Skip to content

Network Service Discovery

Technique · ATTACK:enterprise:T1046

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1046",
  "title": "Network Service Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1046",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--e3a12395-188d-4051-9a16-ea8e14d07b88",
  "external_id": "T1046",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:43.915Z",
  "modified": "2026-05-12T15:12:00.723Z",
  "version": "3.2",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "apple doco bonjour description",
      "url": "https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/NetServices/Introduction.html"
    },
    {
      "source_name": "CISA AR21-126A FIVEHANDS May 2021",
      "url": "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"
    },
    {
      "source_name": "macOS APT Activity Bradley",
      "url": "https://themittenmac.com/what-does-apt-activity-look-like-on-macos/"
    }
  ]
}

Explicit source assertions (80)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01a1c2f4-ccb3-4238-9c9c-d6ca3a098ed9

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02279a7e-d5b8-44a7-99a3-64913b4ffa7b

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02caaeff-7429-444f-bac2-498fe3a73cfd

FireEye APT39 Jan 2019 · BitDefender Chafer May 2020

ATTACK:enterprise:C0004 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--069bd80b-9f39-46c6-a9dc-b61e42a2f91e

BlackBerry CostaRicto November 2020

ATTACK:enterprise:G0098 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bc4d3d8-8018-4e0a-a365-ebef543e1222

Symantec Palmerworm Sep 2020

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d79b40d-3ff5-42d6-a135-6e6555890a23

Microsoft BlackByte 2023

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d889b2d-eda4-45dc-99bf-c530b7d4b05f

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0093 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--129d828d-a84b-43dc-afc1-f46d8a25de0a

Gigamon Berserk Bear October 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13d8aec7-3e49-41f8-b57c-475cdc0d9632

Dell TG-3390 · Unit42 Emissary Panda May 2019

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14f063a6-0819-4549-b9e0-44ee9e0f2fc8

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:S9045 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1508970d-75b0-4a48-aba1-258439f4f349

AI-Mexico-Govt-Breach

ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d1cc2e5-ef43-4b36-9077-3b173e03d254

ESET Industroyer

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2589342a-8f88-4458-bc34-cec6b073763e

Github PowerShell Empire

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2773ed2b-4ec2-4528-8a3c-ca878fbbfa21

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2996198c-97d1-48df-9463-6d1c0140f050

Unit42 Agrius 2023

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a37062f-9174-47b3-8c1f-2e32db19db1e

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c9fad15-9b3f-45fe-854a-c87113d4695c

Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32d0c1aa-b936-40d4-932e-7d4f42736382

CISA Iran Albanian Attacks September 2022 · Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32d482c4-2c0d-4688-a38b-d73b5b2962a3

ATTACK:enterprise:G0105 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3778dc3a-14b2-43e9-8e37-d1c3c731b390

Securelist DarkVishnya Dec 2018

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--393a3ec4-9970-44ab-ae63-1e9c6bed0310

FireEye APT34 Webinar Dec 2017

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3faf013a-e1c4-494a-b2a1-6e9abef908b9

Kaspersky ThreatNeedle Feb 2021

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4258ffdf-ecdb-465d-af16-bda97062ab7f

Symantec Leafminer July 2018

ATTACK:enterprise:S1073 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--455ad18f-00a1-4ac4-a77b-abb26a68996e

Cybereason Royal December 2022

ATTACK:enterprise:S0374 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--467f79d6-edf7-4e6a-a0d7-8196cd406ce1

CheckPoint SpeakUp Feb 2019

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47e4d006-2685-4628-a46b-f6d9066f3585

Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c1c2160-0b1d-4bb9-be29-e0c6e0570a2d

Unit 42 Hildegard Malware

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5929ef3e-3945-4ede-b3cd-94f47850a6bd

TrendMicro TropicTrooper 2015 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--592a2355-077e-4692-a28a-da998ed5f937

Bitdefender Naikon April 2021

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d55b1c4-cdf4-4314-881e-ba0c853b1b60

DFIR Phosphorus November 2021

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d8e9a49-f534-4cb6-9e3e-aebacb3c1dd0

Talos Rocke August 2018 · Anomali Rocke March 2019

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5dd2c2dd-dcc3-44f5-9c9a-3055cda6c5fa

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:S0590 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61de6721-267c-4224-8000-b3329f3057cf

Debian nbtscan Nov 2019 · SecTools nbtscan June 2003

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63994c7c-6544-4e29-9c94-ac2237166774

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--651225d6-5454-4c44-8d62-776bd7ddaed2

ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6633ef0a-40ae-46f4-aff9-762fb4c0ab29

SentinelOne INC Ransomware · SOCRadar INC Ransom January 2024

ATTACK:enterprise:S0683 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--679707b5-84d8-473d-9d28-e92a7d16763a

Peirates GitHub

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6eaf57d7-1e0c-437a-b5e6-4b4dc6f00ae1

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--704355c5-4743-4fe1-bd64-b7012fe7c1d2

Talos ZxShell Oct 2014 · FireEye APT41 Aug 2019

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72f5ca9f-6b0e-4051-b2ae-da1b59e6ed2b

ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73ce71e3-938e-4f5e-b588-32426e874577

FireEye Periscope March 2018

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73d4dcf0-5c97-4b60-af21-b68182237e15

Cisco Talos Avos Jun 2022

ATTACK:enterprise:S1144 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8035ec83-a439-442f-81d9-9306d2235d91

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80f94d40-0861-4403-b206-1c864a136788

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82c8372e-9b69-4720-a351-d6f0bda110d5

NCC Group Chimera January 2021

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87ebb077-671c-42b2-ad27-07f54b5920be

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--883558d8-c445-45cf-a5cd-841fdf49f311

FireEye APT41 Aug 2019

ATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e330fc5-d4d9-4c6c-a73d-b8665d5fa547

Trustwave BlackByte 2021

ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9409dcff-0ddf-43f6-b7c0-937fd9216ee0

Unit42 Xbash Sept 2018

ATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97919ca1-4aec-4fa3-b698-ae4ec7524968

Anthropic AI Orchestrated Campaign NOV 2025

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98e08749-5e7b-40ed-8a66-cd33f9c8c6ba

Talos Cobalt Strike September 2020 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0039 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b360cf4-4600-4ea8-a28c-99d91e0d1734

Symantec Suckfly May 2016

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ee893d7-f87e-4d2e-a440-4ba9cb3a3561

Palo Alto Brute Ratel July 2022

ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0bb2dec-515f-4334-97c1-63fa6c9b4340

ANSSI Sandworm January 2021

ATTACK:enterprise:S0117 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a423dc5c-c506-4cc5-b65c-0c9269d18fb6

Invincea XTunnel

ATTACK:enterprise:S0698 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8aec030-1331-46d8-afa3-d08be70f55c0

ESET Hermetic Wizard March 2022

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1c49faa-0b6f-4a0e-85da-5ab8ddeab2ce

FireEye FIN6 April 2016

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b84414c0-18e9-4483-83db-555bd2880740

Cado Security TeamTNT Worm August 2020 · Unit 42 Hildegard Malware · Cisco Talos Intelligence Group · Palo Alto Black-T October 2020

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c32ad752-3f38-4f34-b00d-c892d8698f0b

Symantec Daggerfly 2023

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4693c3d-7ec1-4e6d-9788-b3aa39d97e10

FoxIT Wocao December 2019

ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c92f6bab-4dfc-443d-903c-35318b80a396

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9c411dd-b313-4448-a2b9-17d00b3c78e2

Huntress LightSpy macOS 2024

ATTACK:enterprise:S0608 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cac01499-50ef-4cbf-a223-6879c139173a

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf0143f0-1021-4825-9ad4-2a8803003ed9

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4afacec-3b00-49b0-9c37-06f8a6c07526

Symantec Bilbug 2022

ATTACK:enterprise:S0061 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db283fff-4b13-4c79-85f0-5cdb6b76e964

Baumgartner Naikon 2015

ATTACK:enterprise:S0233 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db85ce33-98cf-4fec-93bd-402909cbe4bc

FireEye Periscope March 2018

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd0c5079-1bd3-45fa-b8e7-aabf0a5513b7

CISA AA20-259A Iran-Based Actor September 2020 · ClearSky Pay2Kitten December 2020

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddede021-d8bc-4303-9915-5b2dd0ebd4cd

ESET InvisiMole June 2020

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e45bff55-f8b0-406b-ba7d-03af2e7be8c8

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6b68811-113e-4f86-8096-9f506e34dda1

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eacb7614-6cc9-4eb9-92fc-bba53ac4f59a

Unit 42 Lucifer June 2020

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ebf193e2-d75e-4204-80cd-a9791d7d3c18

CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--edcd7a59-f8e0-41e5-b0f5-8d348fa13a10

PTSecurity Cobalt Group Aug 2017 · PTSecurity Cobalt Dec 2016 · Group IB Cobalt Aug 2017

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--edfe3a60-e9e5-4619-a8a2-f44d07e75172

AI-Mexico-Govt-Breach

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee291097-fca7-4a62-bf82-e05e6c6e49e9

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f46bb223-1276-4266-b653-d6b8c2943adf

ClearSky Lebanese Cedar Jan 2021

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa87affe-1703-48c9-adc7-14bf52d0cc14

trendmicro_redcurl

ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fefae8e3-2549-4743-9713-7dfa40c52ae4

CERT-FR PYSA April 2020

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff9369b6-62d2-46fd-acc9-ba20fdae8fac

CISA GRU29155 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.