Native API
Technique · ATTACK:enterprise:T1106
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1106",
"title": "Native API",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1106",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--391d824f-0ef1-47a0-b0ee-c59a75e27670",
"external_id": "T1106",
"domain": "enterprise",
"created": "2017-05-31T21:31:17.472Z",
"modified": "2026-09-11T19:38:58.040Z",
"version": "2.3",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "MACOS Cocoa",
"url": "https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/OSX_Technology_Overview/CocoaApplicationLayer/CocoaApplicationLayer.html#//apple_ref/doc/uid/TP40001067-CH274-SW1"
},
{
"source_name": "Apple Core Services",
"url": "https://developer.apple.com/documentation/coreservices"
},
{
"source_name": "macOS Foundation",
"url": "https://developer.apple.com/documentation/foundation"
},
{
"source_name": "OutFlank System Calls",
"url": "https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/"
},
{
"source_name": "Redops Syscalls",
"url": "https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls"
},
{
"source_name": "GNU Fork",
"url": "https://www.gnu.org/software/libc/manual/html_node/Creating-a-Process.html"
},
{
"source_name": "CyberBit System Calls",
"url": "https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/"
},
{
"source_name": "GLIBC",
"url": "https://www.gnu.org/software/libc/"
},
{
"source_name": "LIBC",
"url": "https://man7.org/linux/man-pages//man7/libc.7.html"
},
{
"source_name": "Linux Kernel API",
"url": "https://www.kernel.org/doc/html/v4.12/core-api/kernel-api.html"
},
{
"source_name": "MDSec System Calls",
"url": "https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/"
},
{
"source_name": "Microsoft CreateProcess",
"url": "https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-createprocessa"
},
{
"source_name": "Microsoft Win32",
"url": "https://docs.microsoft.com/en-us/windows/win32/api/"
},
{
"source_name": "Microsoft NET",
"url": "https://dotnet.microsoft.com/learn/dotnet/what-is-dotnet-framework"
},
{
"source_name": "NT API Windows",
"url": "https://undocumented.ntinternals.net/"
}
]
}Explicit source assertions (238)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00ba134e-1833-4dde-bf4e-7ec45271e8a6
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S1179 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0125d222-8e17-44eb-b89b-6d795607e81f
Microsoft BlackByte 2023ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--019e35b8-cec3-45e0-b297-19dca59b3190
Novetta Winnti April 2015ATTACK:enterprise:S0453 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02075984-9bec-465e-8a21-6717b9a1308b
Malwarebytes Pony April 2016ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0229d70b-03ef-4744-aa06-348dd4bcbd10
NCSC Cyclops Blink February 2022ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06808653-60ba-430a-8c37-b3b49d740578
Talos Bisonal Mar 2020ATTACK:enterprise:S0084 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07ec1906-e634-43d5-ba87-02054fe82da6
Cylance Dust StormATTACK:enterprise:S0678 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0872f093-cfab-4e63-bfde-b7748808c96f
McAfee Lazarus Nov 2020ATTACK:enterprise:S0627 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09254353-5452-4af7-8e7b-f297eff42a7f
Securelist APT10 March 2021ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09505cc8-8e0f-4283-9329-df2bea12867c
Bitdefender Naikon April 2021ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--095bfdd3-2379-4cad-bef4-53e8bdd08a75
Talos Cobalt Strike September 2020 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020 · Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1013 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a3c7f91-6020-46f8-be45-d0a8cf86956e
Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:S0610 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b097893-c35a-4e75-ad26-d13ca0fd8b61
Check Point APT34 April 2021ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0eed42c5-98b2-409a-abaf-95915fc93d79
McAfee Lazarus Jul 2020ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f4a9bce-7e94-4c6f-83b1-49f842aa42c9
Security Scorecard Medusa Ransomware January 2024ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10435dca-baee-420a-a2b3-b13209e2d96a
Telefonica Snip3 December 2021ATTACK:enterprise:S0434 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--106cf74b-91d6-4348-91ae-48d1a42abb73
QiAnXin APT-C-36 Feb2019ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1095b9e8-2849-40c2-b56f-f6bc9d4bc648
Sogeti CERT ESEC Babuk March 2021 · McAfee Babuk February 2021 · Medium Babuk February 2021ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1326a801-6937-42ab-9916-e142ccc64261
McAfee Cuba April 2021ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13bcc487-1088-4f58-8d06-025a1c0522ed
CheckPoint_NimbusManticoreEurope_Sept2025ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--141a93b8-bfb7-4881-918c-7c91b7e41b25
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1489621a-59eb-42a9-b529-adc37c65520c
Zscaler Higaisa 2020ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14a8d0df-a875-45ed-be76-c671c1771179
ATT QakBot April 2021ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16632684-1ef3-41bb-9ef1-97c6c3294448
Mcafee Clop Aug 2019 · Cybereason Clop Dec 2020ATTACK:enterprise:S9053 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--166d3d7e-8bba-49ea-b84e-5944fdf717e0
CheckPoint_NimbusManticoreEurope_Sept2025ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1681f4aa-4bb1-482a-8fdf-8c1b724635d9
CheckPoint Naikon May 2020ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1790f5a1-b5d5-41a4-8da0-c75ed7a23b0d
CrowdStrike Ryuk January 2019ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19e06de9-b9a1-4532-94c6-f729036ba0c3
Checkpoint Dridex Jan 2021ATTACK:enterprise:S0668 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a471326-20d2-41e2-8dc5-dd9d9ce5a7e1
Talos TinyTurla September 2021ATTACK:enterprise:S1053 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b0ca110-bb1d-434d-a271-6574fdb11723
Malwarebytes AvosLocker Jul 2021ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c0296de-dc33-4fd7-b774-1bbe8c1b56b7
Unit 42 BackConfig May 2020ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c69d2f9-1152-415a-9294-808886999e04
Trend Micro KillDisk 1ATTACK:enterprise:S0466 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e669c57-11e8-4088-904c-84940458be8e
objective-see windtail2 jan 2019ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1eb02abf-4bad-4672-a0dd-73fffc02bb47
FireEye Ursnif Nov 2017ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20acec2a-ce61-4794-82f9-79fa778e7a7f
Microsoft Actinium February 2022ATTACK:enterprise:S1232 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20d9e1a0-835e-4aaf-80d0-4db5ad4d8dae
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--222fdbe3-5833-4be9-aa45-b85087606dc1
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S9036 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--226fb240-24c2-4eb6-ac1b-c9c60712371c
ESET_MuddyWater_Dec2025ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--239eb918-b9e0-499c-9934-96382fa782a0
Eset Ramsay May 2020ATTACK:enterprise:S0631 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24a3fef1-9b1f-498b-8aca-df90565e6932
Cybereason Chaes Nov 2020ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26818c78-7042-4493-a94b-eec0d7b9972a
BlackBerry Amadey 2020ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28427b29-2088-44f7-8acd-5df104dcb8ee
McAfee HoneybeeATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2af126e3-89ef-45b4-b345-45567ef17dfa
S2 Grupo TrickBot June 2017 · Joe Sec TrickbotATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b3cf66b-29d9-4251-b170-977def2692ad
MoustachedBouncer ESET August 2023ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c131932-4632-4866-845f-212cbe29756d
McAfee Lazarus Jul 2020 · Lazarus APT January 2022 · Qualys LolZarusATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d353aa1-9975-43cf-9aa3-3ef02fd3e61a
Kaspersky Ferocious Kitten Jun 2021ATTACK:enterprise:S9027 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3020712a-95b1-4f23-9a24-68a2b401ae97
Trend Micro Earth Kasha Anel NOV 2024ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--304c0297-8d9e-41ee-a5c0-f8bd33bdcd2a
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:S1236 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31d36371-b38c-4391-baf9-3b72056c520d
IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDAATTACK:enterprise:S1139 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32285265-97d8-4d93-b601-ade0155b2a9e
Cybereason INC Ransomware November 2023ATTACK:enterprise:S1152 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3301326d-45dd-4c42-9f2b-9e1123cde08e
PWC Yellow Liderc 2023ATTACK:enterprise:S0651 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3436ac2b-eadf-4aec-bd3a-cb814fd057b8
Checkpoint IndigoZebra July 2021ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3465231b-93b2-47ea-8c4f-f1f7e9d9be1b
ESET Turla PowerShell May 2019ATTACK:enterprise:S9058 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34fdbe2b-27c4-4f3e-9372-0ced2e9c4140
Mandiant_UNC1549_Nov2025ATTACK:enterprise:S0011 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3502c424-9bf1-4780-a5bd-a0d3830e1251
TrendMicro Taidoor · CISA MAR-10292089-1.v2 TAIDOOR August 2021ATTACK:enterprise:S1247 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--355133f7-9499-409f-9215-5c8f0756bd2d
Cyble Embargo Ransomware May 2024ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--355975ea-f7ae-4ae9-9b76-9a90c1b620c8
SophosGnGal_SystemBC_Dec2020ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--376f951c-844c-474b-b805-7f36caa07579
Mandiant ROADSWEEP August 2022ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c132a1b-053d-450b-8a4f-cabf30317075
Medium Metamorfo Apr 2020 · Fortinet Metamorfo Feb 2020ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cf6afbd-a010-4982-8121-22e67ace6046
Cycraft Chimera April 2020ATTACK:enterprise:S9037 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d32732f-e0ca-4ec7-833a-2eae547c2c44
CloudSEK_RustyWater_Jan2026ATTACK:enterprise:S1078 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fa24e29-2791-4b10-8014-bfa817c3a2f2
RotaJakiro 2021 netlab360 analysisATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fe56134-1a77-4df2-af85-9a68042c5fb8
BlackBerry CostaRicto November 2020ATTACK:enterprise:S0471 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--419b786c-a7db-4357-918c-aa1b883203ee
Trend Micro Tick November 2019ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41b41a39-ff5f-433d-9e2a-3dad3b00d74e
Halcyon Qilin.B OCT 2024 · Trend Micro Agenda Ransomware AUG 2022ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42f4db8f-ef8b-4dcc-8c8f-4d0b5219c8b7
Beechey 2010 · Corio 2008 · Microsoft Windows Defender Application Control · TechNet Applocker vs SRP · NSA MS AppLocker · Windows Commands JPCERTATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--432e1354-11a0-4ade-9874-58fa3194b0d1
CheckPointResearch_TheGentlemen_April2026ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44927ff0-b153-4122-a881-ff078a3e81cd
BiZone Lizar May 2021ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44b2a372-1aee-4a7e-a544-2aacdfe3121a
Malwarebytes RokRAT VBA January 2021ATTACK:enterprise:S1210 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--463f6f75-0bcf-4cee-ae3f-8a7ad2776721
Cisco LotusBlossom 2025ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48879c97-651c-4426-9093-bd8c4939fc19
Trend Micro njRAT 2018ATTACK:enterprise:S9061 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c141056-f1ee-46f9-9fdc-de576094ac65
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c90355d-1d51-41b1-ad7a-e62537483a90
INCIBE-CERT LockBit MAR 2024 · Sentinel Labs LockBit 3.0 JUL 2022ATTACK:enterprise:S0180 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ed458b0-e5cd-48c7-baba-a33ca84a8738
US-CERT Volgmer 2 Nov 2017ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51fb8815-6f59-46ff-8f7a-98025623db76
FireEye HancitorATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53948a0d-1c53-4569-b6b3-78b7738793c3
Hornet Security Avaddon June 2020ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5580b0f6-7679-46c3-adb5-270c87f8ef69
Cisco Ukraine Wipers January 2022 · RecordedFuture WhisperGate Jan 2022ATTACK:enterprise:S1170 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55cadf96-99c1-4f37-8ef6-8c846ee74ade
ESET OilRig Downloaders DEC 2023ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56175559-c05d-405c-b2ef-10a3acd3af61
sentinelone operationDigitalEye Dec 2024ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56aab689-f68d-4a38-a814-d9a54d04093d
Segurança Informática URSA Sophisticated Loader 2020 · SCILabs Malteiro 2021