Skip to content

Ping

Software · ATTACK:enterprise:S0097

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0097",
  "title": "Ping",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0097",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--b77b563c-34bb-4fb8-86a3-3694338f7b47",
  "external_id": "S0097",
  "domain": "enterprise",
  "created": "2017-05-31T21:33:01.483Z",
  "modified": "2026-05-12T15:12:00.740Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "TechNet Ping",
      "url": "https://technet.microsoft.com/en-us/library/bb490968.aspx"
    }
  ]
}

Explicit source assertions (20)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0666ab5e-7771-4f61-8c80-6a0202624caa

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--090c11ed-8235-4c05-b553-749ee6497b0a

Cybereason Soft Cell June 2019

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ce9c0f3-6da9-402c-adc4-a001877e40e6

ClearSky Siamesekitten August 2021

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d51acf9-f8df-42e1-aef3-4c86cf5ab17a

NCC Group APT15 Alive and Strong

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--194b2a3c-ce1f-4326-a26f-fd998c94b947

Costa AvosLocker May 2022

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--201802a3-afae-4c10-a125-0fc4fd62f1d2

Bitdefender Sardonic Aug 2021

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27c6ffb3-836c-4a43-9862-b77c8e4a8256

DFIR Phosphorus November 2021

ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a220ca3-88f4-40eb-8041-184c412950d4

Baumgartner Naikon 2015 · Bitdefender Naikon April 2021

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ce2f87e-527d-4bc1-9ba1-79ade0a4db59

Alperovitch 2014

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fcefdbe-87b9-4434-87ea-996425650be0

Symantec Bilbug 2022

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43b9a1b5-6f95-4c6c-8e1f-59f9049e3afb

DFIR Ryuk's Return October 2020 · DHS/CISA Ransomware Targeting Healthcare October 2020 · DFIR Ryuk in 5 Hours October 2020

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bfd02aa-acc6-47a0-8867-d7962ce775f6

FireEye APT41 Aug 2019 · Group IB APT 41 June 2021

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c6cd115-7f4c-4fda-b848-4ef3e81d44cd

ATTACK:enterprise:S0097 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b2356e1-6544-40a7-a694-8ac36a1da1b7

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac0fcc8b-d546-4882-bb25-f12a8b9381ee

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad6cad0b-d827-4182-baf9-826c6788cf4e

CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c73c6a89-90d5-47e0-af58-b5197d4f3594

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d77885d0-46e0-47b7-9cc2-6a396c570b12

Symantec Shuckworm January 2022

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc253840-25d8-4080-9668-fde2fc3e4173

JPCERT MirrorFace JUL 2024

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5f75ae0-45f5-48b8-938f-f0d9e17e53eb

FireEye APT10 April 2017 · PWC Cloud Hopper Technical Annex April 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.