aol.pm

Exploitation for Client Execution

Technique · ATTACK:enterprise:T1203

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1203",
  "title": "Exploitation for Client Execution",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1203",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--be2dcee9-a7a7-4e38-afd6-21b31ecc3d63",
  "external_id": "T1203",
  "domain": "enterprise",
  "created": "2018-04-18T17:59:24.739Z",
  "modified": "2025-10-24T17:49:18.695Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [

  ]
}

Explicit source assertions (64)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0841fe7b-657e-47e9-b4c9-ec812043a41c

ATT Sidewinder January 2021 · Cyble Sidewinder September 2020

ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e1a58e9-06e9-4ad5-8445-4068e240e3d7

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b3f3de6-364e-443f-8b34-62073c801a5b

Securelist Sofacy Feb 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b9b061b-5ead-45f3-b4cc-30d8427b0649

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--216e5287-2cea-4bd0-b109-24b205f848b3

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2311db5c-218f-44f8-aa50-3e8322b79081

McAfee Sandworm November 2013 · iSight Sandworm Oct 2014 · TrendMicro Sandworm October 2014

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ecdcdb3-6aa2-4888-921f-e9506ebbd00c

Gigamon Berserk Bear October 2021

ATTACK:enterprise:G0138 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f5d9a23-5360-479c-b6dc-f9827bb6b353

TrendMicro New Andariel Tactics July 2018 · FSI Andariel Campaign Rifle July 2017 · IssueMakersLab Andariel GoldenAxe May 2017

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--314a5160-17e0-44eb-9f4b-1a8e216b56a2

McAfee Bankshot

ATTACK:enterprise:M1050 → mitigates → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d1c88d6-f390-4e05-ba1c-c6ea59f5fe22

TechNet Moving Beyond EMET · Wikipedia Control Flow Integrity

ATTACK:enterprise:S1154 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e93955a-ad40-4e94-b2c6-7676a18571f7

Lumen Versa 2024

ATTACK:enterprise:G0089 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49315e80-2d47-432f-8e5f-3a694a91bb45

Cylance Shaheen Nov 2018

ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f195e59-5f23-45d9-b48e-d0d0a0152b72

Google EXOTIC LILY March 2022

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a0ce8c4-e941-4bd0-8e70-6ca440a29b9d

McAfee Bankshot

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ca1f5dc-9573-46bb-a9db-fb83cd15b272

F-Secure The Dukes · Cybersecurity Advisory SVR TTP May 2021 · MSTIC NOBELIUM May 2021

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6236226c-b950-4baf-a1f6-1c956ae04613

Netskope XLoader 2022

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--630900fe-588f-44af-8f46-f722c503b6fd

Intel471_SH_Aug2021

ATTACK:enterprise:G0098 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66a14eeb-a6a0-4614-8224-7f238b3a83da

TrendMicro BlackTech June 2017

ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66cadf3d-bfb7-4b75-a659-06b3cb1bbd37

Cyphort EvilBunny Dec 2014

ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6706d89e-27dd-48bb-ae0b-db51e07cbc91

Unit42 Xbash Sept 2018 · Trend Micro Xbash Sept 2018

ATTACK:enterprise:S0578 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b8761f0-fd7d-45da-971a-b3883e77fcc5

Carnegie Mellon University Supernova Dec 2020 · Splunk Supernova Jan 2021

ATTACK:enterprise:G0142 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--718b8ec5-a10a-46e1-96e2-14ceb3835b1e

TrendMicro Confucius APT Feb 2018 · Uptycs Confucius APT Jan 2021

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74316a28-d1a6-40b8-8c49-836f06e90e02

Cymmetria Patchwork · Symantec Patchwork · Unit 42 BackConfig May 2020 · Securelist Dropping Elephant · PaloAlto Patchwork Mar 2018 · TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018

ATTACK:enterprise:G0005 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75b6869c-dd4e-44ec-8614-97fe792e9dd6

Moran 2014 · Trend Micro IXESHE 2012

ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--767ac715-7f6e-4bde-9112-2876102f8a2f

Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76a3097b-808d-45a9-aa81-dce5ed6a45d3

Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ab16f65-9be6-46ec-8c2c-96f58e089df0

Cisco Group 72

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b053a36-de7d-476b-bc06-6d712432d615

PTSecurity Higaisa 2020

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7dd876da-7f2b-4bdb-9cc1-424dd53dd6cd

Talos Frankenstein June 2019

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ec2b835-9c82-4a0a-9730-5f4b87e233f4

Crowdstrike Global Threat Report Feb 2018 · TrendMicro Cobalt Group Nov 2017 · RiskIQ Cobalt Nov 2017 · RiskIQ Cobalt Jan 2018 · Proofpoint Cobalt June 2017 · PTSecurity Cobalt Dec 2016 · PTSecurity Cobalt Group Aug 2017 · Talos Cobalt Group July 2018

ATTACK:enterprise:S0374 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8195cc4a-3415-49b9-9338-156b56ac0e30

CheckPoint SpeakUp Feb 2019

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--829ec8ab-3e48-442b-beb2-b0d2dbdaaca0

Accenture MUDCARP March 2019 · Proofpoint Leviathan Oct 2017 · CISA AA21-200A APT40 July 2021 · FireEye Periscope March 2018

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--857b5ce3-0eb0-4dae-a034-42cfa306a447

Volexity InkySquid BLUELIGHT August 2021 · FireEye APT37 Feb 2018 · Talos Group123 · Securelist ScarCruft Jun 2016

ATTACK:enterprise:G0062 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a9d92e5-e9b5-40bd-8cc4-c4cc5ed9fdd4

Proofpoint TA459 April 2017

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b2f18e7-8c3c-4d43-a2f9-53f87512f3a2

Crowdstrike MUSTANG PANDA June 2018

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b7be75b-ae8e-46c5-b59d-cb278f76f57a

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e8c23a5-ca50-4c40-992e-7bd1491077e7

Recorded Future RedDelta 2025

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--924c8549-a033-44f9-8823-64e95fe339e7

FireEye Clandestine Wolf · FireEye Clandestine Fox

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--935f9bb6-d38d-42d1-a764-6b5110ad5364

Symantec Tick Apr 2016 · Trend Micro Tick November 2019

ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--941a9634-bacb-4389-bb17-09212c937683

PWC Sea Turtle 2023

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9553062d-2207-4990-b9d4-a29f75628bd5

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad934b01-9c8c-42cd-8195-dc272c363208

TrendMicro Tropic Trooper Mar 2018 · Unit 42 Tropic Trooper Nov 2016

ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af7d7ff9-c74e-48da-9e6d-029161746afd

TrendMicro Tonto Team October 2020 · Talos Bisonal Mar 2020 · Talos Bisonal 10 Years March 2020 · Kaspersky CactusPete Aug 2020

ATTACK:enterprise:G1007 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0601ad4-5d8d-4c86-8d0a-86fc2edadbc3

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0702a30-f680-4f9b-99c3-352ce2a9557a

Kaspersky Cloud Atlas August 2019 · Kaspersky Cloud Atlas December 2014 · Symantec Inception Framework March 2018 · Unit 42 Inception November 2018

ATTACK:enterprise:S0391 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b07612e3-9f6f-4c55-a63d-629b0e4c099f

FireEye HAWKBALL Jun 2019

ATTACK:enterprise:S0243 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b12c9b3f-bff1-4c73-bb86-a9665948405c

Sofacy DealersChoice

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcbc885e-c1ae-4e69-a72c-22900403bae3

FireEye APT41 Aug 2019

ATTACK:enterprise:C0016 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c837d369-bb16-464b-9cae-8eca38124c4e

Cylance Dust Storm

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8f99f79-c0da-4767-8191-34cf2012b559

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3f7e788-7479-41f7-8efc-35b8f2a914f4

CISA GRU29155 2024

ATTACK:enterprise:M1048 → mitigates → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d48a5068-7796-4c66-9ddf-eb6e8aaf6887

Windows Blogs Microsoft Edge Sandbox · Ars Technica Pwn2Own 2017 VM Escape

ATTACK:enterprise:G1002 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d497a340-9b38-4b98-8fb6-1288519dc541

Forcepoint BITTER Pakistan Oct 2016 · Cisco Talos Bitter Bangladesh May 2022

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dac35c07-4a4a-4924-a702-09e5cf988349

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de676fc0-0b1f-4392-a84b-f412c660d89a

Talos Cobalt Strike September 2020 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0066 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1269d18-6cc9-45cc-9c99-06f765bea366

Symantec Elderwood Sept 2012

ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1bcdc6c-771a-4606-b7f4-cdfbef5efc34

Microsoft DUBNIUM June 2016

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2048373-fe76-4f99-8608-60eaa05d1b2b

ESET OceanLotus Mar 2019

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3034eac-6009-4a94-b1e6-50a163b26045

Trend Micro Earth Simnavaz October 2024

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4b036ec-b7d4-40a7-9a85-25423a1027c9

FireEye admin@338

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e948752d-c4a1-4678-97e4-2bd11563115e

Symantec Elfin Mar 2019 · Microsoft Holmium June 2020

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f57211b1-df3f-4f38-a1ce-7a4f3d1d7fe1

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5e6ce32-60e2-4a2c-8cc9-efb9d613a8e4

ClearSky MuddyWater June 2019

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1203

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fa27f615-56c5-4089-bcda-657999868e53

ESET InvisiMole June 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.