Domains
Subtechnique · ATTACK:enterprise:T1584.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1584.001",
"title": "Domains",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1584/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--f9cc4d06-775f-4ee1-b401-4e2cc0da30ba",
"external_id": "T1584.001",
"domain": "enterprise",
"created": "2020-10-01T00:51:28.513Z",
"modified": "2026-05-12T15:12:00.726Z",
"version": "1.4",
"aliases": [
],
"tactics": [
"resource-development"
],
"source_references": [
{
"source_name": "Krebs DNS Hijack 2019",
"url": "https://krebsonsecurity.com/2019/02/a-deep-dive-on-the-recent-widespread-dns-hijacking-attacks/"
},
{
"source_name": "ICANNDomainNameHijacking",
"url": "https://www.icann.org/en/ssac/registration-services/documents/sac-007-domain-name-hijacking-incidents-threats-risks-and-remediation-12-07-2005-en"
},
{
"source_name": "Palo Alto Unit 42 Domain Shadowing 2022",
"url": "https://unit42.paloaltonetworks.com/domain-shadowing/"
},
{
"source_name": "Microsoft Sub Takeover 2020",
"url": "https://docs.microsoft.com/en-us/azure/security/fundamentals/subdomain-takeover"
}
]
}Explicit source assertions (14)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--134cc6c4-30f8-4b85-8ea1-da19c3e92af9
Google Iran Threats October 2021 · Certfa Charming Kitten January 2021 · ClearSky Kittens Back 3 August 2020 · Proofpoint TA453 July2021ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--171a96b6-1680-408b-b90d-356b393a3dea
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2389113c-9a72-4633-aa52-8f77c3df564a
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--242f96c4-460f-49e6-80a9-79ea85348c2d
ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a27a98e-ee19-49f3-96e4-a5c9ee6e65ed
Proofpoint Operation Transparent Tribe March 2016ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c095f1e-211d-4e84-b521-9cef12f1e83f
McAfee Lazarus Nov 2020 · McAfee Lazarus Jul 2020ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d5baa1d-8a54-4ce2-a983-3fd68e173cb4
SentinelOne Gootloader June 2021ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--378fcd18-9928-419c-b5c6-8fd1397bb425
ESET DynoWiper Update JAN 2026ATTACK:enterprise:C0021 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44e0a8c6-ccb4-4d4e-bcf0-0709f10dec51
Microsoft Unidentified Dec 2018ATTACK:enterprise:C0010 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57e9b366-fac5-4320-bb76-da81953de2dc
Mandiant UNC3890 Aug 2022ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63bce642-8e12-44c1-a805-e7390aef23e7
SocGholish-update · SentinelOne SocGholish Infrastructure November 2022 · Red Canary SocGholish March 2024 · Secureworks Gold Prelude ProfileATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--976a08e5-40b0-4b9f-a453-a1d0b33c3080
KISA Operation Muzabi · Mandiant APT43 March 2024ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1584.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1c2c530-a2d2-4c2f-bcff-ceda0277de59
Mandiant APT1ATTACK:enterprise:T1584.001 → subtechnique-of → ATTACK:enterprise:T1584
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d061e030-6ad7-457d-a909-5ca6f7282762