Skip to content

File Deletion

Subtechnique · ATTACK:enterprise:T1070.004

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1070.004",
  "title": "File Deletion",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1070/004",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--d63a3fb8-9452-4e9d-a60a-54be68d5998c",
  "external_id": "T1070.004",
  "domain": "enterprise",
  "created": "2020-01-31T12:35:36.479Z",
  "modified": "2026-09-11T19:53:31.010Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "Microsoft SDelete July 2016",
      "url": "https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete"
    }
  ]
}

Explicit source assertions (320)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0164 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0061f7aa-fe4e-41e5-8ebf-e9f526bda08f

ClearSky Wilted Tulip July 2017

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00c1536c-5f37-4f45-a8ae-c426325d24e5

ITOCHU LODEINFO JAN 2024

ATTACK:enterprise:S0395 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01b13af3-d241-47ed-b351-e83604c0d92f

ESET LightNeuron May 2019

ATTACK:enterprise:S1150 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01dc7e85-da23-4a0b-937e-a7a6e83c7f53

Mandiant ROADSWEEP August 2022 · Microsoft Albanian Government Attacks September 2022

ATTACK:enterprise:S0654 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--022d2514-26de-457f-8fb4-c5daf36eaef9

Group IB Ransomware September 2020

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02bd0dd0-85cb-439c-a984-973bed485f8e

Crowdstrike HuntReport 2022 · CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0302f1d4-ceeb-4976-b12d-dc5f6b8fd3e7

Group-IB RansomHub FEB 2025

ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0439c736-6a78-4e89-9c55-6cc565b1b11f

Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0448 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0449ef6d-2ea2-40a3-9cc9-c07672d6a859

McAfee Sharpshooter December 2018

ATTACK:enterprise:G0051 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--059f8b03-59f9-45da-9c12-862f50e5fe45

FireEye FIN10 June 2017

ATTACK:enterprise:T1070.004 → subtechnique-of → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05e3980c-03ae-4624-82d8-0cbcc45705cd

ATTACK:enterprise:S0593 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05f303b4-7582-45d1-af25-46250afc4d8f

CISA EB Aug 2020

ATTACK:enterprise:S0370 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--063bf46c-0210-4e2f-bd7e-6db0f0975f07

Sophos SamSam Apr 2018

ATTACK:enterprise:S0390 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0705be49-4ad2-4b50-a024-e8b79b53a1ab

Flashpoint FIN 7 March 2019

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0741e02b-edaa-43a4-a96c-d6baf2d29015

Accenture Hogfish April 2018 · District Court of NY APT10 Indictment December 2018

ATTACK:enterprise:S1027 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07fd0d2b-867b-4b9a-bf7a-e2c0dfe60079

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--089efdf8-b07a-4cda-aa5d-e60f9501ffd1

Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:S0282 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08b4b3f1-3c20-4e70-8a42-99fd5f191b12

alientvault macspy

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--098a760a-66ce-46e0-938e-86518e450a27

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a068253-0c11-4ba7-bac4-1290e5f50960

CISA AppleJeus Feb 2021

ATTACK:enterprise:S0437 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0aa51def-3a75-4c69-8b65-82559d8f4c83

TrendMicro BlackTech June 2017

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b46eb26-ebc0-4fa7-8925-9b775571f793

ATT TeamTNT Chimaera September 2020 · Cisco Talos Intelligence Group

ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c5806e9-dbfc-45d5-a5a9-843523b9b942

NCSC-NL COATHANGER Feb 2024

ATTACK:enterprise:S0527 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d388cf6-adcd-4708-8203-cea7180340b0

Cybereason Kimsuky November 2020

ATTACK:enterprise:S0344 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f785fc5-0d07-40bd-8d54-acfb79499824

Unit42 Azorult Nov 2018

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10a4e987-0b9d-4ea1-b82f-4b93d6a10a45

Prevailion DarkWatchman 2021

ATTACK:enterprise:S1182 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1320191c-29ef-4784-9010-42ac30aa8dff

Cisco MagicRAT 2022

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--152f2412-dbba-48b7-bbe9-612798f3ac23

Unit 42 Bisonal July 2018 · Kaspersky CactusPete Aug 2020 · Talos Bisonal Mar 2020

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15e25965-b5e9-4b8c-b052-8a2233b30198

ESET Lazarus Jun 2020

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--161225df-de21-4715-b4f3-c324c05ff590

CISA AA20-239A BeagleBoyz August 2020 · FireEye APT38 Oct 2018 · Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16b2871e-c793-4362-89b8-b893806d147a

Bitdefender Naikon April 2021

ATTACK:enterprise:S0107 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--171380bf-41ff-43da-86fe-c131f5f7b97b

Trustwave Cherry Picker

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--172a8a26-d2c9-4d29-b050-55949c0186dd

McAfee Bankshot

ATTACK:enterprise:G0053 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ace08c6-0f1a-487d-92b2-6c61c2299270

Mandiant FIN5 GrrCON Oct 2016

ATTACK:enterprise:S0342 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ae53b90-59d3-4510-b0e8-686b7ea8e626

ESET GreyEnergy Oct 2018

ATTACK:enterprise:S0380 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b384505-b69a-4c0b-95f1-02384214abae

Kaspersky StoneDrill 2017

ATTACK:enterprise:S0093 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d54c1d7-529f-4e4f-9a38-55b1b8cbff66

Symantec Dragonfly

ATTACK:enterprise:S0443 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d90e3ef-1839-4bb8-8205-02e2461b5d55

FireEye MESSAGETAP October 2019

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f06f614-8f5a-4666-9fa5-fcda1535f97d

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:S0279 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f8760c6-f11c-43f7-acf8-bc30a347518c

objsee mac malware 2017

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--207c59d5-9df0-4838-9a0a-5555ea78b35f

Unit42 OceanLotus 2017 · TrendMicro MacOS April 2018 · Trend Micro MacOS Backdoor November 2020

ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20904798-df45-48a6-8428-9e4fb913f6ae

CarbonBlack LockerGoga 2019

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--230fb134-db80-490d-9c00-5039487d5903

ESET Machete July 2019

ATTACK:enterprise:S0233 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24db8ce5-951e-4952-9aff-c005a563cb99

FireEye Periscope March 2018

ATTACK:enterprise:S0502 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25609fb5-4f73-47ba-882e-56a421b7b566

NSA/FBI Drovorub August 2020

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27857b33-3c5d-4f27-9d61-d70da097fd84

ESET Gelsemium June 2021

ATTACK:enterprise:S0347 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27e8d133-848b-4db0-ac79-b5a37da879f1

TrendMicro Lazarus Nov 2018

ATTACK:enterprise:S0249 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28084f31-80be-472b-bd15-6945b2905a93

McAfee Gold Dragon

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b4a8be2-8403-43d4-addd-79c504e3dec8

Symantec Remsec IOCs · Kaspersky ProjectSauron Full Report · Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S1200 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b772eaa-086e-4e04-a346-8cfac766f8f0

Cybereason StealBit Exfiltration Tool · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:S0176 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e5039ef-913f-4808-9685-32f64f4dbf49

Microsoft SIR Vol 21

ATTACK:enterprise:S0434 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f0fee17-1cd1-45dd-a1e0-f854c03ed064

QiAnXin APT-C-36 Feb2019

ATTACK:enterprise:S0256 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ff304c1-9b4d-4f01-927d-53a1c339f7ab

ESET Turla Mosquito Jan 2018

ATTACK:enterprise:S0257 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30c22798-520c-40cc-b53f-352a1c0a4940

Unit 42 VERMIN Jan 2018

ATTACK:enterprise:S0556 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3179774b-9b7a-4720-850c-23c7b04d26c6

Check Point Pay2Key November 2020

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3194bdc2-a0d3-412a-a14a-bc0c4f30bc9c

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31bd2260-ef8d-4f69-a7a8-9388e0d721c9

Microsoft PLATINUM April 2016

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--323ab0a8-1ae7-4754-a47d-f4c0978dea10

Picus BlackByte 2022 · Cisco BlackByte 2024 · Microsoft BlackByte 2023 · Symantec BlackByte 2022

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32621114-725a-4766-b057-2d091adba75b

Mandiant Cutting Edge Part 3 February 2024 · Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--339e60fc-f94c-4b51-bc78-846c29c4340d

Kaspersky MoleRATs April 2019

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33d66657-3e4c-430b-ae40-a9d310f39f13

Unit 42 Hildegard Malware

ATTACK:enterprise:S9046 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33ef3c18-7600-4de9-b28f-69f6bbe054f3

Claroty-IOCONTROL · Armis-IOCONTROL

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3464b769-7884-4721-8384-1771472f668d

Kaspersky Turla Aug 2014

ATTACK:enterprise:S0195 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35f3fba0-7deb-4436-87a2-503c96f69342

Microsoft SDelete July 2016

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36c3a279-a507-482e-9d9c-ee6cdfb3db67

Rapid7 BlackBasta 2024

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3872901c-9601-413e-bf8a-e2fe35772c71

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0441 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38938464-b328-4d89-a3a3-7e1f68cb195e

Unit 42 Inception November 2018

ATTACK:enterprise:S0011 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--399c8f98-ead6-40c5-9dba-13e25e338fd8

CISA MAR-10292089-1.v2 TAIDOOR August 2021

ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39f5d465-832e-4de8-9738-0879803e2b1c

CrowdStrike SUNSPOT Implant January 2021

ATTACK:enterprise:S0162 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b31b258-d3e0-4acc-9c20-de870baa64a0

Sofacy Komplex Trojan

ATTACK:enterprise:S0181 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b32f3be-5bdd-4de8-9e39-83b0b8c1e70f

US-CERT FALLCHILL Nov 2017

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b4aaacf-d721-4bad-a64e-37d48c6b847d

McAfee Honeybee

ATTACK:enterprise:S0172 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bf633d0-5578-4e3a-a599-52f3946f6623

Palo Alto Reaver Nov 2017

ATTACK:enterprise:S0238 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cf1b188-99ad-48a5-bce8-962eef956ec8

McAfee GhostSecret

ATTACK:enterprise:S0264 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d4a9fd6-34cb-4883-a00c-4aea3d00869e

Unit 42 OilRig Sept 2018

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3dfd09c1-dde9-4bbf-9cfc-57b263b91284

Cadet Blizzard emerges as novel threat actor

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e153f3f-26aa-4ff6-8192-095b30e94bae

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--417552c3-3db4-491a-86bb-7fe2c513d406

jRAT Symantec Aug 2018

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--425b70b5-c809-4d74-a5d8-d159a6564b21

ESET MirrorFace DEC 2022 · Trend Micro Earth Kasha Updates APR 2025 · JPCERT MirrorFace JUL 2024 · Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--432f7a25-5994-4f50-8b75-c62c674f27a7

Talos Konni May 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.