aol.pm

Protocol or Service Impersonation

Subtechnique · ATTACK:enterprise:T1001.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1001.003",
  "title": "Protocol or Service Impersonation",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1001/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c325b232-d5bc-4dde-a3ec-71f3db9e8adc",
  "external_id": "T1001.003",
  "domain": "enterprise",
  "created": "2020-03-15T00:40:27.503Z",
  "modified": "2026-09-03T19:46:40.086Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "Malleable-C2-U42",
      "url": "https://unit42.paloaltonetworks.com/cobalt-strike-malleable-c2-profile/"
    },
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    },
    {
      "source_name": "ESET Okrum July 2019",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"
    }
  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b255cef-7177-48b8-ade1-752314f90b7e

Novetta Blockbuster Destructive Malware · Novetta Blockbuster · McAfee-GhostSecret-fixurl · McAfee Lazarus Resurfaces Feb 2018

ATTACK:enterprise:S1120 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ad251b3-f49e-438d-98e0-3e310d683a8d

Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--354a4208-0d17-47ab-bf0d-8611c5ad23e5

Zscaler

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bd961d2-39f1-4ed0-a42e-1a9e00ecc2de

Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Palo Alto Networks, Unit 42

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5025e4e1-4862-430c-a5fd-8ca7fece809b

Zscaler

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5179f874-72fb-4743-bd51-3f3fdb660038

Cobalt Strike Manual 4.3 November 2020 · Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:S0245 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5292f0c1-e65e-4233-aa97-ab75354d74a9

Malware Analysis Report 10135536-G

ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63920a70-160d-46b3-a55f-05e8d7d30ba1

PWC KeyBoys Feb 2017

ATTACK:enterprise:T1001.003 → subtechnique-of → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--723b4534-34cc-4b65-9547-f461cb744586

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74fe4149-c5df-43a3-809a-5ece230b1cd7

Zscaler Higaisa 2020

ATTACK:enterprise:S0586 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8da08b47-36bd-4d74-91df-6fdae6d1bfff

CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--945a3286-2197-4984-8838-837afcd7925c

MAR10135536-B

ATTACK:enterprise:S9061 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--954aba1c-7a3a-4302-8d46-ddca791eca59

Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024

ATTACK:enterprise:S0246 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e193b3a-3f21-43aa-b373-6fcec59ff2c7

MAR10135536-F

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4ceb321-f21d-4c62-9b49-cb0c64f0008e

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac71c15a-3c61-4e73-9663-fb35dc0a1a66

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b315cea7-6ca6-4d59-83e5-c91f635bbeb4

Mandiant APT41

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0011483-66e7-4f74-a397-d391efc421dc

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c516fa38-8bf4-4e8a-af64-09f6973825e6

Kaspersky ToddyCat June 2022

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c64b3644-a838-4ed3-a6f3-fc770637b009

ATTACK:enterprise:S0076 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8c5b193-b49d-4c0e-a9da-072302ff47a0

Scarlet Mimic Jan 2016

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e83c4950-2aef-4dfe-81bf-ccafc59ada7a

Palo Alto Networks, Unit 42

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f68ff2ea-8e0c-4972-a39b-eac286ed9690

2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Zscaler

ATTACK:enterprise:S0181 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f77c9b92-0800-4631-b669-524c8ab23772

US-CERT FALLCHILL Nov 2017

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1001.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcd3bc09-f88b-43d7-989d-10f7058e655e

ESET Okrum July 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.