Skip to content

Service Execution

Subtechnique · ATTACK:enterprise:T1569.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1569.002",
  "title": "Service Execution",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1569/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f1951e8a-500e-4a26-8803-76d95c4554b4",
  "external_id": "T1569.002",
  "domain": "enterprise",
  "created": "2020-03-10T18:33:36.159Z",
  "modified": "2026-09-11T19:43:47.298Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Microsoft Service Control Manager",
      "url": "https://docs.microsoft.com/windows/win32/services/service-control-manager"
    },
    {
      "source_name": "Russinovich Sysinternals",
      "url": "https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx"
    }
  ]
}

Explicit source assertions (78)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00822c6a-a881-4678-8d74-6a52b2ca27c9

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08a0175a-eb34-4ed2-a9ca-d458da65326a

Trellix Darkgate 2023

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10625b4c-7ecc-49a0-b8e3-c9f2d8cba2da

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--155a8883-7b22-4fa8-8d2f-bd76c8efd5b3

Cobalt Strike TTPs Dec 2017 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--177888f1-a326-4642-98c3-66aa91ef18dd

Cyfirma_Vidar_June2024

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b92df4d-d064-4615-b27d-cf4d53ecc97b

ESET InvisiMole June 2020

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c0e8084-c8a5-4c8d-bac1-bfb7eb07b586

Symantec Hydraq Persistence Jan 2010

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21c271aa-7bdd-44ea-afd0-ca3f542ee425

Palo Alto Brute Ratel July 2022

ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--235a7fee-dfe1-4812-b553-e88bc9d56e89

Talos Nyetya June 2017 · US-CERT NotPetya 2017

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23f36f2f-9bc4-4c95-a75b-65e5c74aed88

NCC Group Chimera January 2021

ATTACK:enterprise:S0166 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--292248d9-30b0-4de3-9041-407db4e78f78

Symantec Buckeye

ATTACK:enterprise:S0698 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29c9b21f-7ea0-48f0-bd90-978d4f37813f

ESET Hermetic Wizard March 2022

ATTACK:enterprise:S0668 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ebf0505-4b0a-4e17-b303-b860585f7c11

Talos TinyTurla September 2021

ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--341ef3b2-3f92-4ea1-b36f-93fdb1d15816

ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--347de212-26bf-4ad4-963f-c4dfa3c821d1

Sophos Ragnar May 2020

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--364be248-6fa2-42a2-847b-35e6f43fd06d

BitDefender Chafer May 2020 · Symantec Chafer February 2018

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37b7ba1e-5093-4a0d-920b-c86d3c9c766b

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--395cee0e-ee8b-4e90-b2a7-f3a271ef0b1a

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d6d167f-6a45-4e4f-8576-6f7713444acd

Joint Cybersecurity Advisory LockBit JUN 2023

ATTACK:enterprise:S0123 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f416bd3-a06f-4ec2-8cf6-4a84e0611c63

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--421f569c-e961-4112-a527-1aa5cabd37a1

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d7faa7b-2fd2-4c40-89c2-e8171055733c

FoxIT Wocao December 2019

ATTACK:enterprise:S0191 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5765c7d1-884f-4d6d-a938-4a92c86a9e21

Secpod Winexe June 2017

ATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59b39f06-a71c-42f7-92f2-244a183113d6

Palo Alto Networks BBSRAT

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c0b2098-6f0d-4c99-ac9d-bb3ea4ca9d52

Trend Micro DRBControl February 2020

ATTACK:enterprise:S0238 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d6984fc-52cb-429b-9e68-64e656d9ad30

McAfee GhostSecret

ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fc0ca38-bb65-43ab-b8b2-6861442b25a8

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--606d0114-e9a5-49a6-a6b9-0f67da987969

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--619998d9-cbe8-40b1-ad0e-bc47f9c8037a

BlackBerry_FIN7_April2024

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6397d645-207c-4d1b-9a65-5f1b69a84e7c

Gh0stRAT ATT March 2019

ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bbb4292-0496-412d-8277-af752703c46a

Huntress INC Ransom Group August 2023

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c1da156-9a34-4aa4-a57a-b376edb8707e

Sygnia VelvetAnt 2024A

ATTACK:enterprise:T1569.002 → subtechnique-of → ATTACK:enterprise:T1569

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d137f11-8f05-45e8-960c-d64bc14167be

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e1e5bab-151b-4be9-9c96-5cb4c66ff540

ATTACK:enterprise:S0398 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--737788fa-f921-4147-9148-c39228f76e85

Unit42 Emissary Panda May 2019

ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73a53379-746e-46db-b101-1fc45df5e458

Palo Alto Shamoon Nov 2016 · McAfee Shamoon December19 2018

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7447ce8c-6c1a-497e-86d5-1adf960e23a3

Github PowerShell Empire

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83140b4e-03aa-4f6f-ad80-d1080ffafae4

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8483ad9a-84c9-4c83-a4d7-d403e44735dc

ESET Okrum July 2019

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84dc2fd1-a443-4ce6-866a-c58cffc1b0f3

FireEye APT41 March 2020 · Group IB APT 41 June 2021

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--84fd38cb-2310-4cac-abdd-6418223bc51c

MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85be49ac-785e-48af-8d0e-4b74818428fc

SecureList Silence Nov 2017 · Group IB Silence Sept 2018

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8bfa94cf-4eeb-442c-8f18-25b07cd3cbf5

NCC Group APT15 Alive and Strong

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c0f1ff3-4188-423d-ae8c-19f799a9fb73

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Broadcom Medusa Ransomware Medusa Group March 2025

ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8dc7e200-3c90-4611-9bbe-aa90056f423e

RedCanary Mockingbird May 2020

ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8eed7d01-46dc-4b25-a42d-bd9afcb84963

US-CERT HOPLIGHT Apr 2019

ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90febb12-39b4-4138-99da-93f1e987ac2a

Unit 42 WhisperGate January 2022 · Medium S2W WhisperGate January 2022

ATTACK:enterprise:S0176 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91ca1017-0b33-4fa1-a61f-b3dae24c7e40

Microsoft SIR Vol 21 · Microsoft Wingbird Nov 2017

ATTACK:enterprise:S1134 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--927a3c20-7d5c-42ac-97c8-e3546a11c411

SentinelOne Agrius 2021

ATTACK:enterprise:S0056 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9453d60b-4f3f-494f-985d-e29094ef8945

Cylance Cleaver

ATTACK:enterprise:S0451 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94824fdd-25fa-4d23-9220-825f04c4bcc6

ESET LoudMiner June 2019

ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96417d00-2a6b-4a22-b43c-f65cb60da952

CERT-FR PYSA April 2020

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--968911f0-2158-4c76-9fab-562a00ecc418

McAfee Honeybee

ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9aebe474-f443-4007-bb8d-dc7c9f22d5f9

Novetta Winnti April 2015

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a491cb90-9480-450b-9a57-55b95b249d31

ESET OceanLotus Mar 2019

ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a55e0219-f440-4523-9bfa-00c562824005

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0029 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a66aff09-0635-44a3-b591-a530a25c9012

Russinovich Sysinternals

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7aa8345-4b70-43aa-924c-bb7d1caf2c7f

Cisco BlackByte 2024 · Symantec BlackByte 2022

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aaa2f519-62f6-4dcb-8193-6ed33b8ff4ab

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b106e9ad-dbde-43c7-a38d-da5c87e1da05

FireEye FIN6 Apr 2019

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c05978ea-b814-473e-a073-9bae9ab7695b

ESET Attor Oct 2019

ATTACK:enterprise:S1132 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c24808aa-a503-459a-b867-a44b55fbd6bf

SentinelOne Agrius 2021

ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2d27932-5a39-46ed-ab21-c1b2f02dee15

Google Cloud APT41 2024

ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c992481b-fe93-416d-b8a3-c5ed752c17f4

Talos Olympic Destroyer 2018

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ceadf11d-d89c-4ec6-a7a2-fe842570bb4c

NCC Group WastedLocker June 2020

ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfc5761e-2c94-420a-a985-a4a1d7fe0b7c

Microsoft Moonstone Sleet 2024

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d107e5fd-53fc-478d-9040-85087070d7ff

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5e069df-6933-417e-b62d-6c8701438382

Microsoft SharePoint Exploit JUL 2025

ATTACK:enterprise:S1181 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db7a1676-ec8d-41af-a392-2ee2e0b4d31d

Microsoft BlackByte 2023

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db85221a-3d34-4e8d-bcb1-95b507617b84

Qualys Hermetic Wiper March 2022 · SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dda9f6bb-eb66-422b-aa58-fede809b6a6a

Sophos Netwalker May 2020

ATTACK:enterprise:S1247 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e63477f0-9081-4633-a375-8cb72320f4ad

ESET Embargo Ransomware October 2024

ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7b10c00-0860-4592-a72c-e14e993e972b

Talos Promethium June 2020 · Bitdefender StrongPity June 2020

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7fd3986-ae47-4301-9299-a3f8be437d03

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed40dd97-0ad0-4501-8f1e-a4bd4625432d

Talos ZxShell Oct 2014

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--efaecf33-d565-40fa-baf5-976138f6c883

CISA AA20-239A BeagleBoyz August 2020 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3b210e4-9784-4305-8cad-6bdb4d44250f

Mandiant FIN12 Oct 2021 · DFIR Ryuk in 5 Hours October 2020 · DFIR Ryuk's Return October 2020

ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f71de781-3899-46ad-9c57-a63f683afab2

Cyberreason Anchor December 2019 · Medium Anchor DNS July 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.