System Network Connections Discovery
Technique · ATTACK:enterprise:T1049
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1049",
"title": "System Network Connections Discovery",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1049",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--7e150503-88e7-4861-866b-ff1ac82c4475",
"external_id": "T1049",
"domain": "enterprise",
"created": "2017-05-31T21:30:45.139Z",
"modified": "2026-05-12T15:12:00.652Z",
"version": "2.5",
"aliases": [
],
"tactics": [
"discovery"
],
"source_references": [
{
"source_name": "Amazon AWS VPC Guide",
"url": "https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html"
},
{
"source_name": "Microsoft Azure Virtual Network Overview",
"url": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview"
},
{
"source_name": "Google VPC Overview",
"url": "https://cloud.google.com/vpc/docs/vpc"
},
{
"source_name": "US-CERT-TA18-106A",
"url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
},
{
"source_name": "Sygnia ESXi Ransomware 2025",
"url": "https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/"
}
]
}Explicit source assertions (99)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d1fe44d-a476-4553-b163-1e03890ae7b4
Unit 42 Lucifer June 2020ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f6041e9-c2cb-4a22-951d-13587fe4a547
Secureworks Karagany July 2019ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ffa2b36-2a4c-4f40-af47-c56b357f92c8
McAfee Babuk February 2021ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11ab80ae-29e7-45a4-8d92-53493e2971c3
FireEye APT38 Oct 2018ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12ea66f1-566a-404f-a948-f76b9047710e
PWC Cloud Hopper April 2017ATTACK:enterprise:S0445 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16bea458-8018-4e53-a377-5970747521ab
FOX-IT May 2016 MofangATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1df5eebc-94f5-44ae-8feb-8d3a89fbfc4e
ESET Zebrocy May 2019ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--209075a3-e836-4894-b931-663bb785e96b
GitHub PoshC2ATTACK:enterprise:G0033 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21ff06b5-022f-40bf-821b-3e08dc9f08a3
Kaspersky Poseidon GroupATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24bce281-7858-4a42-bfd6-601800fb63f7
Kaspersky ProjectSauron Technical AnalysisATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26aac288-6032-4925-afbe-506c8ea06300
FoxIT Wocao December 2019ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27a36f9c-2292-4bf0-8c08-9ccfc1effffe
Talos GravityRATATTACK:enterprise:S0104 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28189361-4cd2-4925-a095-d7ebd07ebd57
TechNet NetstatATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28fd47e4-d76e-4cd2-8ad2-745d1d0a5c72
Malwarebytes Konni Aug 2021ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a562acd-e85c-42ce-89fc-b10174863980
ATT TeamTNT Chimaera September 2020 · Trend Micro TeamTNTATTACK:enterprise:G0138 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2bb829ce-e597-4033-af7c-ef44aaebadb4
Kaspersky Andariel Ransomware June 2021ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2cc2c5ca-7c7a-4ab7-9cb3-76bdd14324b8
Avira Mustang Panda January 2020ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d39b438-6af9-4b7e-a086-277241642c9e
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e661579-5e24-486f-9c8e-624fb18b0b85
CME Github September 2018ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f3d9b76-bec9-4cee-9a9b-1c42f373ec86
McAfee Maze March 2020ATTACK:enterprise:S0241 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3018ef54-d98c-4958-bc31-dc6b45b67a05
RATANKBAATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3325e625-d76b-42df-b952-749dabb57517
Kaspersky Turla · ESET ComRAT May 2020 · ESET Turla PowerShell May 2019ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--344f58f9-fefa-4c50-888c-25b2ef9e7dd2
GovCERT Carbon May 2016ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c191f01-edea-4b76-b0c8-5d809452dea2
CERT PolskaATTACK:enterprise:S0678 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--438c4a38-3043-4697-8490-d63fcbc63cd8
McAfee Lazarus Nov 2020ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bf260f4-0a10-49d9-b930-e1293f40e693
Talos Cobalt Strike September 2020ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c94f67d-6662-44ea-be75-ded8b2dbfa00
Savill 1999ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d82bac6-ec9d-4f4b-a471-169728a830a4
FireEye Clandestine Fox · Symantec Buckeye · evolution of pirpiATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b2c87e3-8eac-48b3-832b-2290b367403d
F-Secure BlackEnergy 2014 · Securelist BlackEnergy Nov 2014ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61151171-f03e-45f3-af06-8e6d5019dca0
Cisco LotusBlossom 2025ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61929ceb-3933-46f1-a11b-4d67482b1d59
Securelist DtrackATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--643a223a-76fa-4a34-9197-3acbc5aff205
Secureworks BRONZE SILHOUETTE May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65a16e8c-47a1-4327-8eed-5cc82339807f
Dragos Crashoverride 2018 · US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ce9578b-a538-4ac1-8739-dfbd835f7599
Sygnia VelvetAnt 2024AATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6cfd90ab-8e17-4b78-9bfb-7792b8f51143
Kaspersky Turla · Kaspersky Turla Aug 2014ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--705fdfa4-6b23-480c-b31a-eadb41533439
Palo Alto ComnieATTACK:enterprise:S1091 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72db9534-3ac3-46df-b8ca-220727d9deb9
GitHub PacuATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--739291c0-44da-4d50-abcf-8b365c284289
Sysdig TeamPCP MAR 2026ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--783b7e83-90ee-4628-80a5-c087258290ab
NHS Digital Egregor Nov 2020ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--786ef353-11be-4c1b-8951-0b3fff69669c
ESET Turla Lunar toolset May 2024ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79c992f3-9df2-4ea0-a63f-690409f5faca
SentinelLabs Metador Sept 2022ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c859c07-f840-42da-958f-4c6af48a2498
McAfee Cuba April 2021ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e62327c-aa58-4ce9-8519-c4bedbd57b80
FireEye NETWIRE March 2019ATTACK:enterprise:S0165 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8336111f-565e-4294-8b18-182c26da2421
Symantec BuckeyeATTACK:enterprise:S0018 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83ad6071-8874-49c9-98cd-0d493a8eeb07
AlienVault Sykipot 2011ATTACK:enterprise:S1032 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--84ea2b0d-ca0f-425d-86c8-7df1ca514841
Checkpoint MosesStaff Nov 2021ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--886942af-c1e9-49e9-af7e-98d1899f3000
Mandiant APT1ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88d6a08e-2e96-41de-868f-b41c07d11541
Trend Micro Waterbear December 2019ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b020cdd-4731-4dd5-8407-7f3076ab1d2d
CIRCL PlugX March 2013ATTACK:enterprise:S1144 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b52e132-0b6b-4cd4-a3d2-a7d04a01dfcb
FRP GitHubATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8edb0383-cae8-43ee-9241-b25e5068cc95
Palo Alto OilRig May 2016ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9246e480-a0ee-4e5d-9d4b-a0f7adb34d85
Kaspersky ToddyCat Check Logs October 2023ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--938a71e3-a9dc-4ad9-b1c4-b15d75967b8d
Symantec W32.DuquATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95df0f16-1c35-4603-baae-4559113f9a0b
DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:S0102 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--980e4dca-4d6b-4206-9c51-bff32c72a961
ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98c1c7ad-db36-459a-ae63-1b92dcb209a5
NCC Group Chimera January 2021ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--99cfee83-7db8-44c1-8fd8-75bc1c67d17c
Trend Micro Muddy Water March 2021ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d201245-16f4-4142-94ff-25136107d0f6
CISA MAR SLOTHFULMEDIA October 2020ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9fef204f-163a-4c9d-b9b1-8a168074063a
FireEye admin@338ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a29a37fc-86e2-4b93-8fa5-560b0a395fbc
Cybereason Soft Cell June 2019ATTACK:enterprise:S0063 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5efdeb3-10db-4e40-b8cd-61dee7d72cc0
Palo Alto CVE-2015-3113 July 2015ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a70bd01d-1d79-44e7-afe4-3a83e5a8d70c
FireEye APT41 Aug 2019 · Group IB APT 41 June 2021ATTACK:enterprise:S0575 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a92a6707-1c22-42b2-9968-2aead300d2da
CarbonBlack Conti July 2020ATTACK:enterprise:S0443 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b565458d-7831-4010-9596-4d6fe44fd738
FireEye MESSAGETAP October 2019ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb7ce54a-20a5-434e-99f1-ad37cbac0777
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c195f2cb-deff-400e-b89e-8625deaa9817
Symantec Orangeworm April 2018ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c45974f5-90b7-4b5b-8123-9961df8ea26d
Github PowerShell EmpireATTACK:enterprise:C0007 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c56990a5-9ef4-47a8-9c2b-4e313b9f363c
Bitdefender FunnyDream Campaign November 2020ATTACK:enterprise:S1075 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c73f6319-ad09-4fb5-bb2f-18fd73bfdc5d
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8470c56-2c81-4826-804c-44e53d87333f
Kaspersky Lyceum October 2021ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca5d71c9-2184-4cb2-9a63-2146fba66175
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:S0374 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--caa06b6c-b59e-4986-87f5-fdab9d9d3534
CheckPoint SpeakUp Feb 2019ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ccd387c3-f818-468e-ac13-24b6aab2a061
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cdcf94e0-b105-49c0-8f62-64f7350a5658
ESET BackdoorDiplomacy Jun 2021ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce48fd88-9fed-44d6-864f-07d8994c89d2
ESET Okrum July 2019ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db852d3d-7f78-43b9-bd14-3f2d11c22863
Cybereason Cobalt Kitty 2017ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--def0dc1a-1c41-44f0-a076-36fb1b98390c
TrendMicro EarthLusca 2022ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df7e5314-665b-44a3-8040-f6cb8fd28cbf
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e002fb3d-e0f7-4f37-90ff-e388e4aaeb80
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0cf8a56-e8e1-43b0-9efc-f167d1cf21de
FireEye APT34 Dec 2017