Security Software Discovery
Subtechnique · ATTACK:enterprise:T1518.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1518.001",
"title": "Security Software Discovery",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1518/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--cba37adb-d6fb-4610-b069-dd04c0643384",
"external_id": "T1518.001",
"domain": "enterprise",
"created": "2020-02-21T21:16:18.066Z",
"modified": "2026-05-12T15:12:00.716Z",
"version": "1.5",
"aliases": [
],
"tactics": [
"discovery"
],
"source_references": [
]
}Explicit source assertions (143)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02052736-4888-47b0-9eb4-4031a4061998
Securelist Darkhotel Aug 2015 · Microsoft DUBNIUM June 2016ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--030506d0-28fa-4a37-8375-037f7887ccff
TrendMicro RaspberryRobin 2022 · HP RaspberryRobin 2024ATTACK:enterprise:S0611 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0481e814-434a-4736-80f3-f8bbcad3faf2
Mcafee Clop Aug 2019 · Cybereason Clop Dec 2020ATTACK:enterprise:S0469 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07173c7c-335d-488b-b3ff-2f94168500db
Trend Micro Tick November 2019ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07b15826-1fe3-42db-afdb-9f18e2c8ef2b
FoxIT Wocao December 2019ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--085c21c0-4afb-4df2-bf86-803457be16fd
Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0cf2ae01-9d19-46d7-949e-e6d7a5639a95
Rewterz Sidewinder APT April 2020ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f5c39a8-edc1-4da2-941a-56e17b32abe4
Fortinet Metamorfo Feb 2020 · ESET Casbaneiro Oct 2019ATTACK:enterprise:S1234 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11855647-767c-4f80-adb0-4ff81a392f67
Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12c5e6cf-be54-42cc-af42-5fa80ad87fb5
Trend Micro Mustang Panda Earth Preta Toneshell February 2025ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1343df30-b011-42f7-b3a3-a5d1d2f0b9c6
Crowdstrike Qakbot October 2020 · ATT QakBot April 2021 · ATT QakBot April 2021 · Kaspersky QakBot September 2021ATTACK:enterprise:S0339 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14a9f873-cb86-4238-b6c6-8b0836512fdc
Talos Micropsia June 2017 · Radware Micropsia July 2018ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15c71de6-bc1d-451f-8c61-a982516bb18b
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--198d7156-eff4-4a6e-8e59-ab8a656f77a8
Proofpoint Operation Transparent Tribe March 2016 · Kaspersky Transparent Tribe August 2020ATTACK:enterprise:S0330 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19f93e6a-a481-4f72-856a-879742a654e4
Talos Zeus Panda Nov 2017 · GDATA Zeus Panda June 2017ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a2f3d08-8a75-4ad5-8aba-445d37ebbff8
BlackBerry BahamutATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b19ae5d-f4c5-4962-a069-3d264ff1a80d
ESET_MuddyWater_Dec2025ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c327eb2-e0af-45c2-a9ea-784252ad34b0
CISA AA20-239A BeagleBoyz August 2020 · MIcrosoft Mastra npm Compromise JUN 2026 · 1 - appvATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c792ece-e1d9-4819-9621-1b704a23839d
Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ce61b6a-b1fd-4e21-874a-774a1487fa12
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2211993c-fe8d-4bd7-a312-44187566ae65
Mandiant APT42-untanglingATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--240b044f-89b4-4009-bbf6-04b1f0bb6385
Korean FSI TA505 2020 · BlackBerry Amadey 2020ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25623cee-b8bc-4937-9a93-749549e69a83
Proofpoint TA2541 February 2022ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26289101-47e6-47a5-bc9f-19bf918721d6
Palo Alto ComnieATTACK:enterprise:G0089 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a8c6029-7714-437a-87a2-bc91067575e6
Cylance Shaheen Nov 2018ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e77d363-e38f-40ad-a6ef-9222dc12793d
Baumgartner Naikon 2015ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fdc9078-0737-4b2c-bb6c-f046b63c368b
Cybereason Bazar July 2020ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30b3b0e1-88a4-4126-8a2e-78ccaedbb36d
Kroll RedLine Stealer August 2024 · Veriti RedLine Stealer MAAS April 2023ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30ff291e-e546-4084-8b5b-22fd5a597449
Morphisec Cobalt Gang Oct 2018ATTACK:enterprise:S0046 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--330c8e43-575f-4c9a-b6c2-def7306841ad
F-Secure CozyDukeATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35a86a34-1ea3-4f78-bd73-96b9975f9927
Qualys LummaStealer 2024ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37d43abb-78c6-45b7-927d-353f5f95c322
Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024ATTACK:enterprise:S1013 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--382d78e9-c653-4d0d-aab6-c154152f6f1c
Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:S0196 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c0cb507-2bf0-46ab-b5c2-ba2865397722
Morphisec ShellTea June 2019ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c155a7b-d51d-4290-a663-3e5cf022d6e4
Secureworks DarkTortilla Aug 2022ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3caf848c-d95b-40ae-a288-2905319e4005
FireEye MuddyWater Mar 2018ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3db3a6a7-5fa4-4a66-86b6-5df1732a8e96
SymantecCarbonBlack_ShuckwormUSB_Apr2025ATTACK:enterprise:S0267 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--433eeadb-2011-476e-833a-7541df07d432
ESET GreyEnergy Oct 2018ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44aab0bc-80d5-4c6b-9acf-ceb9cc30f443
Kaspersky TajMahal April 2019ATTACK:enterprise:S0256 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--481c0cee-c977-430f-9f33-e5859b48be39
ESET Turla Mosquito Jan 2018ATTACK:enterprise:S0257 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49b63fca-e16a-446e-89fc-2b899f8420bf
Unit 42 VERMIN Jan 2018ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49c5bbcf-7ac3-406f-8b58-2b4c00b2c41e
Cybereason Valak May 2020ATTACK:enterprise:S0468 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49f761f9-89d2-4e6f-a0c6-fc5e32cca471
Trend Micro SkidmapATTACK:enterprise:S0143 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a9f7553-b3ee-405b-9c81-f487b4bed868
Kaspersky Flame · Kaspersky Flame FunctionalityATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f90f58d-de6a-41b8-8ffd-1db5da42db34
Cofense Astaroth Sept 2018ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--502d4200-719b-4b42-8221-0ecd0ed0d6e7
Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022 · Medium Ali Salem Bumblebee April 2022ATTACK:enterprise:S0473 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50dbe887-4d91-42d3-8e1b-34000ad5a1e7
Trend Micro Tick November 2019ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52781f1e-4b91-4ff2-8f48-89e15bc40d42
FireEye APT34 Dec 2017ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5449b7c0-73f8-474f-8444-0182112d7c57
Talos Frankenstein June 2019ATTACK:enterprise:S0657 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5adfebe4-4bfd-4848-9727-379d7284dcc8
Volexity InkySquid BLUELIGHT August 2021ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d2cc737-7cbc-476f-afbe-a8fafa7043fe
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6157e239-92a8-427f-ba9b-2f06f5b03f12
US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:S0388 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--618d4835-6022-46df-bee1-38fcb97ffb91
TrendMicro TropicTrooper 2015ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61c802ec-b415-4161-bf15-3a8c5cc0a243
DFIR Ryuk's Return October 2020ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6207afcd-8cc6-4bee-aa2c-2218e30679b1
Google Cloud APT41 2024ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67e2417b-793a-4082-94ca-445718e925b1
TrendMicro Netwalker May 2020ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a5bc2dd-2132-4af0-9b12-0e781971d96c
Cymmetria PatchworkATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6afb86e4-cb3b-40f5-ab03-10db5e0e9302
Kaspersky Ferocious Kitten Jun 2021ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6bed87bb-2cb9-48a8-a23d-31ed8285c61f
Securelist MuddyWater Oct 2018ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d651de6-29d6-4621-91af-a48593ab7c19
Check Point Blind Eagle MAR 2025ATTACK:enterprise:S0679 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--700e46f0-0c55-4b5b-8f12-d4ead13b03d3
Kaspersky WIRTE November 2021ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71219800-4802-4029-bf24-fc09503ad05d
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--716975f1-af44-4d45-af4e-29ad68ce3fb3
ESET Grandoreiro April 2020 · ESET Grandoreiro April 2020ATTACK:enterprise:S0098 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74e84133-f84a-469a-bfd7-1a514af2f15e
Palo Alto T9000 Feb 2016ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--765e3b13-60f4-4b34-b03f-0d8e738b0add
FireEye APT28ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77a6a1b4-9217-48fe-b1dd-f1f6506dd910
ESET HiddenFace 2024 · Trend Micro Earth Kasha NOV 2024ATTACK:enterprise:S0472 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--785d0d93-1500-40b5-9f71-9d51aadef914
Trend Micro Tick November 2019ATTACK:enterprise:S0471 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79c46f52-743a-4a17-bede-aa003c03f6b1
Trend Micro Tick November 2019ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7da97f5c-fd61-4181-9775-47abbd5250c0
Proofpoint TA505 Mar 2018ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7de5afb6-3dbf-4c9a-876f-1f7a4aa9d4e0
Unit 42 WhisperGate January 2022ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e32a557-f724-433f-84e0-756e14db7074
Talos Promethium June 2020ATTACK:enterprise:S0380 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e90117e-0a1b-4320-9b37-54e070c3dc49
Kaspersky StoneDrill 2017ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f81539c-f287-4f8f-be26-11443d2e19d3
DFIR_Sodinokibi_Ransomware · DFIR_Quantum_RansomwareATTACK:enterprise:S0057 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80ca0faf-6958-4158-a36d-b3e7936c5f5a
Microsoft TasklistATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8121ed43-42eb-42ad-a86f-26fb53b71975
Prevx Carberp March 2011ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81e6eb4d-4a94-4416-8a45-b54e9cafda9d
Palo Alto Brute Ratel July 2022ATTACK:enterprise:S1179 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83082ae7-c6bd-4595-8fe5-3016e8879119
Symantec BlackByte 2022ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--833c9993-3551-45af-9bbd-413de2d4dac3
CrowdStrike AQUATIC PANDA December 2021ATTACK:enterprise:S0653 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8536d997-c81c-48c9-94e9-6ffea04e4a0f
Checkpoint IndigoZebra July 2021ATTACK:enterprise:S0171 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--863c1d57-db93-49a9-a953-eb7c2d6b2e5b
Forcepoint Felismus Mar 2017