Windows Command Shell
Subtechnique · ATTACK:enterprise:T1059.003
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1059.003",
"title": "Windows Command Shell",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1059/003",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--d1fcf083-a721-4223-aedf-bf8960798d62",
"external_id": "T1059.003",
"domain": "enterprise",
"created": "2020-03-09T14:12:31.196Z",
"modified": "2026-05-12T15:12:00.717Z",
"version": "1.5",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "SSH in Windows",
"url": "https://docs.microsoft.com/en-us/windows/terminal/tutorials/ssh"
}
]
}Explicit source assertions (391)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0053 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0191f3d3-59d3-4fcc-bfff-5fbfa0675cfd
Unit 42 SeaDuke 2015ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--032981a6-3299-4852-bd9c-c691f866bec5
Novetta Blockbuster Destructive Malware · Novetta Blockbuster · Qualys LolZarus · McAfee Lazarus Resurfaces Feb 2018 · McAfee GhostSecret · US-CERT SHARPKNOT June 2018ATTACK:enterprise:S0259 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03a73f0c-218f-4ebf-81d2-88e2c8e9b883
ASERT InnaputRAT April 2018ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03c08ef9-80c7-4f20-b197-ad44f702f2e0
Trend Micro Daserf Nov 2017 · Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0046 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04e4f0d1-32a9-4d64-a733-3316b0bf2740
F-Secure CozyDukeATTACK:enterprise:S1017 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04f0ecb5-4647-4f96-9439-7e2255da11c8
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:S0229 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06814fdf-8bf8-43eb-b448-812541b46afa
Proofpoint Leviathan Oct 2017 · Proofpoint Leviathan Oct 2017ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06aa7096-4813-4f50-a69a-7bcd6503ffe4
Unit 42 BackConfig May 2020ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07945166-0096-44fb-855e-a25313ca2b1d
Korean FSI TA505 2020ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08bf9136-b5a3-4f46-893a-3bd4f7911f91
ESET Turla Lunar toolset May 2024ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08d8941b-e4be-44f1-8a3f-765b8f5d1196
BiZone Lizar May 2021 · Threatpost Lizar May 2021ATTACK:enterprise:S0651 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b440f89-cffb-458c-bc16-c64af09230c6
Checkpoint IndigoZebra July 2021ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b86182d-8435-4632-92fe-a2a8ac720b77
ESET MirrorFace 2025ATTACK:enterprise:S0124 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c56b369-b665-4001-87ff-d27ae135cc64
Palo Alto DNS RequestsATTACK:enterprise:S0346 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--102d7613-aabc-4d54-b0fe-88501924da86
McAfee Oceansalt Oct 2018 · McAfee Oceansalt Oct 2018ATTACK:enterprise:S0639 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10801683-4565-4af5-a447-ac31043f8ad7
Trend Micro Ransomware February 2021ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--112012c7-a727-47a4-8a7a-ccb7d40a3311
Cyberreason Anchor December 2019ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11ab0bc2-4baa-4d06-a001-2b59d3bc5567
FoxIT Wocao December 2019ATTACK:enterprise:S0025 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--121d2e76-5ba1-475d-9cf9-1046724abae1
Mandiant APT1 AppendixATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12362fa5-736b-4cac-9d74-51cd559f1e7c
Crowdstrike Qakbot October 2020 · Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021 · ATT QakBot April 2021ATTACK:enterprise:S0698 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--131ac47f-f346-4d49-8c59-f252684b0281
ESET Hermetic Wizard March 2022ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13219288-d8b3-4464-a173-923ed8dfae0a
PaloAlto NanoCore Feb 2016 · Cofense NanoCore Mar 2018ATTACK:enterprise:G0039 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13a8be40-1190-4553-b026-58c5088c322a
Symantec Suckfly May 2016ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14c87d77-834d-4f0a-abaa-984c7e2a67d6
SophosGnGal_SystemBC_Dec2020ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15a8c4ba-f86d-4b2f-a0c7-9390d22dbd4e
Cybereason Soft Cell June 2019ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16632790-94dc-40ce-9c0a-2f6af0f691b1
Palo Alto Gamaredon Feb 2017 · Symantec Shuckworm January 2022ATTACK:enterprise:S0520 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--170fb051-0d3d-4105-b6d2-96c9c68e4b8c
US-CERT BLINDINGCAN Aug 2020ATTACK:enterprise:S0345 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1719d211-582f-4ae9-90f4-2ec984360927
Mandiant APT1 AppendixATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17bc0957-1509-4faf-bb51-a6a9e1959978
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Unit 42 Magic Hound Feb 2017ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17db0e04-2e71-4f29-9086-266503e6d000
Talos PoetRAT October 2020ATTACK:enterprise:S1191 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1831125c-e713-4fdb-a893-1284b2acffc0
Palo Alto Howling Scorpius DEC 2024ATTACK:enterprise:S0436 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--183b5c91-0424-4a26-830c-cdeb8959b72a
JPCert TSCookie March 2018ATTACK:enterprise:S0020 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19be6ce1-8eea-47ff-b87c-3358d390454d
SecureWorks BRONZE UNION June 2017 · Lee 2013 · NCSC Joint Report Public ToolsATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b42c337-1bb7-4b42-9332-238b5edb6a63
Zscaler APT31 Covid-19 October 2020ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b5bac20-4c29-42a5-86ce-622c1d50cf6b
Bitsight Latrodectus June 2024 · Elastic Latrodectus May 2024ATTACK:enterprise:G0070 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ba80112-ffca-4c7e-ae63-fcbe3b9e689d
Lookout Dark Caracal Jan 2018ATTACK:enterprise:S0390 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1bab673f-4d0f-473a-8c4d-9b6b53c1369d
Flashpoint FIN 7 March 2019ATTACK:enterprise:S9007 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c020af3-753b-47a3-acb4-324d1ff4ee4e
Gen Digital Kimsuky HTTPTroy October 2025ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c0acd9f-d536-47ec-9473-5d2a5e5dde73
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c13ff97-1581-4283-b9ec-f378f97f3440
Cybereason StrifeWater Feb 2022ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ca344f1-97fe-453c-9f12-86130ddcebbc
Mandiant FIN12 Oct 2021 · DFIR Ryuk's Return October 2020ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ca68d88-a287-4c48-a4f8-68611eceb445
ESET RTM Feb 2017ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1caa0b51-4e91-4c1b-bec5-53592ab9d08a
Cylance Sodinokibi July 2019 · Talos Sodinokibi April 2019 · Picus Sodinokibi January 2020 · Secureworks REvil September 2019ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d3892ec-dccb-4ba2-b82c-2c7fcafbdd00
Microsoft PLATINUM April 2016ATTACK:enterprise:S0382 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1db2b844-8ace-46f3-a2f9-527e813f32b6
Proofpoint TA505 Jan 2019 · Deep Instinct TA505 Apr 2019ATTACK:enterprise:S1193 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ddb44cc-25c0-4f18-a70c-5c13c7d1c99a
Mandiant APT42-untanglingATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e5cae4c-240d-495b-9eca-34bba583d894
ESET Okrum July 2019ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e8fbfc4-4992-490a-9a91-e304eb965c0d
Proofpoint Bumblebee April 2022 · Google EXOTIC LILY March 2022ATTACK:enterprise:S1035 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fe26342-5bd2-4f5b-91a8-e9b6c53f7c23
NCSC GCHQ Small Sieve Jan 2022ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ffac810-9c9e-4060-9902-737085ba8bc5
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0564 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--209fe032-42b5-4268-85bf-4db099e06d92
Microsoft GALLIUM December 2019ATTACK:enterprise:S0011 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2124d78b-edbb-4334-9bbc-fd7dc62fcdd0
CISA MAR-10292089-1.v2 TAIDOOR August 2021ATTACK:enterprise:S0435 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21711eb2-eddd-40f5-8c20-dc50495c102d
JPCert PLEAD Downloader June 2018ATTACK:enterprise:S0547 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23faa436-b299-4b94-9284-fe80d6c5d312
Cybereason Molerats Dec 2020 · BleepingComputer Molerats Dec 2020ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24b4efab-e553-4faa-a53d-d6306e183d20
Zscaler Pikabot 2023ATTACK:enterprise:C0051 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24fc21b0-44f7-4a26-89e1-074ba8ea0981
Nearest Neighbor VolexityATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--251c7f06-a012-4fe1-9520-21f051a47255
Group IB GrimAgent July 2021ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--261d9569-d779-4f76-a7e3-6f704afc8185
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--264be7f9-61e1-4e9e-aa4a-aa4a7420f3b3
Palo Alto ComnieATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26cee727-2047-4ea9-b3bd-1115431aa633
FireEye APT34 Dec 2017 · OilRig ISMAgent July 2017 · Unit 42 OopsIE! Feb 2018 · Unit 42 QUADAGENT July 2018 · Unit42 OilRig Nov 2018 · FireEye APT34 Dec 2017 · OilRig ISMAgent July 2017 · Unit 42 OopsIE! Feb 2018 · Unit 42 QUADAGENT July 2018 · Unit42 OilRig Nov 2018ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26eafe5d-0ffc-48cf-ba1d-3681bdcbfaa3
SecureWorks BRONZE UNION June 2017 · Unit42 Emissary Panda May 2019ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26f6de28-984d-4f79-9806-c13fe9e1f42d
Cybereason Bazar July 2020 · Zscaler Bazar September 2020ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--275a2606-3eee-4c11-8a97-300b58f49d60
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S0271 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--283ba525-5180-461a-989b-87fc2f896ed7
US-CERT KEYMARBLE Aug 2018ATTACK:enterprise:G0028 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--289e01df-60e6-4eee-830e-9d742ac10c86
Dell TG-1314ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a42bba4-1bb8-4119-9d55-80d0d37d6313
Cybereason Lockbit 2.0 · Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b2ccd03-b6ad-4125-a05d-851ebf353bb5
Kaspersky Adwind Feb 2016ATTACK:enterprise:T1059.003 → subtechnique-of → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2bd00c10-dace-4747-931e-67915d9aab7d
ATTACK:enterprise:S0082 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c158663-599b-45a8-b946-6d545206428d
Lotus Blossom Dec 2015ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d413a0d-abce-4e4e-ab09-12930eeb959f
Group-IB RansomHub FEB 2025ATTACK:enterprise:S0258 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d467445-9cce-4e84-968e-7a7ecc0a81fa
Unit 42 RGDoor Jan 2018ATTACK:enterprise:C0037 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e07c275-4a34-4249-bbd5-7342ddcfa759
TrendMicro Pikabot 2024ATTACK:enterprise:S0594 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2eea60ff-d673-49aa-b360-49cc32763ff1
Trend Micro Muddy Water March 2021ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f1861d0-00dc-4b68-aab6-0a2f781b3a94
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:S0221 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f4d2f2e-78a9-46e6-bb2f-5b1be932da42
Umbreon Trend MicroATTACK:enterprise:S1043 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f50eea4-aec7-4925-a8c6-2d0c6a4f481f
Bitdefender FunnyDream Campaign November 2020ATTACK:enterprise:S0275 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fbbc518-3feb-4613-9981-297d928c483f
FireEye APT10 Sept 2018ATTACK:enterprise:S9067 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fc39af3-0bc7-4b72-a5f1-e193ae86a5d2
Mandiant_UNC1549_Nov2025ATTACK:enterprise:S0088 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--305ecc72-e820-44cb-ab52-593ccca814ff
Zscaler KasidetATTACK:enterprise:S0360 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30f18b5b-a02e-4d15-bfd2-346145453a07
Palo Alto OilRig Sep 2018