimikatz Crendential Manager

ATTACK:enterprise:G0011 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc831c63-94af-4937-b8e6-668591ec7d04

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df6bb7e8-1971-4e8c-92cc-16727ac996dd

Kaspersky Lyceum October 2021

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dfd6892f-82a4-4db4-a132-3d6f221e55f4

Secureworks IRON LIBERTY July 2019

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e94576ee-284c-4782-a6ef-b7dd8a780254

FireEye APT34 Webinar Dec 2017 · FireEye APT35 2018 · Symantec Crambus OCT 2023 · Unit42 OilRig Playbook 2023

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec6d7edc-f538-41ce-89b6-a2c424ddd58b

Netscout Stolen Pencil Dec 2018 · KISA Operation Muzabi · Mandiant APT43 March 2024

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ecc6def4-fd02-484e-8ad5-3fe93ac7c716

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed3bc4c8-f800-440f-8bb4-c5e8e4611eb3

Security Intelligence More Eggs Aug 2019

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1649

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed48d88f-840e-4653-84df-7181afc6dfd3

Adsecurity Mimikatz Guide

ATTACK:enterprise:G0107 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eda182e5-ad1a-466b-8ede-664a2c778076

Symantec Whitefly March 2019

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1003.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5e29f3a-99b1-4c45-952b-c238f72435ab

Deply Mimikatz · GitHub Mimikatz lsadump Module · Directory Services Internals DPAPI Backup Keys Oct 2015 · NCSC Joint Report Public Tools

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffa16031-220f-4bb3-9be4-241b4b43b53e

Microsoft BlackByte 2023

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.