HotCroissant
Software · ATTACK:enterprise:S0431
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0431",
"title": "HotCroissant",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0431",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--aad11e34-02ca-4220-91cd-2ed420af4db3",
"external_id": "S0431",
"domain": "enterprise",
"created": "2020-05-01T19:10:31.446Z",
"modified": "2024-04-11T02:17:38.807Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Carbon Black HotCroissant April 2020",
"url": "https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"
},
{
"source_name": "US-CERT HOTCROISSANT February 2020",
"url": "https://www.us-cert.gov/ncas/analysis-reports/ar20-045d"
}
]
}Explicit source assertions (21)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1678d731-c556-4968-aab1-ae745015308f
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30da2329-c7ee-4ac9-a38d-af79e6c1389c
Carbon Black HotCroissant April 2020 · US-CERT HOTCROISSANT February 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45310a29-78b6-4863-ab0b-49fd53ef1809
Carbon Black HotCroissant April 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0431
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--636c3816-21ed-46f7-8837-2334bed88e42
US-CERT HOTCROISSANT February 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7066827b-795c-447c-9c07-05765ed1e07b
US-CERT HOTCROISSANT February 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74f14668-7111-4f96-a307-4aac00d91cf4
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--911d7f27-a32e-45fb-a66b-e7b195023c43
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92e19c14-504e-402f-b755-08358333cda0
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--967c2498-0f51-464f-b5e5-2a0539614033
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98fd9ed1-abf3-4e2f-b071-8aea2dc44a64
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5720510-fadb-496d-97b5-99cdabb051ab
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a88e956c-6c71-47e1-b02c-d4c105542690
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0f13745-074b-46ba-ae7a-03385ef79d31
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c12c331c-67dd-40be-b2ad-a198c0b92e78
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8a01e1c-dac0-4a47-bda3-3b5684bd3d47
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1518
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d07460c8-0d13-4c25-81f7-56e5198f07c5
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3542e4e-6c4d-468a-b11e-462e35dc33f6
US-CERT HOTCROISSANT February 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee1b1aee-a635-4008-813d-fab125f0b0a5
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0f49935-c4e4-4322-8748-2129915950c7
US-CERT HOTCROISSANT February 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa7381ff-f2b8-4878-a9a0-10a703c7a5dd
Carbon Black HotCroissant April 2020ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbc96b86-2c57-40b6-89f7-d7a755275a45
Carbon Black HotCroissant April 2020