Skip to content

Windows Management Instrumentation

Technique · ATTACK:enterprise:T1047

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1047",
  "title": "Windows Management Instrumentation",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1047",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--01a5a209-b94c-450b-b7f9-946497d91055",
  "external_id": "T1047",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:44.329Z",
  "modified": "2026-05-12T15:12:00.619Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "FireEye WMI 2015",
      "url": "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf"
    },
    {
      "source_name": "Mandiant WMI",
      "url": "https://www.mandiant.com/resources/reports"
    },
    {
      "source_name": "WMI 6",
      "url": "https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"
    },
    {
      "source_name": "WMI 1-3",
      "url": "https://learn.microsoft.com/en-us/windows/win32/wmisdk/wmi-start-page?redirectedfrom=MSDN"
    },
    {
      "source_name": "WMI 7,8",
      "url": "https://techcommunity.microsoft.com/t5/windows-it-pro-blog/wmi-command-line-wmic-utility-deprecation-next-steps/ba-p/4039242"
    }
  ]
}

Explicit source assertions (153)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01000868-19de-44dd-bea5-ad30dae460ad

Bitdefender Sardonic Aug 2021

ATTACK:enterprise:S0688 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0182aa0a-a8b9-4a6e-9932-88f34f8ceee3

Check Point Meteor Aug 2021

ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01eddb48-5116-494c-9d1c-2ace79b28530

Sygnia Emperor Dragonfly October 2022 · Microsoft Ransomware as a Service

ATTACK:enterprise:S0270 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0220b491-9c13-4bc4-a3e2-e3ad0e8c9733

Unit 42 DarkHydrus July 2018 · Unit42 DarkHydrus Jan 2019

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--022896ea-ed59-4782-8d53-d559ffcbd64b

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Intel471 Medusa Ransomware May 2025

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04203d88-5fe1-4e63-be65-51a17705716b

PWC Cloud Hopper Technical Annex April 2017 · Symantec Cicada November 2020 · Github AD-Pentest-Script

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05615e68-064a-467c-99eb-e5d7b510afcc

Splunk LAMEHUG SEP 2025

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--088f896a-59a4-4bce-aacf-3a1f0d6c4237

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a764574-6288-4f66-b4af-b485424b32d2

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a789ae7-0348-4bec-a7bd-7890f0996d66

Cybereason INC Ransomware November 2023 · SOCRadar INC Ransom January 2024 · Huntress INC Ransom Group August 2023

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c0b4142-96e7-440b-a01f-f2bda05649b1

Securelist BlackEnergy Feb 2015

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fc08710-fefb-4109-821e-1130c14914f3

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1157b635-1cd6-4f65-9be6-09a9f7ac1664

jRAT Symantec Aug 2018

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11f31998-c76f-4433-8e9c-c0ef0b7574d5

Carbon Black Emotet Apr 2019

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12e24dfb-3b4c-4244-90c9-2f9675dc6eaa

CERT-EE Gamaredon January 2021 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025 · unit42_gamaredon_dec2022

ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1395dbee-5ed2-45d4-a807-19fb707e9dab

Palo Alto Ashen Lepus DEC 2025

ATTACK:enterprise:S0618 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15e5da78-6475-426e-acd0-09f8a59ca0bb

FireEye FiveHands April 2021 · CISA AR21-126A FIVEHANDS May 2021

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16e1d79d-1eb9-4ce7-a21e-115ce2a414f1

Unit42 Sofacy Dec 2018

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18e8e653-d924-4fed-a33f-7893cf8a683b

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0256 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1937b1c7-004f-4d22-bbf2-ab0de1ba8e1a

ESET Turla Mosquito Jan 2018

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1969fef1-3e75-4228-b034-b6436f207c01

Anomali MUSTANG PANDA October 2019 · Secureworks BRONZE PRESIDENT December 2019

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b6f869f-951c-4323-816f-dbedbe3aac0a

Talos MuddyWater May 2019 · ClearSky MuddyWater Nov 2018 · DHS CISA AA22-055A MuddyWater February 2022 · Securelist MuddyWater Oct 2018

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bce55fa-b34e-4522-9422-85bf3fdda889

Bitdefender Agent Tesla April 2020

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c715763-19ea-475d-9d5c-8d4434b4095f

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c935a6d-dd69-4be3-bfed-56c01d0f9413

Cybereason Bumblebee August 2022 · Proofpoint Bumblebee April 2022 · Google EXOTIC LILY March 2022

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e0c4d65-a4db-42e0-9eb0-93354ad56d06

FireEye WMI 2015

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fa97951-8eba-4771-bc42-8084967f0c65

Red Canary Hospital Thwarted Ryuk October 2020 · DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Grim Spider May 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20cb38ca-5e2d-40eb-b104-c1e95ff2ec54

Check Point VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23d208f5-cadc-4f80-94c4-5644eaa8b7c7

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:S1028 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2440db47-5c7d-4f60-89e8-d5a6f19f0d0d

MalwareBytes SideCopy Dec 2021

ATTACK:enterprise:S1155 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25168e37-9e0c-46ba-9f70-9b5011a96482

Github Covenant

ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--265686ee-6e90-439f-9966-e40b8472bd06

Cyphort EvilBunny Dec 2014

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2869490f-0728-4a73-a9c2-3a5de5f9f5e7

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29552a61-61fe-4265-9468-e53318bd388c

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d2ebfcb-0b2c-4c69-877e-2ca633c95a17

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--341a8145-4d62-4126-a18d-10976d08d920

Sygnia VelvetAnt 2024A

ATTACK:enterprise:S1152 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--344e4ab0-d480-4d70-b64d-539cf5f26c96

PWC Yellow Liderc 2023

ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34529aa9-4431-4b7f-af18-e53c5b8b71aa

Zscaler BlindEagle DEC 2025

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35419603-7bc2-40f6-8e5d-4e7a8f13ebb7

FireEye APT34 Dec 2017

ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36986111-c0c0-40d0-8d88-3b59e655c2d1

SocGholish-update

ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38f54e6f-502c-4af5-9867-fa9fb8381662

Proofpoint TA505 Mar 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a30af61-b9b4-488e-aebc-dee4dfce52b6

eSentire FIN7 July 2021

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3dd85bcc-faab-43a0-99d4-9b269e69f2e7

Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f6981d7-5647-41ca-99af-180f8ece72f1

Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--402e9430-9d3a-4694-89ca-923dab3fba26

Cybereason Soft Cell June 2019

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40b2270c-1549-44dc-87b2-d263941eb951

CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:S0654 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--411ea36c-e237-4503-82f2-6e9d87a01380

Group IB Ransomware September 2020

ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42cc506f-e9c2-43f1-a68f-3c6973cca2dc

FireEye MuddyWater Mar 2018 · ClearSky MuddyWater Nov 2018

ATTACK:enterprise:S1129 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44271618-cc52-45a9-9799-e9665b73cfc2

Kersten Akira 2023

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45bc3eef-6651-4a46-833e-7a2e91fe3ba1

ATTACKIQ MUSTANG PANDA TONESHELL March 2023

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48e6b5fc-9d82-4cdf-84aa-bc23647e1234

ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51548d6c-0aa9-4813-8493-3d9bbcd0617a

RedCanary Mockingbird May 2020

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--533a2f2c-6cc9-48fa-b029-17cc827e12d7

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0264 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5422e9a8-4fbe-40c0-8348-53faa9a7d2d3

Unit 42 OilRig Sept 2018

ATTACK:enterprise:S1193 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55427322-8d66-40f7-92ce-ea489f58870c

Mandiant APT42-untangling

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55670baa-97b1-44fe-abb8-0162b5a9663b

ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--597ca258-3af4-4e51-abf9-b192e98939fd

Bitdefender Naikon April 2021

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d5077b6-4490-4762-8b8f-ba4e0655ec67

Palo Alto Brute Ratel July 2022

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ddcecdb-9e54-4e8e-b67b-64d24ec3264a

ATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e0bb60b-21e7-4913-862b-61f8831c1732

Secureworks GOLD IONIC April 2024 · Huntress INC Ransom Group August 2023

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ea2e743-24d9-4e93-bc71-e504ee876395

Rapid7 BlackBasta 2024

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64a17aba-5182-4666-bd37-dafa9d835fe8

Novetta Blockbuster RATs · Novetta Blockbuster · Qualys LolZarus · Kaspersky ThreatNeedle Feb 2021

ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--667aa499-504c-4fb1-9b56-0bb680d773d1

Kaspersky ShrinkLocker 2024

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6988baa7-1b48-4203-8020-7bb3fb38098d

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a58662b-4eb1-4172-b387-13e9b574368a

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ad5d5c8-b53e-417c-a574-3818269d1e85

FireEye WannaCry 2017 · SecureWorks WannaCry Analysis · LogRhythm WannaCry

ATTACK:enterprise:S0605 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ade9df2-d75a-40a6-91aa-f3150e07ac6a

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e05703b-26a3-4429-8d91-3c32053ca662

Cisco LotusBlossom 2025

ATTACK:enterprise:S0241 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ed1086d-3197-403e-86e4-16e4dee07faa

Lazarus RATANKBA · RATANKBA

ATTACK:enterprise:S0553 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7196c18e-b80f-41ec-ae37-a88e99435f56

Cybereason Molerats Dec 2020

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--737af098-bd8c-4449-b93d-adaaaa55abea

Microsoft BlackCat Jun 2022

ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76eae7b3-2e02-41c6-8b31-b81c8d124006

Talos Nyetya June 2017 · US-CERT NotPetya 2017

ATTACK:enterprise:S0151 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77ea5d03-715b-4247-8484-6c1cf2bc7984

FireEye FIN7 April 2017

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7dcf8536-cf47-4979-a3a2-cda656431edc

Dragos Crashoverride 2018 · Microsoft Prestige ransomware October 2022

ATTACK:enterprise:S0380 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80c90e89-2519-40cb-8757-06471e47d0fb

Kaspersky StoneDrill 2017

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--812699e3-ffb0-4aec-b7d9-96680311d5a4

Microsoft SharePoint Exploit JUL 2025

ATTACK:enterprise:S0375 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84221e86-8ed7-42d4-878f-951cc6eaf65c

Securelist Remexi Jan 2019

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85216e27-5d58-4d89-8b04-3ef50ed14f95

TrendMicro EarthLusca 2022

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8561e826-0aa8-4711-ab0b-fffb0b03ff13

Github PowerShell Empire

ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85ee8dfa-7f36-406a-a87c-97633530bdda

CME Github September 2018

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.