Skip to content

Disable or Modify Tools

Technique · ATTACK:enterprise:T1685

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1685",
  "title": "Disable or Modify Tools",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1685",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--bbde9781-60aa-4b8a-a911-895b0c1b3872",
  "external_id": "T1685",
  "domain": "enterprise",
  "created": "2026-04-14T22:53:26.949Z",
  "modified": "2026-09-11T19:52:16.657Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "defense-impairment"
  ],
  "source_references": [
    {
      "source_name": "Cocomazzi FIN7 Reboot",
      "url": "https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/"
    },
    {
      "source_name": "Microsoft Lamin Sept 2017",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=Backdoor:Win32/Lamin.A"
    },
    {
      "source_name": "ETW Palantir",
      "url": "https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63"
    },
    {
      "source_name": "SCADAfence_ransomware",
      "url": "https://cdn.logic-control.com/docs/scadafence/Anatomy-Of-A-Targeted-Ransomware-Attack-WP.pdf"
    }
  ]
}

Explicit source assertions (145)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:T1685.002 → subtechnique-of → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01691c6e-9432-4297-8dab-632bf5ee87bc

ATTACK:enterprise:S0669 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--018f9809-0d5b-4a83-a712-2d605db13c59

MalwareBytes LazyScripter Feb 2021

ATTACK:enterprise:S1234 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--021e01e6-7694-48f2-b35f-5862178bc05c

Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

ATTACK:enterprise:C0055 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04d2c81c-1140-4eea-8383-d835c80df3bf

Sekoia 7777 Botnet JUL 2024 · Bitsight 7777 Botnet · Microsoft Storm-0940

ATTACK:enterprise:S1048 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--060fbd8f-3413-4bae-8a59-fe8de8bb1fb7

SentinelLabs reversing run-only applescripts 2021

ATTACK:enterprise:S0576 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--064b2c99-1f7c-43d5-ab3e-892e598e2cac

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07aa4a45-85f6-4ec6-b079-389d29c44108

Mandiant UNC3944 May 2025

ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08ced821-8f14-4c59-ba35-d5d836b3f7b8

Microsoft PLATINUM April 2016

ATTACK:enterprise:T1685.007 → subtechnique-of → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09bb5f5e-59bf-434d-aa49-8ad3ad94916e

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a6e9719-3f53-4d8e-b540-89cff763e361

Talos Kimsuky Nov 2021 · Securelist Kimsuky Sept 2013

ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ae676ca-eb9c-4e3e-b577-22f63b42b7ca

Sogeti CERT ESEC Babuk March 2021

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ae86b10-69a4-4e9d-9b31-403dc08be50f

HP RaspberryRobin 2024

ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b926b38-f00a-4ea2-a64b-8b4c05851629

Unit 42 Gorgon Group Aug 2018

ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e44aa81-e454-4274-9fba-07fe3d3e3a0c

SentinelOne Hermetic Wiper February 2022 · Crowdstrike DriveSlayer February 2022 · Qualys Hermetic Wiper March 2022

ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fef4426-7e24-4ea7-81cf-6b1454f17120

Sophos Ragnar May 2020

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15ade855-78be-4131-bf28-349573613447

FireEye FIN6 Apr 2019

ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15d6b855-c6c5-404b-8ab1-8dd5687784a0

Cisco Ukraine Wipers January 2022 · Unit 42 WhisperGate January 2022 · Medium S2W WhisperGate January 2022

ATTACK:enterprise:S0457 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17a88462-297f-415c-b993-eaac0d4f91e3

TrendMicro Netwalker May 2020 · Sophos Netwalker May 2020

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b61a1d1-c1e1-4fce-a84c-c1bccbf101fc

Check Point Warzone Feb 2020

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b61ec0f-6c86-4d0c-ae02-7b2fb32754a7

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b68d2aa-a5b2-4d6b-b063-3609ce13e810

Netskope XLoader 2022 · Zscaler XLoader 2025

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ccfc450-d4a7-464d-aa95-f2dddf2f9652

JPCERT MirrorFace JUL 2024

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1eb7d0a2-784b-44e8-a1dd-2c444b67bf29

Splunk RedLine Stealer June 2023

ATTACK:enterprise:S0249 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f0d3fa4-7ed4-4487-be95-2c6af1e271ea

McAfee Gold Dragon

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--217968e0-0c70-4f57-a2e6-5add0bc51a11

Mandiant Cutting Edge Part 2 January 2024 · Volexity Ivanti Zero-Day Exploitation January 2024

ATTACK:enterprise:S0253 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2471f5b2-7d7a-4df3-99d0-18e05aec0f4d

McAfee Gold Dragon

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25fca6d7-bea3-4987-a7cb-65739b2c4850

Unit42 Agrius 2023

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--271c15bb-8c7b-4d5b-8621-237eb04886ec

Ensilo Darkgate 2018

ATTACK:enterprise:C0028 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--273e10a7-c598-4e06-be21-a8ec7537eeb6

Booz Allen Hamilton

ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2963d541-8e6b-4376-a165-876145293a7e

Lumen KVBotnet 2023

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a864dfa-14df-4e58-98a6-62cbc14b52f9

Group IB Ransomware September 2020

ATTACK:enterprise:S9039 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d480202-6883-4c91-b734-767370a6d121

ATTACK:enterprise:S0004 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f132e5d-680c-4394-b4c7-c808cc3aadf6

Cylance Cleaver

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36f687d3-8052-4009-836d-8b796a1fcf71

Palo Alto Lockbit 2.0 JUN 2022 · FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37915015-f4c2-48be-9a98-e846c37baedc

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:S0228 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38bde25a-6e15-4c7a-91e6-4758d113049b

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38e9a261-d427-4c06-999f-8679795556ef

Proofpoint TA2541 February 2022

ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c1b9608-a67a-4db6-adbc-ea24cca581ba

Zscaler PureCrypter JUN 2022

ATTACK:enterprise:T1685.001 → subtechnique-of → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ec211cb-7fbc-4d41-ad56-f599dee5f190

ATTACK:enterprise:S0468 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ee9c6bb-90c4-476d-b516-020113a65c62

Trend Micro Skidmap

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--417d46c4-2fed-4722-81dd-5f936787d2db

Picus BlackByte 2022 · Cisco BlackByte 2024 · FBI BlackByte 2022

ATTACK:enterprise:S1206 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41bf2d1e-85e1-47a0-82ac-11deda6927e3

Cisco Salt Typhoon FEB 2025

ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4321e96d-8a92-498c-9b7a-b134cd8cb7a9

Socket Shai-Hulud November 2025

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47bef4ea-597e-4827-b55f-c189aa67c928

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0130 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a0eb081-8a12-4ae3-a1f5-b45b39ac56b6

Forcepoint Monsoon

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ad6ce8b-4554-4b4f-b6d7-a049d2f83155

Fortinet Diavol July 2021

ATTACK:enterprise:S0252 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4adc5d0c-a757-4cce-afbc-c0a08bd6aecf

McAfee Gold Dragon

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b564cd9-d1c8-4f9d-b922-b6a651497edc

CodeX Microsoft Defender 2021

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cc1fe6e-b097-4e81-b0c3-aee729ec9600

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d6e2596-a7ed-49af-b24b-dca2ddbb6ef2

Mandiant_UNC2165 · Symantec WastedLocker June 2020

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e7b9e53-2cd3-47c0-b08a-b5ed52a20df7

Socket HexEval BeaverTail Contagious Interview June 2025

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f313b03-22ae-4789-aef2-12121e9f717d

ATTACK:enterprise:S0640 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50a17d24-155e-4036-8a58-a8c376f36c05

Arxiv Avaddon Feb 2021

ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--568ce97a-d845-41a3-828a-49b372fa46d6

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57e05fbc-ffbc-4110-a58f-02c5e8813b14

ATTACK:enterprise:G1031 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59af5f32-5099-48cd-bf84-73ab69ef052d

Palo Alto Unit 42 OutSteel SaintBot February 2022

ATTACK:enterprise:G0024 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5adb2d01-8616-4413-8a3f-7cb4d2749284

CrowdStrike Putter Panda

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5baaca5c-6f5b-4cbf-9bef-2f6625ec9e3f

Joint Cybersecurity Advisory LockBit JUN 2023 · Joint Cybersecurity Advisory LockBit 3.0 MAR 2023 · INCIBE-CERT LockBit MAR 2024

ATTACK:enterprise:S0336 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5cd2bb27-c043-455f-b67f-88ec4bbe2d93

DigiTrust NanoCore Jan 2017 · PaloAlto NanoCore Feb 2016

ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d0accb1-8889-4d96-9eb2-0258548c5b23

CERT-FR PYSA April 2020

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60827b66-e9a2-4da6-b589-492d3f7eebcd

wardle evilquest parti

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61a16f5b-29c2-4d75-bf4f-36228fe68016

DHS/CISA Ransomware Targeting Healthcare October 2020 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021 · DFIR Ryuk's Return October 2020

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--644bf221-89ce-48b8-abe9-eaadf1ee8ff4

Rostovcev APT41 2021

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6471e2c1-621f-4393-a63f-c6cfbacc592e

Trend Micro Tick November 2019

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64ee123b-bf6f-440f-a34e-6f20838b6f30

FireEye SUNBURST Additional Details Dec 2020

ATTACK:enterprise:S0688 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6941840a-027f-48af-a589-6ba29cddadfb

Check Point Meteor Aug 2021

ATTACK:enterprise:S0434 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b7468ec-604a-48fb-b5d0-c96c47714a8c

Imminent Unit42 Dec2019

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d81dacd-8f87-4426-9d04-6bf548420bb0

Cylance Sodinokibi July 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e067a3e-21a7-4a68-ac82-60b7ea325a5d

ESET Turla PowerShell May 2019

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f08abbe-2b04-482f-98ec-ae9382ba3084

Novetta Blockbuster Loaders · Novetta Blockbuster Tools · Novetta Blockbuster · US-CERT SHARPKNOT June 2018

ATTACK:enterprise:S0477 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fed282b-09d5-4ec6-ac3b-356329c9ad6a

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:T1685.006 → subtechnique-of → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72ffe99f-3b8e-4681-a553-f9fccd47404d

ATTACK:enterprise:S0279 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73b90d32-5377-4654-b65e-390b1184350d

objsee mac malware 2017

ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73f9e48f-a39c-4213-aaf3-86b2e8bf890a

MacKeeper Bundlore Apr 2019 · 20 macOS Common Tools and Techniques

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74474695-0959-42a8-8352-e70486d066f4

Netskope LummaStealer 2025

ATTACK:enterprise:T1685.005 → subtechnique-of → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--760c9e3c-6074-442a-bf16-39e0fa82919b

ATTACK:enterprise:S0372 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76a951cd-cb2c-485a-9596-b0df6302ba41

Wired Lockergoga 2019

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--778d26cc-c730-4329-aa66-8c7e83610e99

Trend Micro Muddy Water March 2021

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7da2fa27-ae11-4955-9dff-b2e2d24d6548

ESET Gamaredon June 2020 · ESET Gamaredon Sept2024

ATTACK:enterprise:S1169 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--808fd295-d2d2-4284-bcc8-789221e18723

ESET OilRig Campaigns Sep 2023

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.