Skip to content

DEADEYE

Software · ATTACK:enterprise:S1052

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1052",
  "title": "DEADEYE",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1052",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--c46eb8e6-bf29-4696-8008-3ddb0b4ca470",
  "external_id": "S1052",
  "domain": "enterprise",
  "created": "2022-12-20T21:08:56.465Z",
  "modified": "2024-04-11T02:38:56.409Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "DEADEYE.EMBED"
    },
    {
      "source_name": "DEADEYE.APPEND"
    },
    {
      "source_name": "Mandiant APT41",
      "url": "https://www.mandiant.com/resources/apt41-us-state-governments"
    }
  ]
}

Explicit source assertions (13)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0051db4d-9eb9-4b22-93a5-b6593176da75

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03cb8f9a-7ad7-4aa8-966f-bf768023eb89

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1218.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--202e085f-f9aa-48a3-a49a-d033054c8c51

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2eb32b46-9833-4391-b282-c7ee10bbfc62

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2eec8dea-fea0-4958-b851-3e549578348f

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64b7eeef-4ccb-4b92-8224-63f1d61265a5

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:S1052

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68da81e3-44b7-4d06-ab56-b0095e02eba0

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fd94786-4ffe-4053-851b-ee62fa558652

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b826389-8c99-4b4c-9da6-de41e4f29fc4

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4cc226c-2858-4040-a90d-5cf1297fd78c

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b13bb5d3-b725-43f9-89d6-6baaa9481d11

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba116238-1da4-415f-94a8-d4c577a16561

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1564.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc829687-1a36-46f3-9196-79e62f84d005

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.