Skip to content

Dynamic-link Library Injection

Subtechnique · ATTACK:enterprise:T1055.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1055.001",
  "title": "Dynamic-link Library Injection",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1055/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f4599aa0-4f85-4a32-80ea-fc39dc965945",
  "external_id": "T1055.001",
  "domain": "enterprise",
  "created": "2020-01-14T01:26:08.145Z",
  "modified": "2026-05-12T15:12:00.724Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "Hiding Malicious Code with Module Stomping",
      "url": "https://blog.f-secure.com/hiding-malicious-code-with-module-stomping/"
    },
    {
      "source_name": "Elastic HuntingNMemory June 2017",
      "url": "https://www.endgame.com/blog/technical-blog/hunting-memory"
    },
    {
      "source_name": "Elastic Process Injection July 2017",
      "url": "https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
    },
    {
      "source_name": "Module Stomping for Shellcode Injection",
      "url": "https://www.ired.team/offensive-security/code-injection-process-injection/modulestomping-dll-hollowing-shellcode-injection"
    }
  ]
}

Explicit source assertions (69)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1027 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--063ed9e5-4acd-47b4-a169-0ca40ef95025

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--092ea2a0-c8f5-409f-b391-119f3446e63c

Malwarebytes Saint Bot April 2021

ATTACK:enterprise:S0082 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--106aae81-fab1-42b3-97b0-4f0c1d67c896

Lotus Blossom Dec 2015

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11247a95-272b-4ae2-8dae-2cd049328734

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15f40e8e-7ddd-47f8-a11d-fbebc2c4d3fa

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a7d1db3-9383-4171-8938-382e9b0375c6

F-Secure BlackEnergy 2014

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a978832-f04d-4853-8094-58fc99e30ed1

ESET Turla Mosquito May 2018 · Github Rapid7 Meterpreter Elevate

ATTACK:enterprise:S0613 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e075dae-a0df-4ab9-a297-fda2248bc254

BlackBerry CostaRicto November 2020

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21674a10-7168-420e-b916-2979a3ee3b5e

ATTACK:enterprise:S0055 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22a75bbf-5490-40cb-bdb7-a0eda5e95d21

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--249897d9-131f-4cf8-93d7-cb20006a511d

Talos Cobalt Strike September 2020 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27ccf817-33de-4d85-85e5-851f82e835e4

Proofpoint TA505 October 2019

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e418dd3-d6dc-4d02-a555-2b3a13936dc3

Medium Metamorfo Apr 2020

ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39647c47-c73d-4da7-9b1a-8c67f20c1890

ESET ComRAT May 2020 · CISA ComRAT Oct 2020

ATTACK:enterprise:S0273 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a0c38e8-c174-4c86-a229-fcb4965ce311

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bcce871-6b9d-4eaf-9364-80dea3cb7ef9

Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--410ec59e-9e11-4acc-98d6-4d7c63f09c8d

BiZone Lizar May 2021

ATTACK:enterprise:G1026 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43f6b172-34cf-4663-836a-df1ad978e7df

SCILabs Malteiro 2021

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44a97cbb-ce03-43ee-959e-c582e64372a2

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44fab50d-4fb6-4a8a-ab7a-84dcb70443f5

McAfee Maze March 2020 · Sophos Maze VM September 2020

ATTACK:enterprise:S0167 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47415cec-25f8-4425-9125-157e1637a687

CopyKittens Nov 2015

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a0cbe7f-e88c-4ef6-8bf7-9f6e17e8de04

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bcd21d2-7583-4b82-8d33-2b153eeb6fdb

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d0ea359-36b3-46f8-818a-5aaff3de574a

Microsoft FinFisher March 2018 · FinFisher Citation

ATTACK:enterprise:S0501 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d5f07bd-985d-4dee-8f1b-9143fb158438

ESET PipeMon May 2020

ATTACK:enterprise:S0024 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--508879cf-53b7-4578-9a5f-9ed20dfb09ef

Symantec Dyre June 2015

ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5451c465-0b5d-451c-bdaa-55165e408b9b

Cisco LotusBlossom 2025

ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5893fbd3-f3c0-4332-b2e3-e6a07142ef9d

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:S0460 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a0db1e3-cd18-4f00-936b-4b8ede1e0498

Proofpoint TA505 October 2019

ATTACK:enterprise:T1055.001 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e6cf759-1690-41b3-9e41-d8317f4ef83d

ATTACK:enterprise:S0011 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e840479-61c1-44f5-8cb8-0e61ffe12b89

TrendMicro Taidoor · CISA MAR-10292089-1.v2 TAIDOOR August 2021

ATTACK:enterprise:S0241 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65eff720-b419-4e73-8f6c-c3dd07b78484

Lazarus RATANKBA · RATANKBA

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e906ef1-2984-4d8e-ba9f-5f40f30f996e

Gigamon BADHATCH Jul 2019

ATTACK:enterprise:S0576 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71c146b5-9afa-41fa-9339-2a6287e7d309

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7307a870-2d74-4e46-9ba0-8fb83d598cfb

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--749496af-4629-431d-829c-4615b9f41fe5

Trend Micro Agenda Ransomware AUG 2022

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74afa3c9-bfa3-48a3-85bf-b28e5ecd00b7

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7995952f-370f-4514-a0c1-ce160b4c90c1

Accenture MUDCARP March 2019

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b2329e5-eacf-4626-bc3c-43331bc09aef

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c3b845e-56ca-4580-b060-a3fa42b86a86

Symantec W32.Duqu

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d020981-51b3-4ff6-825f-7cd192c934e1

FireEye Poison Ivy · Symantec Darkmoon Aug 2005

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fd4fe68-0f2a-485c-9b10-6847428ef5da

Airbus Derusbi 2015

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8475c5c5-484a-47b6-93ba-0cceeefc59f1

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--964d3a29-afcb-4c4a-89a1-c1769d02221f

Havoc Framework Documentation

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a275b407-099a-4f2c-954c-528cf61349f8

Talos ZxShell Oct 2014

ATTACK:enterprise:G0024 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a442fcac-55d7-49ff-8ecf-ca61885c27e2

CrowdStrike Putter Panda

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a737a968-1fec-4e9b-b0dd-d4318f07a691

ESET Gelsemium June 2021

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b808a8ce-9c2c-4563-b63b-4cd23dce04b8

Aryaka Kimsuky July 2025

ATTACK:enterprise:S0135 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b97e696f-6386-4b15-8f24-81d0abe51830

ESET Sednit Part 3

ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9b2ddad-acb6-4e97-966c-ff18fd36cea3

ESET Carbon Mar 2017

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c055d228-a0e6-4b76-961a-1eebe99679f5

McAfee Lazarus Resurfaces Feb 2018 · Lazarus APT January 2022

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c31643e8-86a3-49e4-bd69-572d7e64c7c0

TrendMicro Tropic Trooper Mar 2018 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S0581 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4e3450c-c657-43c3-b825-031b12a33611

Unit 42 IronNetInjector February 2021

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7d6694e-cfbf-4883-9f4c-8fb3f187e6ae

Kaspersky TajMahal April 2019

ATTACK:enterprise:S1026 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc2dd0db-3679-4b14-b9a1-4aff659e2c4a

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:S0575 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd79adbd-3d52-4f26-aea4-cbbbc3d6aa66

Cybereason Conti Jan 2021 · CarbonBlack Conti July 2020

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d10e82b8-7f30-4845-af05-44ac3287bf70

Eset Ramsay May 2020

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5ede6b1-984f-4e43-8d55-92d1efc5e8b6

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5f2b0fc-c865-419d-aacd-8004ecba00df

ESET Carberp March 2012

ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7aa491f-a801-4611-ad07-5096e12c5c5f

BlackBerry CostaRicto November 2020

ATTACK:enterprise:S0018 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df5bee66-b840-405e-b9d5-2e0ced2e6808

AlienVault Sykipot 2011

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e834920f-bc30-458e-b56e-80947d3a7c6e

Picus Emotet Dec 2018 · Trend Micro Banking Malware Jan 2019 · US-CERT Emotet Jul 2018

ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed113911-e21a-4b1b-a082-42313d5aa887

CheckPoint Naikon May 2020

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1091b2c-ea09-402b-9717-8b7526fb5c13

TrendMicro Netwalker May 2020

ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1459bdf-06ae-435a-8506-1e8e444a410b

IBM TA505 April 2020

ATTACK:enterprise:S0081 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f72d9605-eea6-4ed4-8502-231d4c21431f

Accenture Dragonfish Jan 2018 · Lotus Blossom Jun 2015

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f8b6eae9-cf2b-4b16-8c44-03d989533dd6

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9d9b5aa-f4d6-46fc-8831-21ca405ab8e5

DHS/CISA Ransomware Targeting Healthcare October 2020 · DFIR Ryuk 2 Hour Speed Run November 2020

ATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1055.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa7b6b1c-de8b-4e6b-ae62-785bc6ce3c51

Kaspersky ShadowPad Aug 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.