Skip to content

File Transfer Protocols

Subtechnique · ATTACK:enterprise:T1071.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1071.002",
  "title": "File Transfer Protocols",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1071/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--9a60a291-8960-4387-8a4a-2ab5c18bb50b",
  "external_id": "T1071.002",
  "domain": "enterprise",
  "created": "2020-03-15T16:16:25.763Z",
  "modified": "2026-09-03T19:46:40.084Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "ESET Machete July 2019",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"
    },
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    },
    {
      "source_name": "US-CERT TA18-074A",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-074A"
    }
  ]
}

Explicit source assertions (31)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a0c827d-98ba-4f95-a6ef-b0a34765d0f4

Talos PoetRAT October 2020

ATTACK:enterprise:T1071.002 → subtechnique-of → ATTACK:enterprise:T1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c8ce5e2-3a80-407e-9624-3619528df5fa

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f377784-3676-4df3-8a29-7b3372a5d8ba

Trend Micro Agenda Ransomware OCT 2025

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cd69fd0-d5ad-41db-aaee-fd58e46bfaaa

FireEye APT41 March 2020

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--364f1a31-7710-4b81-91ce-919a89cdedcf

Mythc Documentation

ATTACK:enterprise:C0055 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ec8d5a9-77b4-4406-8c0e-9bccaf4d0cea

Microsoft Storm-0940

ATTACK:enterprise:S0465 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b569311-24d2-439d-badb-a5076955cda3

Unit 42 CARROTBAT January 2020

ATTACK:enterprise:S0019 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e23c694-3f4a-43f7-823b-8ea36558c928

Kaspersky Regin

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64d956d3-7818-47a1-ad3b-c7c5588117eb

Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--685856c8-227b-41b3-841d-9a7be6389eb9

ESET Machete July 2019 · Cylance Machete Mar 2017 · 360 Machete Sep 2020

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a348a23-50cb-45e7-af72-57e2809f6d01

ATTACK:enterprise:S0161 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--785abba4-fdb4-4aad-9049-5a0c748cc965

ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bde54d7-257c-4c68-920e-bd78fe282f14

Microsoft PLATINUM April 2016

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c44064a-f697-413c-b0b1-a6b92bf3cfc3

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93f46e6e-cabc-4274-b50e-63bda692d01e

ESET Attor Oct 2019

ATTACK:enterprise:S1089 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--942ced7d-f5a7-4c8d-ba66-e28479f7447a

MoustachedBouncer ESET August 2023

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d7fb3cf-ccee-4f04-b7ef-ee42c320e513

McAfee Honeybee

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a18f1ae0-dbc8-4f6d-9c88-ab284ce2bf0c

Talos ZxShell Oct 2014

ATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a43b5d19-a2d5-4440-b0c6-6d4819edb77e

Kaspersky ShadowPad Aug 2017

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bac1d1a4-14f7-4f68-8035-e322e94f92c9

US-CERT TA18-074A

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb315101-e4b6-4ff2-a8bb-d063b9370dfa

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:S0464 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bceb819a-0ab5-412b-9671-de67e980cb77

Unit 42 CARROTBAT November 2018 · Unit 42 CARROTBAT January 2020

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd072d13-3815-46eb-ae84-1aba38db3fab

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--beb80024-3f49-424e-b074-c0e1370f4402

Immersive Labs Havoc C2 APR 2024 · Zscaler Havoc FEB 2023 · Havoc Framework Documentation

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--caad197f-4ef9-4239-8f4e-61b9b69e5449

ESET MirrorFace DEC 2022

ATTACK:enterprise:G0083 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cff191ef-39ba-4126-b039-12a7fe327665

Unit42 SilverTerrier 2018

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d31bacda-9a8f-4807-b0d6-51a47f0af986

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d979fd42-450e-4bd3-a6f8-74b8c8f8fb7b

Talos Cobalt Strike September 2020 · cobaltstrike manual

ATTACK:enterprise:S1088 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6bcb612-8e5c-493e-902e-0eb92a796a81

MoustachedBouncer ESET August 2023

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eabe052b-cecc-4d80-92c9-150e8c8dbcdd

VirusBulletin Kimsuky October 2019

ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ebd87b4c-eca9-4680-9608-a49ec74b5c4b

Unit 42 NOKKI Sept 2018

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.