Denis
Software · ATTACK:enterprise:S0354
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0354",
"title": "Denis",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0354",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--f25aab1a-0cef-4910-a85d-bb38b32ea41a",
"external_id": "S0354",
"domain": "enterprise",
"created": "2019-01-30T20:01:44.815Z",
"modified": "2025-04-16T20:38:43.085Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Denis"
},
{
"source_name": "Cybereason Oceanlotus May 2017",
"url": "https://www.cybereason.com/blog/operation-cobalt-kitty-apt"
}
]
}Explicit source assertions (21)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01eb6d18-bb7b-4e4a-b133-60407f40773b
Cybereason Oceanlotus May 2017 · Securelist Denis April 2017 · Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0439c736-6a78-4e89-9c55-6cc565b1b11f
Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--081e43bc-3f9e-4110-a1c1-db7396e2ff59
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--117ecbd3-b4cd-4ad2-a5f4-30ba79563406
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1055.012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e285f16-a145-46f5-aad3-0ea33392f147
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2910f5f5-38d6-418a-8566-23d31b93b124
Securelist Denis April 2017 · Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31028cf4-870e-490e-871e-ec55814dcef8
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33d24077-13af-4e14-ba79-87ca145c5383
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--427f45bd-6518-4527-9ca2-37cf368947f5
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cc3f3af-73f1-4f36-9e28-de4f8ecc3247
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56e55812-7622-4e84-96c6-6fc46dd2b541
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1560.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a6d57a7-8977-4928-8ef7-71d6c8a9fbfa
Securelist Denis April 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1574
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70ed2026-90af-4236-8180-2c095bbce0fe
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c3faa58-eb39-407a-8233-8f43f53aa777
Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a51caaf6-3b9d-4953-9850-bf9217877644
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad825dd4-a26c-4468-8c11-91124ef9042d
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b47d8f5e-7c09-4f40-a5a8-ccce10a8363b
Securelist Denis April 2017 · Cybereason Cobalt Kitty 2017ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0354
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e25ea0c4-513b-489d-943d-2828034f764f
Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2b750e7-ad43-4e27-96a1-9bdb0e886a72
Cybereason Oceanlotus May 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4881cea-8d6f-4cb6-ab86-5aab2379c695
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8d053fe-be2f-43fd-88d5-507e82ee4e1d
Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017