BadPatch
Software · ATTACK:enterprise:S0337
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0337",
"title": "BadPatch",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0337",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--9af05de0-bc09-4511-a350-5eb8b06185c1",
"external_id": "S0337",
"domain": "enterprise",
"created": "2019-01-29T21:33:34.082Z",
"modified": "2025-04-25T14:44:11.108Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "BadPatch"
},
{
"source_name": "Unit 42 BadPatch Oct 2017",
"url": "https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"
}
]
}Explicit source assertions (12)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11d37d18-3ad6-41ed-a99e-f1cc9d524c6c
Unit 42 BadPatch Oct 2017ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1071.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3126e151-051a-45ba-bc52-ca6f0f646fbb
Unit 42 BadPatch Oct 2017ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1074.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--330e86f3-f4ff-4fe0-af64-cd3c86849239
Unit 42 BadPatch Oct 2017ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--389029e4-c8bc-48e7-9e46-ca513eeda5ca
Unit 42 BadPatch Oct 2017ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--520faa7e-f529-4b54-b4dc-55d6ae094717
Unit 42 BadPatch Oct 2017ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5249b0e7-878e-44db-9d59-f162067f1852
Unit 42 BadPatch Oct 2017ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b83337c-5030-402d-ad28-1b9f5cf782cc
Unit 42 BadPatch Oct 2017ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ffaf382-3e91-409b-932f-24d107c59308
Unit 42 BadPatch Oct 2017ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--626b1cb2-60a8-4077-913e-1ee4e788cec6
Unit 42 BadPatch Oct 2017ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91eab726-0a0c-4898-8376-66987fd1037c
Unit 42 BadPatch Oct 2017ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c443cc21-5f8f-4c12-8848-39c469a1c9b2
Unit 42 BadPatch Oct 2017ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc2b58dd-1052-4860-8e14-5650ab8eecfd
Unit 42 BadPatch Oct 2017