Exclusive Control

{
  "id": "ATTACK:enterprise:T1668",
  "title": "Exclusive Control",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1668",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--dff263cc-328e-42b4-afbc-1fee8b6a8913",
  "external_id": "T1668",
  "domain": "enterprise",
  "created": "2025-01-31T15:22:39.317Z",
  "modified": "2025-04-15T19:59:14.622Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "persistence"
  ],
  "source_references": [
    {
      "source_name": "aquasec-postgres-processes",
      "url": "https://www.aquasec.com/blog/pg_mem-a-malware-hidden-in-the-postgres-processes/"
    },
    {
      "source_name": "CERT AT Fortinent Ransomware 2025",
      "url": "https://www.cert.at/de/warnungen/2025/3/ransomware-gruppen-nutzen-weiterhin-kritische-fortinet-schwachstellen-warnung-vor-gepatchten-aber-bereits-kompromittierten-geraten"
    },
    {
      "source_name": "fsecure-netsky",
      "url": "https://www.f-secure.com/v-descs/netsky-h.shtml"
    },
    {
      "source_name": "sophos-multiple-attackers",
      "url": "https://news.sophos.com/en-us/2022/08/09/multiple-attackers-increase-pressure-on-victims-complicate-incident-response/#:~:text=While%20some%20threat%20actors%20are%20interdependent%20%28e.g.%2C%20IABs,vulnerabilities%20or%20disabling%20vulnerable%20services%20after%20gaining%20access"
    },
    {
      "source_name": "Mandiant-iab-control",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/initial-access-brokers-exploit-f5-screenconnect"
    }
  ]
}