{"record":{"id":"ATTACK:enterprise:T1548.002","title":"Bypass User Account Control","type":"Subtechnique","source_url":"https://attack.mitre.org/techniques/T1548/002","snapshot":"enterprise-attack-20.0.json","status":"active","rights":"Source metadata only; source notices retained; no operational prose or payloads","review_status":"machine-extracted; source-specific checks passed, editorial review pending","stix_id":"attack-pattern--120d5519-3098-4e1c-9191-2aa61232f073","external_id":"T1548.002","domain":"enterprise","created":"2020-01-30T14:24:34.977Z","modified":"2026-05-12T15:12:00.621Z","version":"3.0","aliases":[],"tactics":["privilege-escalation"],"source_references":[{"source_name":"Davidson Windows","url":"http://www.pretentiousname.com/misc/win7_uac_whitelist2.html"},{"source_name":"TechNet How UAC Works","url":"https://technet.microsoft.com/en-us/itpro/windows/keep-secure/how-user-account-control-works"},{"source_name":"SANS UAC Bypass","url":"http://pen-testing.sans.org/blog/pen-testing/2013/08/08/psexec-uac-bypass"},{"source_name":"MSDN COM Elevation","url":"https://msdn.microsoft.com/en-us/library/ms679687.aspx"},{"source_name":"enigma0x3 Fileless UAC Bypass","url":"https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/"},{"source_name":"TechNet Inside UAC","url":"https://technet.microsoft.com/en-US/magazine/2009.07.uac.aspx"},{"source_name":"Fortinet Fareit","url":"https://blog.fortinet.com/2016/12/16/malicious-macro-bypasses-uac-to-elevate-privilege-for-fareit-malware"},{"source_name":"Github UACMe","url":"https://github.com/hfiref0x/UACME"}]},"assertions":[{"id":"enterprise:relationship--047f365d-28bd-4db5-96a2-408b97a42c32","subject":"ATTACK:enterprise:S9050","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--047f365d-28bd-4db5-96a2-408b97a42c32","modified":"2026-09-25T18:14:55.281Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--054a22c3-f0ee-476a-b0cb-e3277c755032","subject":"ATTACK:enterprise:S0089","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--054a22c3-f0ee-476a-b0cb-e3277c755032","modified":"2026-04-29T14:23:05.910Z","references":[{"source_name":"F-Secure BlackEnergy 2014","url":"https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0d0b4507-b600-41f1-be98-03909e5d99cf","subject":"ATTACK:enterprise:S0148","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0d0b4507-b600-41f1-be98-03909e5d99cf","modified":"2026-04-29T14:23:05.921Z","references":[{"source_name":"ESET RTM Feb 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--0f5eaa9c-9252-48a7-a386-cc05e3ceaed5","subject":"ATTACK:enterprise:S1202","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--0f5eaa9c-9252-48a7-a386-cc05e3ceaed5","modified":"2026-04-29T14:23:05.925Z","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--126ecc74-4376-4909-9f75-a0630e47cb68","subject":"ATTACK:enterprise:S0154","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--126ecc74-4376-4909-9f75-a0630e47cb68","modified":"2026-04-29T14:23:05.929Z","references":[{"source_name":"cobaltstrike manual","url":"https://web.archive.org/web/20210825130434/https://cobaltstrike.com/downloads/csmanual38.pdf"},{"source_name":"Cobalt Strike Manual 4.3 November 2020","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1762eb59-4fc3-46c8-87d2-c16128bf20cb","subject":"ATTACK:enterprise:S0666","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1762eb59-4fc3-46c8-87d2-c16128bf20cb","modified":"2026-04-29T14:23:05.936Z","references":[{"source_name":"ESET Gelsemium June 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1b7972b8-9373-4f60-a0e5-7c1aca2c15a6","subject":"ATTACK:enterprise:M1051","predicate":"mitigates","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1b7972b8-9373-4f60-a0e5-7c1aca2c15a6","modified":"2026-04-29T14:23:05.942Z","references":[{"source_name":"Github UACMe","url":"https://github.com/hfiref0x/UACME"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--1c395bb3-3b16-422f-bb00-9048b67b2337","subject":"ATTACK:enterprise:S0230","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--1c395bb3-3b16-422f-bb00-9048b67b2337","modified":"2026-04-29T14:23:05.943Z","references":[{"source_name":"Proofpoint ZeroT Feb 2017","url":"https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--22e9d049-aa86-46d3-a2a4-f5ae6e0cc2d8","subject":"ATTACK:enterprise:S1018","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--22e9d049-aa86-46d3-a2a4-f5ae6e0cc2d8","modified":"2026-04-29T14:23:05.953Z","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--236e89e9-ee31-4ec7-bc85-cbacffef7b68","subject":"ATTACK:enterprise:S1111","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--236e89e9-ee31-4ec7-bc85-cbacffef7b68","modified":"2026-04-29T14:23:05.953Z","references":[{"source_name":"Ensilo Darkgate 2018","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--25654cd1-d99b-48c4-b891-8848b923d5f1","subject":"ATTACK:enterprise:G0082","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--25654cd1-d99b-48c4-b891-8848b923d5f1","modified":"2026-07-31T20:48:23.102Z","references":[{"source_name":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--26fd5ea0-6f63-4c0a-9a84-23e489c1161c","subject":"ATTACK:enterprise:S0670","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--26fd5ea0-6f63-4c0a-9a84-23e489c1161c","modified":"2026-04-29T14:23:05.958Z","references":[{"source_name":"Check Point Warzone Feb 2020","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"},{"source_name":"Uptycs Warzone UAC Bypass November 2020","url":"https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--321a3181-9478-4a4c-b13b-607dbfeee7fc","subject":"ATTACK:enterprise:S0192","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--321a3181-9478-4a4c-b13b-607dbfeee7fc","modified":"2026-04-29T14:23:05.983Z","references":[{"source_name":"GitHub Pupy","url":"https://github.com/n1nj4sec/pupy"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3657d3de-d279-47f0-ab54-68ca82f4536d","subject":"ATTACK:enterprise:S0378","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3657d3de-d279-47f0-ab54-68ca82f4536d","modified":"2026-04-29T14:23:05.994Z","references":[{"source_name":"GitHub PoshC2","url":"https://github.com/nettitude/PoshC2_Python"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--36a0199f-bce6-4717-a4e4-ce3d75a7ab1c","subject":"ATTACK:enterprise:S0356","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--36a0199f-bce6-4717-a4e4-ce3d75a7ab1c","modified":"2026-04-29T14:23:05.994Z","references":[{"source_name":"Medium KONNI Jan 2020","url":"https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"},{"source_name":"Malwarebytes Konni Aug 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3bc57dac-c8b3-4d6d-8f4c-3e7d515cdf87","subject":"ATTACK:enterprise:M1047","predicate":"mitigates","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3bc57dac-c8b3-4d6d-8f4c-3e7d515cdf87","modified":"2026-04-29T14:23:06.004Z","references":[{"source_name":"Github UACMe","url":"https://github.com/hfiref0x/UACME"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--3efe41c1-48be-48fc-90d8-5ae70df3cd97","subject":"ATTACK:enterprise:S0074","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--3efe41c1-48be-48fc-90d8-5ae70df3cd97","modified":"2026-04-29T14:23:06.011Z","references":[{"source_name":"Dell Sakula","url":"http://www.secureworks.com/cyber-threat-intelligence/threats/sakula-malware-family/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4436ace7-a47d-4d18-afa1-4454432fba66","subject":"ATTACK:enterprise:T1548.002","predicate":"subtechnique-of","object":"ATTACK:enterprise:T1548","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4436ace7-a47d-4d18-afa1-4454432fba66","modified":"2026-04-29T14:23:06.018Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4439e86a-de1d-4ea6-a856-858b799bcdc5","subject":"ATTACK:enterprise:S0444","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4439e86a-de1d-4ea6-a856-858b799bcdc5","modified":"2026-04-29T14:23:06.018Z","references":[{"source_name":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4558c2f3-247f-478c-8139-80e7a45208e7","subject":"ATTACK:enterprise:S1068","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4558c2f3-247f-478c-8139-80e7a45208e7","modified":"2026-04-29T14:23:06.020Z","references":[{"source_name":"Microsoft BlackCat Jun 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--46393d52-ee2f-44d6-bad6-37a75344f5d2","subject":"ATTACK:enterprise:S1199","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--46393d52-ee2f-44d6-bad6-37a75344f5d2","modified":"2026-04-29T14:23:06.021Z","references":[{"source_name":"Palo Alto Lockbit 2.0 JUN 2022","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"},{"source_name":"FBI Lockbit 2.0 FEB 2022","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--497c12c8-1cdf-4c1e-9624-83438ef770a2","subject":"ATTACK:enterprise:G0120","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--497c12c8-1cdf-4c1e-9624-83438ef770a2","modified":"2026-07-31T18:47:42.410Z","references":[{"source_name":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4a8f7699-3bcd-4586-b029-f43756681805","subject":"ATTACK:enterprise:G0067","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4a8f7699-3bcd-4586-b029-f43756681805","modified":"2026-07-31T18:47:55.300Z","references":[{"source_name":"Securelist ScarCruft May 2019","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--4c6aea43-27ba-4e6a-8907-e5db364a145b","subject":"ATTACK:enterprise:G0060","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--4c6aea43-27ba-4e6a-8907-e5db364a145b","modified":"2026-07-31T18:48:10.400Z","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"},{"source_name":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--580d04a7-791b-42a9-87cc-d3bfbca45d7e","subject":"ATTACK:enterprise:S1242","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--580d04a7-791b-42a9-87cc-d3bfbca45d7e","modified":"2026-04-29T14:23:06.045Z","references":[{"source_name":"Picus Qilin MAR 2025","url":"https://www.picussecurity.com/resource/blog/qilin-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--5cd8b8a9-fd11-4405-8369-b12398b94def","subject":"ATTACK:enterprise:S0129","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--5cd8b8a9-fd11-4405-8369-b12398b94def","modified":"2026-04-29T14:23:06.052Z","references":[{"source_name":"Forcepoint Monsoon","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--659462ab-e1ed-4370-9810-aa3efcb060bf","subject":"ATTACK:enterprise:S0182","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--659462ab-e1ed-4370-9810-aa3efcb060bf","modified":"2026-04-29T14:23:06.063Z","references":[{"source_name":"Microsoft FinFisher March 2018","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--666ef8c1-cc87-4efa-9f35-f9bf1d1317c6","subject":"ATTACK:enterprise:S0606","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--666ef8c1-cc87-4efa-9f35-f9bf1d1317c6","modified":"2026-04-29T14:23:06.064Z","references":[{"source_name":"Secure List Bad Rabbit","url":"https://securelist.com/bad-rabbit-ransomware/82851/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6a0f3ebb-c805-402f-bb2e-aac2f8d174fa","subject":"ATTACK:enterprise:S0134","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6a0f3ebb-c805-402f-bb2e-aac2f8d174fa","modified":"2026-04-29T14:23:06.069Z","references":[{"source_name":"ESET Sednit Part 3","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6b794c49-0734-446c-9192-5b1e1cf06be0","subject":"ATTACK:enterprise:S0250","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6b794c49-0734-446c-9192-5b1e1cf06be0","modified":"2026-04-29T14:23:06.071Z","references":[{"source_name":"Github Koadic","url":"https://github.com/offsecginger/koadic"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--6efcb476-efdb-414c-80f8-66fe84f7c7e3","subject":"ATTACK:enterprise:S0640","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--6efcb476-efdb-414c-80f8-66fe84f7c7e3","modified":"2026-04-29T14:23:06.076Z","references":[{"source_name":"Arxiv Avaddon Feb 2021","url":"https://arxiv.org/pdf/2102.04796.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7037e3b3-33ea-43d6-bfa0-95178066131a","subject":"ATTACK:enterprise:S0262","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7037e3b3-33ea-43d6-bfa0-95178066131a","modified":"2026-04-29T14:23:06.078Z","references":[{"source_name":"CISA AR18-352A Quasar RAT December 2018","url":"https://www.cisa.gov/uscert/ncas/analysis-reports/AR18-352A"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--745d3440-ecdb-4e3f-b9e6-b4484bb6c465","subject":"ATTACK:enterprise:S0141","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--745d3440-ecdb-4e3f-b9e6-b4484bb6c465","modified":"2026-04-29T14:23:06.084Z","references":[{"source_name":"Novetta Winnti April 2015","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--7fff37e5-a123-4d85-850e-7745d1e18650","subject":"ATTACK:enterprise:S0612","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--7fff37e5-a123-4d85-850e-7745d1e18650","modified":"2026-04-29T14:23:06.101Z","references":[{"source_name":"NCC Group WastedLocker June 2020","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--80d612e4-8d4a-45f7-8c29-d44a1aae794c","subject":"ATTACK:enterprise:G0069","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--80d612e4-8d4a-45f7-8c29-d44a1aae794c","modified":"2026-07-31T20:48:29.935Z","references":[{"source_name":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"},{"source_name":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--86eb3c0d-b1c1-4b52-b802-18f321450f29","subject":"ATTACK:enterprise:M1052","predicate":"mitigates","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--86eb3c0d-b1c1-4b52-b802-18f321450f29","modified":"2026-04-29T14:23:06.109Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--88111958-702b-4bfb-9ad1-c329491df5be","subject":"ATTACK:enterprise:S0501","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--88111958-702b-4bfb-9ad1-c329491df5be","modified":"2026-04-29T14:23:06.111Z","references":[{"source_name":"ESET PipeMon May 2020","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--892763cd-4967-49f6-b8a8-212a6f18a19b","subject":"ATTACK:enterprise:S0447","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--892763cd-4967-49f6-b8a8-212a6f18a19b","modified":"2026-04-29T14:23:06.112Z","references":[{"source_name":"Talos Lokibot Jan 2021","url":"https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8961d93e-ec51-42dd-8f76-54d46ea21967","subject":"ATTACK:enterprise:S0132","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8961d93e-ec51-42dd-8f76-54d46ea21967","modified":"2026-04-29T14:23:06.113Z","references":[{"source_name":"Cisco H1N1 Part 2","url":"https://web.archive.org/web/20231210122239/https://blogs.cisco.com/security/h1n1-technical-analysis-reveals-new-capabilities-part-2"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8b4fd69e-a3c6-4721-9aed-d8235a93672e","subject":"ATTACK:enterprise:G0080","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8b4fd69e-a3c6-4721-9aed-d8235a93672e","modified":"2026-07-31T18:48:23.134Z","references":[{"source_name":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--8bb8c2ab-b701-4a09-902b-a2ddf8d36451","subject":"ATTACK:enterprise:S0254","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--8bb8c2ab-b701-4a09-902b-a2ddf8d36451","modified":"2026-04-29T14:23:06.116Z","references":[{"source_name":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--922037af-61f0-42d8-8b57-310b6b56ea5a","subject":"ATTACK:enterprise:M1026","predicate":"mitigates","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--922037af-61f0-42d8-8b57-310b6b56ea5a","modified":"2026-04-29T14:23:06.124Z","references":[],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--945dface-ae29-4baa-ad2d-45c27029936a","subject":"ATTACK:enterprise:S0332","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--945dface-ae29-4baa-ad2d-45c27029936a","modified":"2026-04-29T14:23:06.127Z","references":[{"source_name":"Fortinet Remcos Feb 2017","url":"https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a024097d-78f0-4439-a239-571d361335f5","subject":"ATTACK:enterprise:S0458","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a024097d-78f0-4439-a239-571d361335f5","modified":"2026-04-29T14:23:06.143Z","references":[{"source_name":"Eset Ramsay May 2020","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"},{"source_name":"Antiy CERT Ramsay April 2020","url":"https://www.programmersought.com/article/62493896999/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a1862cc9-ba25-4d48-b2d5-55781dd1fa3e","subject":"ATTACK:enterprise:S0570","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a1862cc9-ba25-4d48-b2d5-55781dd1fa3e","modified":"2026-04-29T14:23:06.145Z","references":[{"source_name":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a57c1d9d-0d2f-4206-a53f-d31ab7c53c17","subject":"ATTACK:enterprise:G1006","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a57c1d9d-0d2f-4206-a53f-d31ab7c53c17","modified":"2026-07-31T20:48:48.326Z","references":[{"source_name":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--a88fe386-79eb-48d0-a982-033b6f75845a","subject":"ATTACK:enterprise:C0006","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--a88fe386-79eb-48d0-a982-033b6f75845a","modified":"2026-07-31T18:47:20.931Z","references":[{"source_name":"McAfee Honeybee","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-uncovers-operation-honeybee-malicious-document-campaign-targeting-humanitarian-aid-groups/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ae0b54d4-8aac-400a-ab6a-9656144c77cc","subject":"ATTACK:enterprise:S0527","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ae0b54d4-8aac-400a-ab6a-9656144c77cc","modified":"2026-04-29T14:23:06.162Z","references":[{"source_name":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b8113737-894f-42de-b607-9d4905fcdfc3","subject":"ATTACK:enterprise:S1039","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b8113737-894f-42de-b607-9d4905fcdfc3","modified":"2026-04-29T14:23:06.176Z","references":[{"source_name":"Cybereason Bumblebee August 2022","url":"https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--b9165c4a-aac7-479d-8ad9-22c25e031a76","subject":"ATTACK:enterprise:G0027","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--b9165c4a-aac7-479d-8ad9-22c25e031a76","modified":"2026-07-31T18:48:29.572Z","references":[{"source_name":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c1b5ad09-6b1a-487e-bec1-af2326be5007","subject":"ATTACK:enterprise:S0531","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c1b5ad09-6b1a-487e-bec1-af2326be5007","modified":"2026-04-29T14:23:06.190Z","references":[{"source_name":"ESET Grandoreiro April 2020","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c2ae3362-b947-40e6-acce-3196480f26ec","subject":"ATTACK:enterprise:S0275","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c2ae3362-b947-40e6-acce-3196480f26ec","modified":"2026-04-29T14:23:06.191Z","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"},{"source_name":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c4734977-e231-46cd-91c8-ce4be580d543","subject":"ATTACK:enterprise:S0660","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c4734977-e231-46cd-91c8-ce4be580d543","modified":"2026-04-29T14:23:06.194Z","references":[{"source_name":"Talent-Jump Clambling February 2020","url":"https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"},{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c5a7cf46-a3ab-4d33-a43f-012c0c5fdf63","subject":"ATTACK:enterprise:S0140","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c5a7cf46-a3ab-4d33-a43f-012c0c5fdf63","modified":"2026-04-29T14:23:06.196Z","references":[{"source_name":"Palo Alto Shamoon Nov 2016","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c65da10e-8b5b-4290-87a4-cbc3120bf99c","subject":"ATTACK:enterprise:S0692","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c65da10e-8b5b-4290-87a4-cbc3120bf99c","modified":"2026-04-29T14:23:06.197Z","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c8de0953-1f20-47a4-bb02-ea9c30e8f932","subject":"ATTACK:enterprise:S0584","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c8de0953-1f20-47a4-bb02-ea9c30e8f932","modified":"2026-04-29T14:23:06.200Z","references":[{"source_name":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--c9412068-a35c-4be3-9945-a1f69f2f77db","subject":"ATTACK:enterprise:S0260","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--c9412068-a35c-4be3-9945-a1f69f2f77db","modified":"2026-04-29T14:23:06.200Z","references":[{"source_name":"ESET InvisiMole June 2018","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d11b6896-16e0-4c02-9c16-0880085010e8","subject":"ATTACK:enterprise:S0669","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d11b6896-16e0-4c02-9c16-0880085010e8","modified":"2026-04-29T14:23:06.211Z","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d13ebdb9-f3c4-4296-b3a5-ac44d29c5c3e","subject":"ATTACK:enterprise:S0633","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d13ebdb9-f3c4-4296-b3a5-ac44d29c5c3e","modified":"2026-04-29T14:23:06.212Z","references":[{"source_name":"Cybereason Sliver Undated","url":"https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d16d59aa-f056-4cc7-9f67-0e80db9cdacb","subject":"ATTACK:enterprise:G0040","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d16d59aa-f056-4cc7-9f67-0e80db9cdacb","modified":"2026-07-31T20:48:26.447Z","references":[{"source_name":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d6b31077-90cf-4279-9064-f83550834447","subject":"ATTACK:enterprise:S1149","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d6b31077-90cf-4279-9064-f83550834447","modified":"2026-04-29T14:23:06.219Z","references":[{"source_name":"Mandiant ROADSWEEP August 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d880af17-1184-4c4e-8550-665944d16a69","subject":"ATTACK:enterprise:S1130","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d880af17-1184-4c4e-8550-665944d16a69","modified":"2026-04-29T14:23:06.221Z","references":[{"source_name":"RedCanary RaspberryRobin 2022","url":"https://redcanary.com/blog/threat-intelligence/raspberry-robin/"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--d9e56665-26bb-49e2-99b4-6b4e7ccb38e3","subject":"ATTACK:enterprise:S1081","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--d9e56665-26bb-49e2-99b4-6b4e7ccb38e3","modified":"2026-04-29T14:23:06.223Z","references":[{"source_name":"BitDefender BADHATCH Mar 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--ecd83e69-2eb1-4c2d-a01f-e42ea8f807f9","subject":"ATTACK:enterprise:S0116","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--ecd83e69-2eb1-4c2d-a01f-e42ea8f807f9","modified":"2026-04-29T14:23:06.247Z","references":[{"source_name":"Github UACMe","url":"https://github.com/hfiref0x/UACME"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f47d71ca-61d7-46a3-ae63-d215b6bf8789","subject":"ATTACK:enterprise:S9007","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f47d71ca-61d7-46a3-ae63-d215b6bf8789","modified":"2026-04-29T14:23:06.257Z","references":[{"source_name":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--f8dbd7fd-5639-413f-92cd-4e3c4151384a","subject":"ATTACK:enterprise:G1051","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--f8dbd7fd-5639-413f-92cd-4e3c4151384a","modified":"2026-07-31T18:48:11.248Z","references":[{"source_name":"Intel471 Medusa Ransomware May 2025","url":"https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fb16dea3-7f32-4778-b6af-3126c4547d17","subject":"ATTACK:enterprise:S0363","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fb16dea3-7f32-4778-b6af-3126c4547d17","modified":"2026-04-29T14:23:06.266Z","references":[{"source_name":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fcc98412-8534-42d7-873a-6f8a26721e27","subject":"ATTACK:enterprise:S0662","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fcc98412-8534-42d7-873a-6f8a26721e27","modified":"2026-04-29T14:23:06.268Z","references":[{"source_name":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1},{"id":"enterprise:relationship--fdcda836-4a21-45d2-8269-31b82aa3c08e","subject":"ATTACK:enterprise:G0016","predicate":"uses","object":"ATTACK:enterprise:T1548.002","asserted_by":"MITRE ATT&CK","source_url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","snapshot":"enterprise-attack-20.0.json","evidence_locator":"relationship--fdcda836-4a21-45d2-8269-31b82aa3c08e","modified":"2026-07-31T18:48:09.466Z","references":[{"source_name":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}],"qualification":"Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.","source_occurrences":1}],"source_snapshot":{"file":"enterprise-attack-20.0.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/c2494b29dd268c46a5d0ea0990553e4327cd2253/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014,"checked_at":"2026-10-16T03:31:39Z"},"notices_url":"https://aol.pm/source-notices.txt","notices":"License\n-------\nThe MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research,\ndevelopment, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce\nMITRE's copyright designation and this license in any such copy.\n\n\"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.\"\n\nDisclaimers\n-----------\nMITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part\nof its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover\nfull categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or\nvariations on existing techniques not documented by ATT&CK.\n\nALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE\nORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS,\nAGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT\nTHE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR\nFITNESS FOR A PARTICULAR PURPOSE.\n"}