GrimAgent
Software · ATTACK:enterprise:S0632
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0632",
"title": "GrimAgent",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0632",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--c9b99d03-ff11-4a48-95f0-82660d582c25",
"external_id": "S0632",
"domain": "enterprise",
"created": "2021-07-16T18:19:25.986Z",
"modified": "2024-09-19T14:32:39.426Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Group IB GrimAgent July 2021",
"url": "https://www.group-ib.com/blog/grimagent/"
}
]
}Explicit source assertions (27)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--251b010d-270f-44a3-8546-ce7cde631ab7
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--251c7f06-a012-4fe1-9520-21f051a47255
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--256edc9a-e5fa-48fc-b398-eb0873d46e78
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--267fb6e6-0776-4de0-baac-985beb079ad2
Group IB GrimAgent July 2021ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:S0632
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f5dca6f-7a62-4933-a003-16dbb6d234cb
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38f5765d-0e42-4e63-9411-185983c6ca21
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f1ab899-077c-4f89-81ed-98683ac8753e
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44ddb228-ec4e-495e-b930-04a49fe58a7d
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--494255a0-7672-4302-9e1b-bf3767cb8384
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bdb2764-695c-42d8-afac-f5618660cae7
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50f0d6ac-0cfa-41d6-9795-e6843101c524
Group IB GrimAgent July 2021ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0632
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d7d90a4-1ea6-4eca-94bd-3461d9a54229
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--639a960d-8cc1-4f6f-aca1-cf3c6445d056
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6abe4e38-5d96-469e-b648-dca7a520cc2e
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1480.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f145407-cd6b-4e96-957f-a74cd6c84c52
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac01b568-6d51-415f-8dd4-0d148fa204fb
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac04e244-5ab3-4ac7-8f5d-575ec8ff67f0
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac7a8c0c-bdbc-4ed5-91f9-b00212fe7189
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1070.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba583cf4-b162-4fbd-bf94-ad9f8cc5f642
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9256d21-a464-477a-8756-96eae300b0e4
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1001.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d5bd4aaf-4a58-45dd-a9e7-3ceb6385a998
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e04dd3e5-9883-4f0a-bf05-b20af89c88f3
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ecd6c482-51ae-402c-8482-4feb9cda9b05
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed218127-ef3a-4038-b864-3f0ceb6b4bd1
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eed367b8-b1d1-492e-a376-6725b6db7103
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f187aa90-df6c-485c-bc01-dec83aca9625
Group IB GrimAgent July 2021ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1027.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f2456bbf-ac8a-43c7-b51a-b52e3376726f
Group IB GrimAgent July 2021