SUNSPOT
Software · ATTACK:enterprise:S0562
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0562",
"title": "SUNSPOT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0562",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--bf48e7f8-752c-4ce8-bf8f-748edacd8fa6",
"external_id": "S0562",
"domain": "enterprise",
"created": "2021-01-12T16:14:28.845Z",
"modified": "2025-04-16T20:38:33.634Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "SUNSPOT"
},
{
"source_name": "CrowdStrike SUNSPOT Implant January 2021",
"url": "https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09f6307c-819e-4e35-bfc7-5314b0c3ce85
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1134
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--339e74c4-5e3a-4272-966f-f5542d255d0a
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39f5d465-832e-4de8-9738-0879803e2b1c
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41118997-c45e-4123-be61-1b0c5d456256
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1565.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41d6749b-9bd1-47f6-80c4-52652b965e78
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d8b4863-f8db-4776-a70f-ea16255d45bd
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70d81631-4f33-4fd0-98ac-15b57b8c1ed1
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1195.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--84c6ce73-83b4-43f1-aeae-4b7e2f8b4d34
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b59a1db-0b3d-4ce7-9cea-d91a71dd0a57
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9cb9a1a6-8fdf-4201-af7d-156a92d0f358
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0562
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afd398cc-b093-429c-88f5-e7f661567fd1
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8333924-1556-4c3f-b60f-105984e1f715
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be94a9ae-e54a-427e-8caa-36cea954abcb
CrowdStrike SUNSPOT Implant January 2021ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0562
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf2da3ab-4210-4a4b-932c-15dcc8b9c73f
CrowdStrike SUNSPOT Implant January 2021 · MSTIC Nobelium Toolset May 2021