Pikabot
Software · ATTACK:enterprise:S1145
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1145",
"title": "Pikabot",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1145",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--02739f57-7585-4319-acd3-794ae8ff3a70",
"external_id": "S1145",
"domain": "enterprise",
"created": "2024-07-12T19:07:40.654Z",
"modified": "2024-10-28T19:01:43.612Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Zscaler Pikabot 2023",
"url": "https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot"
},
{
"source_name": "Elastic Pikabot 2024",
"url": "https://www.elastic.co/security-labs/pikabot-i-choose-you"
},
{
"source_name": "Logpoint Pikabot 2024",
"url": "https://www.logpoint.com/wp-content/uploads/2024/02/logpoint-etpr-pikabot.pdf"
}
]
}Explicit source assertions (24)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1037 → uses → ATTACK:enterprise:S1145
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01a4bef1-5445-4e46-90db-fd4335462be1
Latrodectus APR 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05381a55-01d2-4c75-9a2b-504eff1b606a
Zscaler Pikabot 2023ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24b4efab-e553-4faa-a53d-d6306e183d20
Zscaler Pikabot 2023ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ba3fc03-9a46-47b9-aeec-1207702ef4cf
Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1055.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fa37a18-329e-4feb-8d68-d9dde842324a
Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1622
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44a27941-a92a-4dd8-ab62-e30f6d8782e3
Zscaler Pikabot 2023 · Elastic Pikabot 2024 · Logpoint Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--569abeb3-4d27-4157-a50f-0ec8fc4b3f92
Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63113486-c2a1-4a83-8d49-2065f972f83f
Zscaler Pikabot 2023 · Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69cbfe97-c712-4ffe-ac32-b1ce605e516c
Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d719666-23d9-44a7-afb1-2afb5263cf09
Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e9b093c-a8c4-4da8-ac07-3e019ce9e16e
Zscaler Pikabot 2023 · Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--713bde00-ab9d-4eaf-99b2-4d9b2b21df4c
Zscaler Pikabot 2023 · Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8dc92a18-99e3-47ce-8b63-ad6df5851e31
Elastic Pikabot 2024ATTACK:enterprise:C0036 → uses → ATTACK:enterprise:S1145
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--927a4c0e-0065-4266-9359-b48751d70cf2
Elastic Pikabot 2024 · Zscaler Pikabot 2024ATTACK:enterprise:C0037 → uses → ATTACK:enterprise:S1145
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--945e586b-1543-4c24-95ee-e1282ad16823
TrendMicro Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96a0df58-61cc-4380-aaba-e05207c39673
Zscaler Pikabot 2023ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a01a5841-8c3a-4cd4-b747-f4333e083924
Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b44a5877-4cd1-4a5c-b2ea-d1078da36cc2
Zscaler Pikabot 2023 · Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf46855b-a15e-4789-a8e6-d5ad3261ded3
Zscaler Pikabot 2023 · Elastic Pikabot 2024 · Logpoint Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1027.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ccf2762f-9982-43c2-911c-d304797fead0
Zscaler Pikabot 2023 · Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1055.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d21794dc-278a-41c5-9707-17113f261d1d
Zscaler Pikabot 2023ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1480.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dbe1b093-af31-4abd-999e-0e2bf1d0a4d5
Zscaler Pikabot 2023 · Elastic Pikabot 2024ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e039ba9f-a7d1-45a9-8ebc-d75fb31f4baa
Zscaler Pikabot 2023ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed8cf613-63f8-4f50-be4d-f73aba6a3467
Elastic Pikabot 2024