aol.pm

Embedded Payloads

Subtechnique · ATTACK:enterprise:T1027.009

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1027.009",
  "title": "Embedded Payloads",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1027/009",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--0533ab23-3f7d-463f-9bd8-634d27e4dee1",
  "external_id": "T1027.009",
  "domain": "enterprise",
  "created": "2022-09-30T18:50:14.351Z",
  "modified": "2026-05-12T15:12:00.620Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "GitHub PSImage",
      "url": "https://github.com/peewpw/Invoke-PSImage"
    },
    {
      "source_name": "Malware Analysis Report ComRAT",
      "url": "https://www.cisa.gov/uscert/ncas/analysis-reports/ar20-303a"
    },
    {
      "source_name": "Trend Micro",
      "url": "https://www.trendmicro.com/en_us/research/20/e/netwalker-fileless-ransomware-injected-via-reflective-loading.html"
    },
    {
      "source_name": "Securelist Dtrack2",
      "url": "https://securelist.com/my-name-is-dtrack/93338/"
    },
    {
      "source_name": "Microsoft Learn",
      "url": "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/c41e062d-f764-4f13-bd4f-ea812ab9a4d1"
    },
    {
      "source_name": "SentinelLabs reversing run-only applescripts 2021",
      "url": "https://www.sentinelone.com/labs/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/"
    },
    {
      "source_name": "Sentinel Labs",
      "url": "https://www.sentinelone.com/labs/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/"
    }
  ]
}

Explicit source assertions (27)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1137 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0157b7a8-69d3-4c60-adf5-91522af1741f

CheckPoint Agrius 2023

ATTACK:enterprise:T1027.009 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ec0af54-0182-4ad4-9b0e-4542a822de7f

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ee0c642-94af-491c-bc65-821e13586bca

ATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2eec8dea-fea0-4958-b851-3e549578348f

Mandiant APT41

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--324d5c17-a282-4a61-8fad-50ab914f425c

Microsoft DiamondSleet 2023

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36929435-86c4-41f9-8922-ad5e1fc512b1

Gigamon BADHATCH Jul 2019

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a1ee04f-672a-4fc6-80fe-40feb5472625

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1134 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3dc04b05-16d3-445a-98b6-e3f3f4a352ef

SentinelOne Agrius 2021

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58e22fa6-5925-40b7-9df6-4cda34892ea6

Binary Defense Emotes Wi-Fi Spreader · emotet_hc3_nov2023

ATTACK:enterprise:S1048 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f79680a-7b9f-47fd-bb81-025eb6368139

SentinelLabs reversing run-only applescripts 2021

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66f7fca6-b5cc-46e4-86a1-204f4b1038fa

Securelist Dtrack

ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82b48b26-b4af-4ce5-9720-6ce05b7441a5

Trendmicro_IcedID

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87282f36-42f5-4eb1-9fec-778bc0f846b7

TrendMicro Netwalker May 2020

ATTACK:enterprise:S1135 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d047c5c-f46d-44e2-bb46-0dc0bc13e79b

Unit42 Agrius 2023

ATTACK:enterprise:S0649 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4730261-b1b2-45ba-8874-b2edcdd13a75

FireEye SMOKEDHAM June 2021

ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ccf2762f-9982-43c2-911c-d304797fead0

Zscaler Pikabot 2023 · Elastic Pikabot 2024

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce044795-c25e-44ba-8b23-d6a2173e9000

win10_asr

ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce1ef7d9-497c-4aeb-8e6d-a828499ed940

Aikido TeamPCP Trivy MAR 2026

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d140e9e2-debf-4650-8495-26d76c3d9bd0

Unit42 3cx supply chain 2023

ATTACK:enterprise:G1037 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d15b4ebf-5129-4a34-b97a-ded582ff4b15

Latrodectus APR 2024

ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d27ca417-0ced-4e42-b81c-fe93cfe7e1c7

CISA ComRAT Oct 2020 · ESET ComRAT May 2020

ATTACK:enterprise:S1158 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8ad5375-e46e-407f-9de2-e4d241383497

Google Cloud APT41 2024 · Google Cloud APT41 2022

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0d78b1f-4c62-4537-af82-da7575f1fe9e

Google Cloud APT41 2024

ATTACK:enterprise:S0231 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3b299d0-fbc0-445f-a0d0-b3fdaa572917

GitHub PSImage

ATTACK:enterprise:C0021 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5e601f7-5f7a-4888-9e90-e7f815d5013c

Microsoft Unidentified Dec 2018

ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fbf73b94-a193-4b6c-9e04-7f0a279d9ce9

Microsoft Moonstone Sleet 2024

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd0c41df-35a7-4593-996c-0f9bdd6f4749

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.