Keydnap
Software · ATTACK:enterprise:S0276
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0276",
"title": "Keydnap",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0276",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--4b072c90-bc7a-432b-940e-016fc1c01761",
"external_id": "S0276",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2024-01-10T15:18:40.400Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "OSX/Keydnap"
},
{
"source_name": "Keydnap"
},
{
"source_name": "OSX Keydnap malware",
"url": "https://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware-hungry-credentials/"
},
{
"source_name": "synack 2016 review",
"url": "https://objective-see.org/blog/blog_0x16.html"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02e4c930-ffc1-4bcb-a989-12db90671f90
synack 2016 reviewATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39556624-1c45-4178-bfa4-7a20b254df7e
synack 2016 reviewATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1555.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--433418bb-0771-4b2d-9d6c-a153f6819798
synack 2016 reviewATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1564.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4efc1b5d-c1cb-4d94-a4b8-6b0b2b857788
OSX Keydnap malwareATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1548.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72b7d86e-5e78-4bc6-a16e-c4380d12d627
OSX Keydnap malwareATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7eef6b42-8c4c-4619-b0ed-fa17f16de722
synack 2016 reviewATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1036.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b9688abd-0f6d-4c76-8b73-d9fe7d11f07f
synack 2016 reviewATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2dd48c1-c960-4f6f-ad99-5b2aa7463e68
synack 2016 reviewATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--feccb439-0a34-4224-ba12-62e11215d5a5
synack 2016 review