Squirrelwaffle
Software · ATTACK:enterprise:S1030
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1030",
"title": "Squirrelwaffle",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1030",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--3c18ad16-9eaf-4649-984e-68551bff0d47",
"external_id": "S1030",
"domain": "enterprise",
"created": "2022-08-09T16:45:36.234Z",
"modified": "2024-04-11T00:02:15.805Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "ZScaler Squirrelwaffle Sep 2021",
"url": "https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"
},
{
"source_name": "Netskope Squirrelwaffle Oct 2021",
"url": "https://www.netskope.com/blog/squirrelwaffle-new-malware-loader-delivering-cobalt-strike-and-qakbot"
}
]
}Explicit source assertions (21)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--044576aa-2ec0-4f88-9cb9-ec6817dda514
ZScaler Squirrelwaffle Sep 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0862c2ff-157e-4ccd-973a-2b74cb6c79f1
ZScaler Squirrelwaffle Sep 2021 · Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f688474-53c2-4ad5-8998-bd8c39a79f04
ZScaler Squirrelwaffle Sep 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--246b5a38-8569-4145-af9a-0078f398e1d1
ZScaler Squirrelwaffle Sep 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c5ff227-9d4b-4af0-b534-83b55733f5b5
ZScaler Squirrelwaffle Sep 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3283d0a8-5cd2-4548-a3bd-657d51684cd9
ZScaler Squirrelwaffle Sep 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39e0a84e-24de-4b0f-a0e4-3a821b8f963a
ZScaler Squirrelwaffle Sep 2021 · Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3de1cc89-ee9a-4476-9d93-a034da6a90bf
ZScaler Squirrelwaffle Sep 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66794b81-fc1e-4a28-9a52-7e67d64cbed6
ZScaler Squirrelwaffle Sep 2021 · Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69684ccb-b9c0-4284-b2e5-09f15a691f80
Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--791b12bb-cb49-4fc6-a4a5-ea7773fce408
ZScaler Squirrelwaffle Sep 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--796f38d7-b756-43e5-bb81-86169c533ec1
ZScaler Squirrelwaffle Sep 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0ee5fb3-ea57-4b00-8d3e-ff911db8f0e7
ZScaler Squirrelwaffle Sep 2021 · Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bda0ff4f-ed93-4d84-bfa4-dd39abe9fd62
ZScaler Squirrelwaffle Sep 2021 · Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2266528-a862-4fc0-bfa1-4fb1d48daa56
ZScaler Squirrelwaffle Sep 2021 · Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1560.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca140f83-3fc6-44e8-b588-806fb60e7e7e
ZScaler Squirrelwaffle Sep 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3831a8a-1713-49d3-a464-14437d213c3e
ZScaler Squirrelwaffle Sep 2021 · Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3f48900-e929-4040-8e7b-13d06933ce1d
Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1497
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9be6f26-bcc8-49b2-b1aa-e8ce664a1fcb
ZScaler Squirrelwaffle Sep 2021 · Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f176cbd3-81e9-4e7e-b5e2-d6a44c7bf789
ZScaler Squirrelwaffle Sep 2021 · Netskope Squirrelwaffle Oct 2021ATTACK:enterprise:S1030 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe83c4f7-7a52-4a4f-8d17-a28e0ca162ed
ZScaler Squirrelwaffle Sep 2021