Server
Subtechnique · ATTACK:enterprise:T1584.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1584.004",
"title": "Server",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1584/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--e196b5c5-8118-4a1c-ab8a-936586ce3db5",
"external_id": "T1584.004",
"domain": "enterprise",
"created": "2020-10-01T00:56:25.135Z",
"modified": "2026-09-18T00:31:18.340Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"resource-development"
],
"source_references": [
{
"source_name": "TrendMicro EarthLusca 2022",
"url": "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"
},
{
"source_name": "Koczwara Beacon Hunting Sep 2021",
"url": "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2"
},
{
"source_name": "Mandiant SCANdalous Jul 2020",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/"
},
{
"source_name": "ThreatConnect Infrastructure Dec 2020",
"url": "https://web.archive.org/web/20221130114004/https://threatconnect.com/blog/infrastructure-research-hunting/"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0dcce53a-3ac1-4528-8c34-f85569638740
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12948e09-2774-4b91-b9d1-018b41f7f923
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19264fec-8c72-470f-9a7f-6c135718fde7
ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20aaed95-65ce-4a0f-9e25-4a4156889a84
Gigamon Berserk Bear October 2021ATTACK:enterprise:C0013 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26bac510-efd4-499c-8272-3cf186d3b4e3
Bleeping Computer Op Sharpshooter March 2019ATTACK:enterprise:C0042 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c5c7ef8-b900-43b0-a6ca-b3027ac50c9e
ESET OilRig Campaigns Sep 2023ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65eac98e-82b8-4592-a121-bea99f80dc87
Accenture HyperStack October 2020 · Talos TinyTurla September 2021 · Recorded Future Turla Infra 2020ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8191e3f4-df01-42c0-925b-0038772afb17
CISA Leviathan 2024ATTACK:enterprise:G0023 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--82bfe762-9468-458e-801a-13387a271521
FireEye EPS Awakens Part 2ATTACK:enterprise:T1584.004 → subtechnique-of → ATTACK:enterprise:T1584
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--976ffdd9-bc86-4bc6-80a0-736705f049f9
ATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3c7c24f-c630-4a0e-a095-8918a7092547
Anthropic AI Orchestrated Campaign NOV 2025ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--adc994b3-b5cb-4005-882f-a5116d6e40d5
Leonard TAG 2023 · NSA Sandworm 2020ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c75e753a-881a-40db-99d2-f7a7b2183606
ESET EvasivePanda 2024ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd49448e-10e3-4138-916b-1f3ba0727104
McAfee Night DragonATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5c80a6c-8bbe-449d-80fb-8c5d7035d25d
ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f7d3d7fc-e25f-4b1f-b7ea-7c19adb300bd
Crowdstrike Indrik November 2018ATTACK:enterprise:C0044 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8f41001-9fc7-4a19-99e8-2b915abccf52
ESET OilRig Campaigns Sep 2023ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1584.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff6f4b5b-1b5f-4f8f-9307-345a3c278151
TrendMicro EarthLusca 2022