Skip to content

Bypass User Account Control

Subtechnique · ATTACK:enterprise:T1548.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1548.002",
  "title": "Bypass User Account Control",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1548/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--120d5519-3098-4e1c-9191-2aa61232f073",
  "external_id": "T1548.002",
  "domain": "enterprise",
  "created": "2020-01-30T14:24:34.977Z",
  "modified": "2026-05-12T15:12:00.621Z",
  "version": "3.0",
  "aliases": [

  ],
  "tactics": [
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "Davidson Windows",
      "url": "http://www.pretentiousname.com/misc/win7_uac_whitelist2.html"
    },
    {
      "source_name": "TechNet How UAC Works",
      "url": "https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works"
    },
    {
      "source_name": "SANS UAC Bypass",
      "url": "http://pen-testing.sans.org/blog/pen-testing/2013/08/08/psexec-uac-bypass"
    },
    {
      "source_name": "MSDN COM Elevation",
      "url": "https://msdn.microsoft.com/en-us/library/ms679687.aspx"
    },
    {
      "source_name": "enigma0x3 Fileless UAC Bypass",
      "url": "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/"
    },
    {
      "source_name": "TechNet Inside UAC",
      "url": "https://technet.microsoft.com/en-US/magazine/2009.07.uac.aspx"
    },
    {
      "source_name": "Fortinet Fareit",
      "url": "https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware"
    },
    {
      "source_name": "Github UACMe",
      "url": "https://github.com/hfiref0x/UACME"
    }
  ]
}

Explicit source assertions (69)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--047f365d-28bd-4db5-96a2-408b97a42c32

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--054a22c3-f0ee-476a-b0cb-e3277c755032

F-Secure BlackEnergy 2014

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d0b4507-b600-41f1-be98-03909e5d99cf

ESET RTM Feb 2017

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f5eaa9c-9252-48a7-a386-cc05e3ceaed5

Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--126ecc74-4376-4909-9f75-a0630e47cb68

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1762eb59-4fc3-46c8-87d2-c16128bf20cb

ESET Gelsemium June 2021

ATTACK:enterprise:M1051 → mitigates → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b7972b8-9373-4f60-a0e5-7c1aca2c15a6

ATTACK:enterprise:S0230 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c395bb3-3b16-422f-bb00-9048b67b2337

Proofpoint ZeroT Feb 2017

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22e9d049-aa86-46d3-a2a4-f5ae6e0cc2d8

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--236e89e9-ee31-4ec7-bc85-cbacffef7b68

Ensilo Darkgate 2018

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25654cd1-d99b-48c4-b891-8848b923d5f1

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26fd5ea0-6f63-4c0a-9a84-23e489c1161c

Check Point Warzone Feb 2020 · Uptycs Warzone UAC Bypass November 2020

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--321a3181-9478-4a4c-b13b-607dbfeee7fc

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3657d3de-d279-47f0-ab54-68ca82f4536d

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36a0199f-bce6-4717-a4e4-ce3d75a7ab1c

Medium KONNI Jan 2020 · Malwarebytes Konni Aug 2021

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bc57dac-c8b3-4d6d-8f4c-3e7d515cdf87

ATTACK:enterprise:S0074 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3efe41c1-48be-48fc-90d8-5ae70df3cd97

ATTACK:enterprise:T1548.002 → subtechnique-of → ATTACK:enterprise:T1548

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4436ace7-a47d-4d18-afa1-4454432fba66

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4439e86a-de1d-4ea6-a856-858b799bcdc5

FOX-IT May 2016 Mofang

ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4558c2f3-247f-478c-8139-80e7a45208e7

Microsoft BlackCat Jun 2022

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46393d52-ee2f-44d6-bad6-37a75344f5d2

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:G0120 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--497c12c8-1cdf-4c1e-9624-83438ef770a2

ESET EvilNum July 2020

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a8f7699-3bcd-4586-b029-f43756681805

Securelist ScarCruft May 2019

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c6aea43-27ba-4e6a-8907-e5db364a145b

Secureworks BRONZE BUTLER Oct 2017 · Trend Micro Tick November 2019

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--580d04a7-791b-42a9-87cc-d3bfbca45d7e

Picus Qilin MAR 2025

ATTACK:enterprise:S0129 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cd8b8a9-fd11-4405-8369-b12398b94def

Forcepoint Monsoon

ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--659462ab-e1ed-4370-9810-aa3efcb060bf

Microsoft FinFisher March 2018 · FinFisher Citation

ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--666ef8c1-cc87-4efa-9f35-f9bf1d1317c6

Secure List Bad Rabbit

ATTACK:enterprise:S0134 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a0f3ebb-c805-402f-bb2e-aac2f8d174fa

ESET Sednit Part 3

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b794c49-0734-446c-9192-5b1e1cf06be0

ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6efcb476-efdb-414c-80f8-66fe84f7c7e3

Arxiv Avaddon Feb 2021

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7037e3b3-33ea-43d6-bfa0-95178066131a

CISA AR18-352A Quasar RAT December 2018

ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--745d3440-ecdb-4e3f-b9e6-b4484bb6c465

Novetta Winnti April 2015

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fff37e5-a123-4d85-850e-7745d1e18650

NCC Group WastedLocker June 2020

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80d612e4-8d4a-45f7-8c29-d44a1aae794c

ClearSky MuddyWater Nov 2018 · NaumaanProofpoint_GlobalClickFix_April2025

ATTACK:enterprise:M1052 → mitigates → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86eb3c0d-b1c1-4b52-b802-18f321450f29

ATTACK:enterprise:S0501 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88111958-702b-4bfb-9ad1-c329491df5be

ESET PipeMon May 2020

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--892763cd-4967-49f6-b8a8-212a6f18a19b

Talos Lokibot Jan 2021

ATTACK:enterprise:S0132 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8961d93e-ec51-42dd-8f76-54d46ea21967

Cisco H1N1 Part 2

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b4fd69e-a3c6-4721-9aed-d8235a93672e

Group IB Cobalt Aug 2017

ATTACK:enterprise:S0254 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bb8c2ab-b701-4a09-902b-a2ddf8d36451

Rancor Unit42 June 2018

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--922037af-61f0-42d8-8b57-310b6b56ea5a

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--945dface-ae29-4baa-ad2d-45c27029936a

Fortinet Remcos Feb 2017

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a024097d-78f0-4439-a239-571d361335f5

Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020

ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1862cc9-ba25-4d48-b2d5-55781dd1fa3e

Crowdstrike Indrik November 2018

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a57c1d9d-0d2f-4206-a53f-d31ab7c53c17

TrendMicro EarthLusca 2022

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a88fe386-79eb-48d0-a982-033b6f75845a

McAfee Honeybee

ATTACK:enterprise:S0527 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae0b54d4-8aac-400a-ab6a-9656144c77cc

Cybereason Kimsuky November 2020

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8113737-894f-42de-b607-9d4905fcdfc3

Cybereason Bumblebee August 2022

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9165c4a-aac7-479d-8ad9-22c25e031a76

Nccgroup Emissary Panda May 2018

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1b5ad09-6b1a-487e-bec1-af2326be5007

ESET Grandoreiro April 2020

ATTACK:enterprise:S0275 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2ae3362-b947-40e6-acce-3196480f26ec

Trend Micro Earth Kasha Anel NOV 2024 · Trend Micro Earth Kasha Updates APR 2025

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4734977-e231-46cd-91c8-ce4be580d543

Talent-Jump Clambling February 2020 · Trend Micro DRBControl February 2020

ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5a7cf46-a3ab-4d33-a43f-012c0c5fdf63

Palo Alto Shamoon Nov 2016

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c65da10e-8b5b-4290-87a4-cbc3120bf99c

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8de0953-1f20-47a4-bb02-ea9c30e8f932

CISA AppleJeus Feb 2021

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9412068-a35c-4be3-9945-a1f69f2f77db

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:S0669 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d11b6896-16e0-4c02-9c16-0880085010e8

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d13ebdb9-f3c4-4296-b3a5-ac44d29c5c3e

Cybereason Sliver Undated

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d16d59aa-f056-4cc7-9f67-0e80db9cdacb

Cymmetria Patchwork

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6b31077-90cf-4279-9064-f83550834447

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d880af17-1184-4c4e-8550-665944d16a69

RedCanary RaspberryRobin 2022

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9e56665-26bb-49e2-99b4-6b4e7ccb38e3

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:S0116 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ecd83e69-2eb1-4c2d-a01f-e42ea8f807f9

ATTACK:enterprise:S9007 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f47d71ca-61d7-46a3-ae63-d215b6bf8789

Gen Digital Kimsuky HTTPTroy October 2025

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f8dbd7fd-5639-413f-92cd-4e3c4151384a

Intel471 Medusa Ransomware May 2025

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb16dea3-7f32-4778-b6af-3126c4547d17

Github PowerShell Empire

ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcc98412-8534-42d7-873a-6f8a26721e27

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fdcda836-4a21-45d2-8269-31b82aa3c08e

Mandiant No Easy Breach

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.