2017-08-16 12:17:00 +02:00
{
2017-10-26 10:28:53 +02:00
"authors" : [
"MITRE"
] ,
2018-10-19 10:23:09 +02:00
"category" : "tool" ,
2017-10-26 10:28:53 +02:00
"description" : "Name of ATT&CK software" ,
2018-08-13 17:06:29 +02:00
"name" : "Tool" ,
2017-10-26 10:28:53 +02:00
"source" : "https://github.com/mitre/cti" ,
2018-08-13 17:06:29 +02:00
"type" : "mitre-tool" ,
"uuid" : "d700dc5c-78f6-11e7-a476-5f748c8e4fe0" ,
2017-10-26 10:28:53 +02:00
"values" : [
{
2018-12-09 09:16:03 +01:00
"description" : "[Windows Credential Editor](https://attack.mitre.org/software/S0005) is a password dumping tool. (Citation: Amplia WCE)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0005" ,
"mitre_platforms" : [
"Windows"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0005" ,
2017-10-26 10:28:53 +02:00
"http://www.ampliasecurity.com/research/wcefaq.html"
] ,
"synonyms" : [
"Windows Credential Editor" ,
"WCE"
2018-12-09 09:16:03 +01:00
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "65f2d882-3f41-4d48-8a06-29af77ec9f90" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "242f3da3-4425-4d11-8f5c-b842886da966" ,
"value" : "Windows Credential Editor - S0005"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[Pass-The-Hash Toolkit](https://attack.mitre.org/software/S0122) is a toolkit that allows an adversary to \"pass\" a password hash (without knowing the original password) to log in to systems. (Citation: Mandiant APT1)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0122" ,
"mitre_platforms" : [
"Linux" ,
"Windows" ,
"macOS"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0122" ,
2018-12-09 08:32:48 +01:00
"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
2017-10-26 10:28:53 +02:00
] ,
2018-12-09 09:16:03 +01:00
"synonyms" : [
"Pass-The-Hash Toolkit"
]
2018-12-09 08:32:48 +01:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "e624264c-033a-424d-9fd7-fc9c3bbdb03e" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "a52edc76-328d-4596-85e7-d56ef5a9eb69" ,
"value" : "Pass-The-Hash Toolkit - S0122"
2018-12-09 08:32:48 +01:00
} ,
2021-04-29 18:12:36 +02:00
{
"description" : "[CSPY Downloader](https://attack.mitre.org/software/S0527) is a tool designed to evade analysis and download additional payloads used by [Kimsuky](https://attack.mitre.org/groups/G0094).(Citation: Cybereason Kimsuky November 2020)" ,
"meta" : {
"external_id" : "S0527" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0527" ,
"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"
] ,
"synonyms" : [
"CSPY Downloader"
]
} ,
"related" : [
{
"dest-uuid" : "005a06c6-14bf-4118-afa0-ebcd8aebb0c9" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "120d5519-3098-4e1c-9191-2aa61232f073" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "df8b2a25-8bdf-4856-953c-a04372b1c161" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "29be378d-262d-4e99-b00d-852d573628e6" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "32901740-b42c-4fdd-bc02-345b5dc57082" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "deb98323-e13f-4b0c-8d94-175379069062" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "232b7f21-adf9-4b42-b936-b9d6f7df856e" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "d63a3fb8-9452-4e9d-a60a-54be68d5998c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "57340c81-c025-4189-8fa0-fc7ede51bae4" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "799ace7f-e227-4411-baa0-8868704f2a69" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "5256c0f8-9108-4c92-8b09-482dfacdcd94" ,
"value" : "CSPY Downloader - S0527"
} ,
2020-10-18 20:00:48 +02:00
{
"description" : "[Imminent Monitor](https://attack.mitre.org/software/S0434) was a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an operation was conducted to take down the Imminent Monitor infrastructure. Various cracked versions and variations of this RAT are still in circulation.(Citation: Imminent Unit42 Dec2019)" ,
"meta" : {
"external_id" : "S0434" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0434" ,
"https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/"
] ,
"synonyms" : [
"Imminent Monitor"
]
} ,
"related" : [
{
"dest-uuid" : "09a60ea3-a8d1-4ae5-976e-5783248b72a4" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "ec8fc7e2-b356-455c-8db5-2e37be158e7d" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7bc57495-ea59-4380-be31-a64af124ef18" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "eb062747-2193-45de-8fa2-e62549c37ddf" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "cd25c1b4-935c-4f0e-ba8d-552f28bc4783" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "8f4a33ec-8b1f-4b80-a2f6-642b2e479580" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "6faf650d-bf31-4eb4-802d-1000cf38efaf" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1035cdf2-3e5f-446f-a7a7-e8f6d7925967" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "92d7da27-2d91-488e-a00c-059dc162766d" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "ac08589e-ee59-4935-8667-d845e38fe579" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "391d824f-0ef1-47a0-b0ee-c59a75e27670" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "d63a3fb8-9452-4e9d-a60a-54be68d5998c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7385dfaf-6886-4229-9ecd-6fd678040830" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3ccef7ae-cb5e-48f6-8302-897105fbf55c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "58a3e6aa-4453-4cc8-a51f-4befe80b31a8" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "8f8cd191-902c-4e83-bf20-b57c8c4640e9" ,
"value" : "Imminent Monitor - S0434"
} ,
2017-10-26 10:28:53 +02:00
{
2018-12-09 09:16:03 +01:00
"description" : "[Invoke-PSImage](https://attack.mitre.org/software/S0231) takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a one liner for executing either from a file of from the web. Example of usage is embedding the PowerShell code from the Invoke-Mimikatz module and embed it into an image file. By calling the image file from a macro for example, the macro will download the picture and execute the PowerShell code, which in this case will dump the passwords. (Citation: GitHub Invoke-PSImage)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0231" ,
"mitre_platforms" : [
"Windows"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0231" ,
"https://github.com/peewpw/Invoke-PSImage"
2017-10-26 10:28:53 +02:00
] ,
2018-12-09 09:16:03 +01:00
"synonyms" : [
"Invoke-PSImage"
]
2017-10-26 10:28:53 +02:00
} ,
2018-10-12 11:00:00 +02:00
"related" : [
{
2018-12-09 09:16:03 +01:00
"dest-uuid" : "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" ,
2018-10-12 11:00:00 +02:00
"tags" : [
2018-12-09 09:16:03 +01:00
"estimative-language:likelihood-probability=\"almost-certain\""
2018-10-12 11:00:00 +02:00
] ,
2018-12-09 09:16:03 +01:00
"type" : "uses"
2018-10-12 11:00:00 +02:00
}
] ,
2018-12-09 09:16:03 +01:00
"uuid" : "b52d6583-14a2-4ddc-8527-87fd2142558f" ,
"value" : "Invoke-PSImage - S0231"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[ipconfig](https://attack.mitre.org/software/S0100) is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration. (Citation: TechNet Ipconfig)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0100" ,
"mitre_platforms" : [
"Windows"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0100" ,
"https://technet.microsoft.com/en-us/library/bb490921.aspx"
2017-10-26 10:28:53 +02:00
] ,
2018-12-09 08:32:48 +01:00
"synonyms" : [
2018-12-09 09:16:03 +01:00
"ipconfig" ,
"ipconfig.exe"
]
2017-10-26 10:28:53 +02:00
} ,
2018-08-14 09:32:24 +02:00
"related" : [
{
2018-12-09 09:16:03 +01:00
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
2018-08-14 09:32:24 +02:00
"tags" : [
2018-12-09 09:16:03 +01:00
"estimative-language:likelihood-probability=\"almost-certain\""
2018-08-14 09:32:24 +02:00
] ,
2018-12-09 09:16:03 +01:00
"type" : "uses"
2018-08-14 09:32:24 +02:00
}
] ,
2018-12-09 09:16:03 +01:00
"uuid" : "294e2560-bd48-44b2-9da2-833b5588ad11" ,
"value" : "ipconfig - S0100"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. (Citation: Deply Mimikatz) (Citation: Adsecurity Mimikatz Guide)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0002" ,
"mitre_platforms" : [
"Windows"
2017-10-26 10:28:53 +02:00
] ,
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0002" ,
"https://github.com/gentilkiwi/mimikatz" ,
"https://adsecurity.org/?page_id=1821"
2017-10-26 10:28:53 +02:00
] ,
2018-12-09 09:16:03 +01:00
"synonyms" : [
"Mimikatz"
]
2017-10-26 10:28:53 +02:00
} ,
2018-10-12 11:00:00 +02:00
"related" : [
{
2018-12-09 09:16:03 +01:00
"dest-uuid" : "7f3a035d-d83a-45b8-8111-412aa8ade802" ,
2018-10-12 11:00:00 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"likely\""
] ,
"type" : "similar"
2018-12-09 09:16:03 +01:00
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "5095a853-299c-4876-abd7-ac0050fb5462" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "b7dc639b-24cd-482d-a7f1-8897eda21023" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "e624264c-033a-424d-9fd7-fc9c3bbdb03e" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "564998d8-ab3e-4123-93fb-eccaa6b9714a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "60b508a1-6a5e-46b1-821a-9f7b78752abf" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "7b211ac6-c815-4189-93a9-ab415deca926" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "a10641f4-87b4-45a3-a906-92a149cb2c27" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "65f2d882-3f41-4d48-8a06-29af77ec9f90" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "d273434a-448e-4598-8e14-607f4a0d5e27" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "768dce68-8d0d-477a-b01d-0eea98b963a1" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "58a3e6aa-4453-4cc8-a51f-4befe80b31a8" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3fc9b85a-2862-4363-a64d-d692e3ffbee0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "f303a39a-6255-4b89-aecc-18c4d8ca7163" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1644e709-12d2-41e5-a60f-3470991f5011" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2019-10-27 21:06:26 +01:00
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "1ecfdab8-7d59-4c98-95d4-dc41970f57fc" ,
2019-10-27 21:06:26 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2021-04-29 18:12:36 +02:00
} ,
{
"dest-uuid" : "d336b553-5da9-46ca-98a8-0b23f49fb447" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-10-12 11:00:00 +02:00
}
] ,
2018-12-09 09:16:03 +01:00
"uuid" : "afc079f3-c0ea-4096-b75d-3f05338b7f60" ,
"value" : "Mimikatz - S0002"
2017-10-26 10:28:53 +02:00
} ,
{
2019-04-30 19:07:57 +02:00
"description" : "[HTRAN](https://attack.mitre.org/software/S0040) is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their location when interacting with the victim networks. (Citation: Operation Quantum Entanglement)(Citation: NCSC Joint Report Public Tools)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0040" ,
"mitre_platforms" : [
"Linux" ,
"Windows"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0040" ,
2019-04-30 19:07:57 +02:00
"https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf" ,
2021-04-29 18:12:36 +02:00
"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"
2017-10-26 10:28:53 +02:00
] ,
"synonyms" : [
2018-12-09 09:16:03 +01:00
"HTRAN" ,
"HUC Packet Transmit Tool"
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
"dest-uuid" : "3fb18a77-91ef-4c68-a9a9-fa6bdbea38e8" ,
"tags" : [
"estimative-language:likelihood-probability=\"likely\""
] ,
"type" : "similar"
} ,
{
"dest-uuid" : "731f4f55-b6d0-41d1-a7a9-072a66389aea" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2019-04-30 19:07:57 +02:00
} ,
{
"dest-uuid" : "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-12-09 09:16:03 +01:00
}
] ,
"uuid" : "d5e96a35-7b0b-4c6a-9533-d63ecbda563e" ,
"value" : "HTRAN - S0040"
2017-10-26 10:28:53 +02:00
} ,
2020-11-25 07:45:48 +01:00
{
"description" : "[MCMD](https://attack.mitre.org/software/S0500) is a remote access tool that provides remote command shell capability used by [Dragonfly 2.0](https://attack.mitre.org/groups/G0074).(Citation: Secureworks MCMD July 2019)" ,
"meta" : {
"external_id" : "S0500" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0500" ,
"https://www.secureworks.com/research/mcmd-malware-analysis"
] ,
"synonyms" : [
"MCMD"
]
} ,
"related" : [
{
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3c4a2599-71ee-4405-ba1e-0e28414b4bc5" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "df8b2a25-8bdf-4856-953c-a04372b1c161" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "799ace7f-e227-4411-baa0-8868704f2a69" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "005a06c6-14bf-4118-afa0-ebcd8aebb0c9" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "9efb1ea7-c37b-4595-9640-b7680cd84279" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "cbb66055-0325-4111-aca0-40547b6ad5b0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "d1fcf083-a721-4223-aedf-bf8960798d62" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "975737f1-b10d-476f-8bda-3ec26ea57172" ,
"value" : "MCMD - S0500"
} ,
2017-10-26 10:28:53 +02:00
{
2018-12-09 09:16:03 +01:00
"description" : "[pwdump](https://attack.mitre.org/software/S0006) is a credential dumper. (Citation: Wikipedia pwdump)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0006" ,
"mitre_platforms" : [
"Windows"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0006" ,
"https://en.wikipedia.org/wiki/Pwdump"
2017-10-26 10:28:53 +02:00
] ,
2018-12-09 09:16:03 +01:00
"synonyms" : [
"pwdump"
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "1644e709-12d2-41e5-a60f-3470991f5011" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "9de2308e-7bed-43a3-8e58-f194b3586700" ,
"value" : "pwdump - S0006"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. (Citation: TrueSec Gsecdump)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0008" ,
"mitre_platforms" : [
"Windows"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0008" ,
"https://www.truesec.se/sakerhet/verktyg/saakerhet/gsecdump_v2.0b5"
2017-10-26 10:28:53 +02:00
] ,
2018-12-09 09:16:03 +01:00
"synonyms" : [
"gsecdump"
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 08:32:48 +01:00
"related" : [
{
2018-12-09 09:16:03 +01:00
"dest-uuid" : "8410d208-7450-407d-b56c-e5c1ced19632" ,
2018-12-09 08:32:48 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"likely\""
] ,
"type" : "similar"
2018-12-09 09:16:03 +01:00
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "1644e709-12d2-41e5-a60f-3470991f5011" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1ecfdab8-7d59-4c98-95d4-dc41970f57fc" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-12-09 08:32:48 +01:00
}
] ,
2018-12-09 09:16:03 +01:00
"uuid" : "b07c2c47-fefb-4d7c-a69e-6a3296171f54" ,
"value" : "gsecdump - S0008"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[at](https://attack.mitre.org/software/S0110) is used to schedule tasks on a system to run at a specified date or time. (Citation: TechNet At)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0110" ,
"mitre_platforms" : [
"Linux" ,
"Windows" ,
"macOS"
2017-10-26 10:28:53 +02:00
] ,
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0110" ,
"https://technet.microsoft.com/en-us/library/bb490866.aspx"
2017-10-26 10:28:53 +02:00
] ,
"synonyms" : [
2018-12-09 09:16:03 +01:00
"at" ,
"at.exe"
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f3d95a1f-bba2-44ce-9af7-37866cd63fd0" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "0c8465c0-d0b4-4670-992e-4eee8d7ff952" ,
"value" : "at - S0110"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[ifconfig](https://attack.mitre.org/software/S0101) is a Unix-based utility used to gather information about and interact with the TCP/IP settings on a system. (Citation: Wikipedia Ifconfig)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0101" ,
"mitre_platforms" : [
"Linux"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0101" ,
"https://en.wikipedia.org/wiki/Ifconfig"
2017-10-26 10:28:53 +02:00
] ,
"synonyms" : [
2018-12-09 09:16:03 +01:00
"ifconfig"
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "362dc67f-4e85-4562-9dac-1b6b7f3ec4b5" ,
"value" : "ifconfig - S0101"
2018-12-09 08:32:48 +01:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[Fgdump](https://attack.mitre.org/software/S0120) is a Windows password hash dumper. (Citation: Mandiant APT1)" ,
2018-12-09 08:32:48 +01:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0120" ,
"mitre_platforms" : [
"Windows"
] ,
2018-12-09 08:32:48 +01:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0120" ,
"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
2018-12-09 08:32:48 +01:00
] ,
"synonyms" : [
2018-12-09 09:16:03 +01:00
"Fgdump"
]
2018-12-09 08:32:48 +01:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "1644e709-12d2-41e5-a60f-3470991f5011" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "4f45dfeb-fe51-4df0-8db3-edf7dd0513fe" ,
"value" : "Fgdump - S0120"
2018-12-09 08:32:48 +01:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[nbtstat](https://attack.mitre.org/software/S0102) is a utility used to troubleshoot NetBIOS name resolution. (Citation: TechNet Nbtstat)" ,
2018-12-09 08:32:48 +01:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0102" ,
"mitre_platforms" : [
"Windows"
2018-12-09 08:32:48 +01:00
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0102" ,
2017-10-26 10:28:53 +02:00
"https://technet.microsoft.com/en-us/library/cc940106.aspx"
] ,
"synonyms" : [
"nbtstat" ,
"nbtstat.exe"
2018-12-09 09:16:03 +01:00
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
"dest-uuid" : "7e150503-88e7-4861-866b-ff1ac82c4475" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "b35068ec-107a-4266-bda8-eb7036267aea" ,
"value" : "nbtstat - S0102"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[route](https://attack.mitre.org/software/S0103) can be used to find or change information within the local system IP routing table. (Citation: TechNet Route)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0103" ,
"mitre_platforms" : [
"Linux" ,
"Windows" ,
"macOS"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0103" ,
"https://technet.microsoft.com/en-us/library/bb490991.aspx"
2017-10-26 10:28:53 +02:00
] ,
"synonyms" : [
2018-12-09 09:16:03 +01:00
"route" ,
"route.exe"
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "c11ac61d-50f4-444f-85d8-6f006067f0de" ,
"value" : "route - S0103"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[netstat](https://attack.mitre.org/software/S0104) is an operating system utility that displays active TCP connections, listening ports, and network statistics. (Citation: TechNet Netstat)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0104" ,
"mitre_platforms" : [
"Windows" ,
"Linux" ,
"macOS"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0104" ,
2017-10-26 10:28:53 +02:00
"https://technet.microsoft.com/en-us/library/bb490947.aspx"
] ,
"synonyms" : [
"netstat" ,
"netstat.exe"
2018-12-09 09:16:03 +01:00
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
"dest-uuid" : "7e150503-88e7-4861-866b-ff1ac82c4475" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "4664b683-f578-434f-919b-1c1aad2a1111" ,
"value" : "netstat - S0104"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[dsquery](https://attack.mitre.org/software/S0105) is a command-line utility that can be used to query Active Directory for information from a system within a domain. (Citation: TechNet Dsquery) It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle." ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0105" ,
"mitre_platforms" : [
"Windows"
2018-12-09 08:32:48 +01:00
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0105" ,
"https://technet.microsoft.com/en-us/library/cc732952.aspx"
2017-10-26 10:28:53 +02:00
] ,
2018-12-09 09:16:03 +01:00
"synonyms" : [
"dsquery" ,
"dsquery.exe"
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 08:32:48 +01:00
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "2aed01ad-3df3-4410-a8cb-11ea4ded587c" ,
2018-12-09 08:32:48 +01:00
"tags" : [
2018-12-09 09:16:03 +01:00
"estimative-language:likelihood-probability=\"almost-certain\""
2018-12-09 08:32:48 +01:00
] ,
2018-12-09 09:16:03 +01:00
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "21875073-b0ee-49e3-9077-1e2a885359af" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2019-04-30 19:07:57 +02:00
} ,
{
"dest-uuid" : "767dbf9e-df3f-45cb-8998-4903ab5f80c0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-12-09 08:32:48 +01:00
}
] ,
2018-12-09 09:16:03 +01:00
"uuid" : "38952eac-cb1b-4a71-bad2-ee8223a1c8fe" ,
"value" : "dsquery - S0105"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[cmd](https://attack.mitre.org/software/S0106) is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. (Citation: TechNet Cmd)\n\nCmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., <code>dir</code> (Citation: TechNet Dir)), deleting files (e.g., <code>del</code> (Citation: TechNet Del)), and copying files (e.g., <code>copy</code> (Citation: TechNet Copy))." ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0106" ,
"mitre_platforms" : [
"Windows"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0106" ,
"https://technet.microsoft.com/en-us/library/bb490880.aspx" ,
2018-12-09 08:32:48 +01:00
"https://technet.microsoft.com/en-us/library/cc755121.aspx" ,
2018-12-09 09:16:03 +01:00
"https://technet.microsoft.com/en-us/library/cc771049.aspx" ,
"https://technet.microsoft.com/en-us/library/bb490886.aspx"
2017-10-26 10:28:53 +02:00
] ,
"synonyms" : [
2018-12-09 08:32:48 +01:00
"cmd" ,
"cmd.exe"
2018-12-09 09:16:03 +01:00
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "d1fcf083-a721-4223-aedf-bf8960798d62" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "d63a3fb8-9452-4e9d-a60a-54be68d5998c" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "bf90d72c-c00b-45e3-b3aa-68560560d4c5" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "7bc57495-ea59-4380-be31-a64af124ef18" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "354a7f88-63fb-41b5-a801-ce3b377b36f1" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2020-10-18 20:00:48 +02:00
} ,
{
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-12-09 09:16:03 +01:00
}
] ,
"uuid" : "bba595da-b73a-4354-aa6c-224d4de7cb4e" ,
"value" : "cmd - S0106"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[certutil](https://attack.mitre.org/software/S0160) is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. (Citation: TechNet Certutil)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0160" ,
"mitre_platforms" : [
"Windows"
] ,
2017-10-26 10:28:53 +02:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0160" ,
2018-12-09 08:32:48 +01:00
"https://technet.microsoft.com/library/cc732443.aspx"
2017-10-26 10:28:53 +02:00
] ,
2018-12-09 08:32:48 +01:00
"synonyms" : [
"certutil" ,
"certutil.exe"
2018-12-09 09:16:03 +01:00
]
2017-10-26 10:28:53 +02:00
} ,
2018-08-14 09:32:24 +02:00
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "c615231b-f253-4f58-9d47-d5b4cbdb6839" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-10-27 21:06:26 +01:00
"dest-uuid" : "3ccef7ae-cb5e-48f6-8302-897105fbf55c" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-10-27 21:06:26 +01:00
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-08-14 09:32:24 +02:00
}
] ,
2018-12-09 09:16:03 +01:00
"uuid" : "0a68f1f1-da74-4d28-8d9a-696c082706cc" ,
"value" : "certutil - S0160"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[netsh](https://attack.mitre.org/software/S0108) is a scripting utility used to interact with networking components on local or remote systems. (Citation: TechNet Netsh)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0108" ,
"mitre_platforms" : [
"Windows"
2017-10-26 10:28:53 +02:00
] ,
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0108" ,
"https://technet.microsoft.com/library/bb490939.aspx"
2017-10-26 10:28:53 +02:00
] ,
"synonyms" : [
2018-12-09 09:16:03 +01:00
"netsh" ,
"netsh.exe"
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "cba37adb-d6fb-4610-b069-dd04c0643384" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "5372c5fe-f424-4def-bcd5-d3a8e770f07b" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "731f4f55-b6d0-41d1-a7a9-072a66389aea" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f63fe421-b1d1-45c0-b8a7-02cd16ff2bed" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "5a63f900-5e7e-4928-a746-dd4558e1df71" ,
"value" : "netsh - S0108"
2017-10-26 10:28:53 +02:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[BITSAdmin](https://attack.mitre.org/software/S0190) is a command line tool used to create and manage [BITS Jobs](https://attack.mitre.org/techniques/T1197). (Citation: Microsoft BITSAdmin)" ,
2017-10-26 10:28:53 +02:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0190" ,
"mitre_platforms" : [
"Windows"
2017-10-26 10:28:53 +02:00
] ,
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0190" ,
"https://msdn.microsoft.com/library/aa362813.aspx"
2017-10-26 10:28:53 +02:00
] ,
"synonyms" : [
2018-12-09 09:16:03 +01:00
"BITSAdmin"
]
2017-10-26 10:28:53 +02:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "fb8d023d-45be-47e9-bc51-f56bcae6435b" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-10-27 21:06:26 +01:00
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2019-10-25 10:12:22 +02:00
} ,
{
"dest-uuid" : "c8e87b83-edbb-48d4-9295-4974897525b7" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2020-10-18 20:00:48 +02:00
} ,
{
"dest-uuid" : "bf90d72c-c00b-45e3-b3aa-68560560d4c5" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-12-09 09:16:03 +01:00
}
] ,
"uuid" : "64764dc6-a032-495f-8250-1e4c06bdc163" ,
"value" : "BITSAdmin - S0190"
2018-12-09 08:32:48 +01:00
} ,
{
2018-12-09 09:16:03 +01:00
"description" : "[Koadic](https://attack.mitre.org/software/S0250) is a Windows post-exploitation framework and penetration testing tool. [Koadic](https://attack.mitre.org/software/S0250) is publicly available on GitHub and the tool is executed via the command-line. [Koadic](https://attack.mitre.org/software/S0250) has several options for staging payloads and creating implants. [Koadic](https://attack.mitre.org/software/S0250) performs most of its operations using Windows Script Host. (Citation: Github Koadic) (Citation: Palo Alto Sofacy 06-2018)" ,
2018-12-09 08:32:48 +01:00
"meta" : {
2018-12-09 09:16:03 +01:00
"external_id" : "S0250" ,
"mitre_platforms" : [
"Windows"
] ,
2018-12-09 08:32:48 +01:00
"refs" : [
2018-12-09 09:16:03 +01:00
"https://attack.mitre.org/software/S0250" ,
"https://github.com/zerosum0x0/koadic" ,
"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
2018-12-09 08:32:48 +01:00
] ,
"synonyms" : [
2018-12-09 09:16:03 +01:00
"Koadic"
]
2018-12-09 08:32:48 +01:00
} ,
2018-12-09 09:16:03 +01:00
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f4599aa0-4f85-4a32-80ea-fc39dc965945" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "045d0922-2310-4e60-b5e4-3302302cb3c5" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "e3a12395-188d-4051-9a16-ea8e14d07b88" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "bf176076-b789-408e-8cba-7275e81c0ada" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f1951e8a-500e-4a26-8803-76d95c4554b4" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "eb062747-2193-45de-8fa2-e62549c37ddf" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "30973a08-aed9-4edf-8604-9084ce1b5c4f" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "3489cfc5-640f-4bb3-a103-9137b97de79f" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "d1fcf083-a721-4223-aedf-bf8960798d62" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "01a5a209-b94c-450b-b7f9-946497d91055" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "3c4a2599-71ee-4405-ba1e-0e28414b4bc5" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "1644e709-12d2-41e5-a60f-3470991f5011" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "840a987a-99bd-4a80-a5c9-0cb2baa6cade" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "b97f1d35-4249-4486-a6b5-ee60ccf24fab" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "120d5519-3098-4e1c-9191-2aa61232f073" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "03d7999c-1f4c-42cc-8373-e7690d318104" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2020-10-18 20:00:48 +02:00
} ,
{
"dest-uuid" : "edf91964-b26e-4b4a-9600-ccacd7d7df24" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-12-09 09:16:03 +01:00
}
] ,
"uuid" : "c8655260-9f4b-44e3-85e1-6538a5f6e4f4" ,
"value" : "Koadic - S0250"
} ,
{
"description" : "[PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers. (Citation: Russinovich Sysinternals) (Citation: SANS PsExec)" ,
"meta" : {
"external_id" : "S0029" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0029" ,
"https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx" ,
"https://digital-forensics.sans.org/blog/2012/12/17/protecting-privileged-domain-accounts-psexec-deep-dive"
] ,
"synonyms" : [
"PsExec"
]
} ,
"related" : [
{
"dest-uuid" : "6dd05630-9bd8-11e8-a8b9-47ce338a4367" ,
"tags" : [
"estimative-language:likelihood-probability=\"likely\""
] ,
"type" : "similar"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "4f9ca633-15c5-463c-9724-bdcd54fde541" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f1951e8a-500e-4a26-8803-76d95c4554b4" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "bf90d72c-c00b-45e3-b3aa-68560560d4c5" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2021-10-22 14:34:25 +02:00
} ,
{
"dest-uuid" : "2959d63f-73fd-46a1-abd2-109d7dcede32" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7610cada-1499-41a4-b3dd-46467b68d177" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-12-09 09:16:03 +01:00
}
] ,
"uuid" : "ff6caf67-ea1f-4895-b80e-4bb0fc31c6db" ,
"value" : "PsExec - S0029"
} ,
{
2021-04-29 18:12:36 +02:00
"description" : "The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft Net Utility)\n\n[Net](https://attack.mitre.org/software/S0039) has a great deal of functionality, (Citation: Savill 1999) much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) using <code>net use</code> commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as <code>net1 user</code>." ,
2018-12-09 09:16:03 +01:00
"meta" : {
"external_id" : "S0039" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0039" ,
"https://msdn.microsoft.com/en-us/library/aa939914" ,
"http://windowsitpro.com/windows/netexe-reference"
] ,
"synonyms" : [
"Net" ,
"net.exe"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f1951e8a-500e-4a26-8803-76d95c4554b4" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "3489cfc5-640f-4bb3-a103-9137b97de79f" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "25659dd6-ea12-45c4-97e6-381e3e4b593e" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "635cbe30-392d-4e27-978e-66774357c762" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "4f9ca633-15c5-463c-9724-bdcd54fde541" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "a01bf75f-00b2-4568-a58f-565ff9bf202b" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "322bad5a-1c49-4d23-ab79-76d641794afa" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "e358d692-23c0-4a31-9eb6-ecc13a8d7735" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "7e150503-88e7-4861-866b-ff1ac82c4475" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
2019-10-27 21:06:26 +01:00
{
"dest-uuid" : "b6075259-dba3-44e9-87c7-e954f37ec0d5" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
2018-12-09 09:16:03 +01:00
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "f3c544dc-673c-4ef3-accb-53229f1ae077" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "a750a9f6-0bde-4bb3-9aae-1e2786e9780c" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2020-10-18 20:00:48 +02:00
} ,
{
"dest-uuid" : "7610cada-1499-41a4-b3dd-46467b68d177" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "2aed01ad-3df3-4410-a8cb-11ea4ded587c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "21875073-b0ee-49e3-9077-1e2a885359af" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "03342581-f790-4f03-ba41-e82e67392e23" ,
"value" : "Net - S0039"
} ,
{
"description" : "[esentutl](https://attack.mitre.org/software/S0404) is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.(Citation: Microsoft Esentutl)" ,
"meta" : {
2019-10-25 10:12:22 +02:00
"external_id" : "S0404" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0404" ,
"https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh875546(v=ws.11)"
] ,
"synonyms" : [
"esentutl" ,
"esentutl.exe"
]
} ,
"related" : [
{
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f2857333-11d4-45bf-b064-2c28d8525be5" ,
2019-10-25 10:12:22 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "edf91964-b26e-4b4a-9600-ccacd7d7df24" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "bf90d72c-c00b-45e3-b3aa-68560560d4c5" ,
2019-10-25 10:12:22 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2021-10-22 14:34:25 +02:00
} ,
{
"dest-uuid" : "3c4a2599-71ee-4405-ba1e-0e28414b4bc5" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2019-10-25 10:12:22 +02:00
}
] ,
"uuid" : "c256da91-6dd5-40b2-beeb-ee3b22ab3d27" ,
"value" : "esentutl - S0404"
} ,
{
"description" : "[FlexiSpy](https://attack.mitre.org/software/S0408) is sophisticated surveillanceware for iOS and Android. Publicly-available, comprehensive analysis has only been found for the Android version.(Citation: FortiGuard-FlexiSpy)(Citation: CyberMerchants-FlexiSpy)\n\n[FlexiSpy](https://attack.mitre.org/software/S0408) markets itself as a parental control and employee monitoring application.(Citation: FlexiSpy-Website)" ,
"meta" : {
"external_id" : "S0408" ,
"mitre_platforms" : [
"Android"
] ,
"refs" : [
"https://attack.mitre.org/software/S0408" ,
"https://d3gpjj9d20n0p3.cloudfront.net/fortiguard/research/Dig%20Deep%20into%20FlexiSpy%20for%20Android%28white%20paper%29_KaiLu.pdf" ,
"http://www.cybermerchantsofdeath.com/blog/2017/04/22/FlexiSpy.html" ,
"https://www.flexispy.com/"
] ,
"synonyms" : [
"FlexiSpy"
]
} ,
"related" : [
{
"dest-uuid" : "948a447c-d783-4ba0-8516-a64140fcacd5" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "fd658820-cbba-4c95-8ac9-0fac6b1099e2" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "c5089859-b21f-40a3-8be4-63e381b8b1c0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "bd4d32f5-eed4-4018-a649-40b229dd1d69" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "702055ac-4e54-4ae9-9527-e23a38e0b160" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "6683aa0c-d98a-4f5b-ac57-ca7e9934a760" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "d8940e76-f9c1-4912-bea6-e21c251370b6" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "8e27551a-5080-4148-a584-c64348212e4f" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e8b4e1ec-8e3b-484c-9038-4459b1ed8060" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "62adb627-f647-498e-b4cc-41499361bacb" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "99e6295e-741b-4857-b6e5-64989eb039b4" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e4c347e9-fb91-4bc5-83b8-391e389131e2" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "198ce408-1470-45ee-b47f-7056050d4fc2" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "73c26732-6422-4081-8b63-6d0ae93d449e" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "a8c31121-852b-46bd-9ba4-674ae5afe7ad" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e1c912a9-e305-434b-9172-8a6ce3ec9c4a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "1622fd3d-fcfc-4d02-ac49-f2d786f79b81" ,
"value" : "FlexiSpy - S0408"
} ,
2018-12-09 09:16:03 +01:00
{
"description" : "[Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: Microsoft Reg)\n\nUtilities such as [Reg](https://attack.mitre.org/software/S0075) are known to be used by persistent threats. (Citation: Windows Commands JPCERT)" ,
"meta" : {
"external_id" : "S0075" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0075" ,
"https://technet.microsoft.com/en-us/library/cc732643.aspx" ,
2021-10-22 14:34:25 +02:00
"https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"
2018-12-09 09:16:03 +01:00
] ,
"synonyms" : [
"Reg" ,
"reg.exe"
]
} ,
"related" : [
{
2019-10-27 21:06:26 +01:00
"dest-uuid" : "c32f7008-9fea-41f7-8366-5eb9b74bd896" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "341e222a-a6e3-4f6f-b69c-831d792b1580" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "57340c81-c025-4189-8fa0-fc7ede51bae4" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "cde2d700-9ed1-46cf-9bce-07364fe8b24f" ,
"value" : "Reg - S0075"
} ,
{
"description" : "The [Tasklist](https://attack.mitre.org/software/S0057) utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating systems and can be executed from the command-line interface. (Citation: Microsoft Tasklist)" ,
"meta" : {
"external_id" : "S0057" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0057" ,
"https://technet.microsoft.com/en-us/library/bb491010.aspx"
] ,
"synonyms" : [
"Tasklist"
]
} ,
"related" : [
{
"dest-uuid" : "322bad5a-1c49-4d23-ab79-76d641794afa" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "cba37adb-d6fb-4610-b069-dd04c0643384" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "8f4a33ec-8b1f-4b80-a2f6-642b2e479580" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "2e45723a-31da-4a7e-aaa6-e01998a6788f" ,
"value" : "Tasklist - S0057"
} ,
2021-04-29 18:12:36 +02:00
{
"description" : "[NBTscan](https://attack.mitre.org/software/S0590) is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)(Citation: Symantec Waterbug Jun 2019)(Citation: FireEye APT39 Jan 2019)" ,
"meta" : {
"external_id" : "S0590" ,
"mitre_platforms" : [
"Windows" ,
"Linux" ,
"macOS"
] ,
"refs" : [
"https://attack.mitre.org/software/S0590" ,
"https://manpages.debian.org/testing/nbtscan/nbtscan.1.en.html" ,
"https://sectools.org/tool/nbtscan/" ,
"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments" ,
"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"
] ,
"synonyms" : [
"NBTscan"
]
} ,
"related" : [
{
"dest-uuid" : "3257eb21-f9a7-4430-8de1-d8b6e288f529" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e358d692-23c0-4a31-9eb6-ecc13a8d7735" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "03d7999c-1f4c-42cc-8373-e7690d318104" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e3a12395-188d-4051-9a16-ea8e14d07b88" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "b63970b7-ddfb-4aee-97b1-80d335e033a8" ,
"value" : "NBTscan - S0590"
} ,
2018-12-09 09:16:03 +01:00
{
"description" : "[FTP](https://attack.mitre.org/software/S0095) is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a system or to exfiltrate data. (Citation: Wikipedia FTP)" ,
"meta" : {
"external_id" : "S0095" ,
"mitre_platforms" : [
"Linux" ,
"Windows" ,
"macOS"
] ,
"refs" : [
"https://attack.mitre.org/software/S0095" ,
"https://en.wikipedia.org/wiki/File_Transfer_Protocol"
] ,
"synonyms" : [
"FTP" ,
"ftp.exe"
]
} ,
"related" : [
{
"dest-uuid" : "f879d51c-5476-431c-aedf-f14d207e4d1e" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "fb8d023d-45be-47e9-bc51-f56bcae6435b" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "cf23bf4a-e003-4116-bbae-1ea6c558d565" ,
"value" : "FTP - S0095"
} ,
{
"description" : "[Systeminfo](https://attack.mitre.org/software/S0096) is a Windows utility that can be used to gather detailed information about a computer. (Citation: TechNet Systeminfo)" ,
"meta" : {
"external_id" : "S0096" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0096" ,
"https://technet.microsoft.com/en-us/library/bb491007.aspx"
] ,
"synonyms" : [
"systeminfo.exe" ,
"Systeminfo"
]
} ,
"related" : [
{
"dest-uuid" : "354a7f88-63fb-41b5-a801-ce3b377b36f1" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "7fcbc4e8-1989-441f-9ac5-e7b6ff5806f1" ,
"value" : "Systeminfo - S0096"
} ,
{
"description" : "[Ping](https://attack.mitre.org/software/S0097) is an operating system utility commonly used to troubleshoot and verify network connections. (Citation: TechNet Ping)" ,
"meta" : {
"external_id" : "S0097" ,
"mitre_platforms" : [
"Linux" ,
"Windows" ,
"macOS"
] ,
"refs" : [
"https://attack.mitre.org/software/S0097" ,
"https://technet.microsoft.com/en-us/library/bb490968.aspx"
] ,
"synonyms" : [
"ping.exe" ,
"Ping"
]
} ,
"related" : [
{
"dest-uuid" : "e358d692-23c0-4a31-9eb6-ecc13a8d7735" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "b77b563c-34bb-4fb8-86a3-3694338f7b47" ,
"value" : "Ping - S0097"
} ,
{
"description" : "[Arp](https://attack.mitre.org/software/S0099) displays information about a system's Address Resolution Protocol (ARP) cache. (Citation: TechNet Arp)" ,
"meta" : {
"external_id" : "S0099" ,
"mitre_platforms" : [
"Linux" ,
"Windows" ,
"macOS"
] ,
"refs" : [
"https://attack.mitre.org/software/S0099" ,
"https://technet.microsoft.com/en-us/library/bb490864.aspx"
] ,
"synonyms" : [
"Arp" ,
"arp.exe"
]
} ,
"related" : [
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "30489451-5886-4c46-90c9-0dff9adc5252" ,
"value" : "Arp - S0099"
} ,
{
"description" : "[schtasks](https://attack.mitre.org/software/S0111) is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. (Citation: TechNet Schtasks)" ,
"meta" : {
"external_id" : "S0111" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0111" ,
"https://technet.microsoft.com/en-us/library/bb490996.aspx"
] ,
"synonyms" : [
"schtasks" ,
"schtasks.exe"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "005a06c6-14bf-4118-afa0-ebcd8aebb0c9" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "c9703cd3-141c-43a0-a926-380082be5d04" ,
"value" : "schtasks - S0111"
} ,
{
"description" : "[Lslsass](https://attack.mitre.org/software/S0121) is a publicly-available tool that can dump active logon session password hashes from the lsass process. (Citation: Mandiant APT1)" ,
"meta" : {
"external_id" : "S0121" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0121" ,
"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
] ,
"synonyms" : [
"Lslsass"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "65f2d882-3f41-4d48-8a06-29af77ec9f90" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "2fab555f-7664-4623-b4e0-1675ae38190b" ,
"value" : "Lslsass - S0121"
} ,
{
"description" : "[UACMe](https://attack.mitre.org/software/S0116) is an open source assessment tool that contains many methods for bypassing Windows User Account Control on multiple versions of the operating system. (Citation: Github UACMe)" ,
"meta" : {
"external_id" : "S0116" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0116" ,
"https://github.com/hfiref0x/UACME"
] ,
"synonyms" : [
"UACMe"
]
} ,
"related" : [
{
"dest-uuid" : "ccde5b0d-fe13-48e6-a6f4-4e434ce29371" ,
"tags" : [
"estimative-language:likelihood-probability=\"likely\""
] ,
"type" : "similar"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "120d5519-3098-4e1c-9191-2aa61232f073" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "102c3898-85e0-43ee-ae28-62a0a3ed9507" ,
"value" : "UACMe - S0116"
} ,
{
"description" : "[Cachedump](https://attack.mitre.org/software/S0119) is a publicly-available tool that program extracts cached password hashes from a system’ ,
"meta" : {
"external_id" : "S0119" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0119" ,
"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
] ,
"synonyms" : [
"Cachedump"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "6add2ab5-2711-4e9d-87c8-7a0be8531530" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "c9cd7ec9-40b7-49db-80be-1399eddd9c52" ,
"value" : "Cachedump - S0119"
} ,
{
"description" : "[Winexe](https://attack.mitre.org/software/S0191) is a lightweight, open source tool similar to [PsExec](https://attack.mitre.org/software/S0029) designed to allow system administrators to execute commands on remote servers. (Citation: Winexe Github Sept 2013) [Winexe](https://attack.mitre.org/software/S0191) is unique in that it is a GNU/Linux based client. (Citation: Überwachung APT28 Forfiles June 2015)" ,
"meta" : {
"external_id" : "S0191" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0191" ,
"https://github.com/skalkoto/winexe/" ,
"https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/"
] ,
"synonyms" : [
"Winexe"
]
} ,
"related" : [
{
"dest-uuid" : "811bdec0-e236-48ae-b27c-1a8fe0bfc3a9" ,
"tags" : [
"estimative-language:likelihood-probability=\"likely\""
] ,
"type" : "similar"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f1951e8a-500e-4a26-8803-76d95c4554b4" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "96fd6cc4-a693-4118-83ec-619e5352d07d" ,
"value" : "Winexe - S0191"
} ,
{
"description" : "[xCmd](https://attack.mitre.org/software/S0123) is an open source tool that is similar to [PsExec](https://attack.mitre.org/software/S0029) and allows the user to execute applications on remote systems. (Citation: xCmd)" ,
"meta" : {
"external_id" : "S0123" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0123" ,
"https://ashwinrayaprolu.wordpress.com/2011/04/12/xcmd-an-alternative-to-psexec/"
] ,
"synonyms" : [
"xCmd"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f1951e8a-500e-4a26-8803-76d95c4554b4" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "4fa49fc0-9162-4bdb-a37e-7aa3dcb6d38b" ,
"value" : "xCmd - S0123"
} ,
2021-04-29 18:12:36 +02:00
{
"description" : "[BloodHound](https://attack.mitre.org/software/S0521) is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.(Citation: GitHub Bloodhound)(Citation: CrowdStrike BloodHound April 2018)(Citation: FoxIT Wocao December 2019)" ,
"meta" : {
"external_id" : "S0521" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0521" ,
"https://github.com/BloodHoundAD/BloodHound" ,
"https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/" ,
"https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf"
] ,
"synonyms" : [
"BloodHound"
]
} ,
"related" : [
{
"dest-uuid" : "21875073-b0ee-49e3-9077-1e2a885359af" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "970a3432-3237-47ad-bcca-7d8cbb217736" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "767dbf9e-df3f-45cb-8998-4903ab5f80c0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "25659dd6-ea12-45c4-97e6-381e3e4b593e" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "391d824f-0ef1-47a0-b0ee-c59a75e27670" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "2aed01ad-3df3-4410-a8cb-11ea4ded587c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "a01bf75f-00b2-4568-a58f-565ff9bf202b" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b6075259-dba3-44e9-87c7-e954f37ec0d5" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e358d692-23c0-4a31-9eb6-ecc13a8d7735" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "03d7999c-1f4c-42cc-8373-e7690d318104" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2021-10-22 14:34:25 +02:00
} ,
{
"dest-uuid" : "1b20efbf-8063-4fc3-a07d-b575318a301b" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2021-04-29 18:12:36 +02:00
}
] ,
"uuid" : "066b057c-944e-4cfc-b654-e3dfba04b926" ,
"value" : "BloodHound - S0521"
} ,
2018-12-09 09:16:03 +01:00
{
"description" : "[Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). (Citation: GitHub Pupy) [Pupy](https://attack.mitre.org/software/S0192) is publicly available on GitHub. (Citation: GitHub Pupy)" ,
"meta" : {
"external_id" : "S0192" ,
"mitre_platforms" : [
"Linux" ,
"Windows" ,
2019-04-30 19:07:57 +02:00
"macOS" ,
"Android"
2018-12-09 09:16:03 +01:00
] ,
"refs" : [
"https://attack.mitre.org/software/S0192" ,
"https://github.com/n1nj4sec/pupy"
] ,
"synonyms" : [
"Pupy"
]
} ,
"related" : [
{
"dest-uuid" : "bdb420be-5882-41c8-b439-02bbef69d83f" ,
"tags" : [
"estimative-language:likelihood-probability=\"likely\""
] ,
"type" : "similar"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "86850eff-2729-40c3-b85e-c4af26da4a2d" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "8f4a33ec-8b1f-4b80-a2f6-642b2e479580" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "09a60ea3-a8d1-4ae5-976e-5783248b72a4" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "120d5519-3098-4e1c-9191-2aa61232f073" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "6495ae23-3ab4-43c5-a94f-5638a2c31fd2" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "00f90846-cbd1-4fc5-9233-df5c2bf2a662" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "03d7999c-1f4c-42cc-8373-e7690d318104" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "1035cdf2-3e5f-446f-a7a7-e8f6d7925967" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f4599aa0-4f85-4a32-80ea-fc39dc965945" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "df8b2a25-8bdf-4856-953c-a04372b1c161" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "eb062747-2193-45de-8fa2-e62549c37ddf" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "e3a12395-188d-4051-9a16-ea8e14d07b88" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "650c784b-7504-4df7-ab2c-4ea882384d1e" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "1e9eb839-294b-48cc-b0d3-c45555a2a004" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "25659dd6-ea12-45c4-97e6-381e3e4b593e" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "970a3432-3237-47ad-bcca-7d8cbb217736" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "92d7da27-2d91-488e-a00c-059dc162766d" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "7e150503-88e7-4861-866b-ff1ac82c4475" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "635cbe30-392d-4e27-978e-66774357c762" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "bf176076-b789-408e-8cba-7275e81c0ada" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f1951e8a-500e-4a26-8803-76d95c4554b4" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "354a7f88-63fb-41b5-a801-ce3b377b36f1" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "3489cfc5-640f-4bb3-a103-9137b97de79f" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "7bc57495-ea59-4380-be31-a64af124ef18" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "65f2d882-3f41-4d48-8a06-29af77ec9f90" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
2019-10-27 21:06:26 +01:00
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "cc3502b5-30cc-4473-ad48-42d51a6ef6d1" ,
2019-10-27 21:06:26 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
2018-12-09 09:16:03 +01:00
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "9efb1ea7-c37b-4595-9640-b7680cd84279" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "6faf650d-bf31-4eb4-802d-1000cf38efaf" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "0259baeb-9f63-4c69-bf10-eb038c390688" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "29be378d-262d-4e99-b00d-852d573628e6" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7610cada-1499-41a4-b3dd-46467b68d177" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "dfefe2ed-4389-4318-8762-f0272b350a1b" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "837f9164-50af-4ac0-8219-379d8a74cefc" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1ecfdab8-7d59-4c98-95d4-dc41970f57fc" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "6add2ab5-2711-4e9d-87c8-7a0be8531530" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7b211ac6-c815-4189-93a9-ab415deca926" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "3fc9b85a-2862-4363-a64d-d692e3ffbee0" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "58a3e6aa-4453-4cc8-a51f-4befe80b31a8" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "cb69b20d-56d0-41ab-8440-4a4b251614d4" ,
"value" : "Pupy - S0192"
} ,
2019-10-25 10:12:22 +02:00
{
"description" : "MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain.(Citation: GitHub MailSniper)" ,
"meta" : {
"external_id" : "S0413" ,
"mitre_platforms" : [
"Office 365" ,
"Windows" ,
"Azure AD"
] ,
"refs" : [
"https://attack.mitre.org/software/S0413" ,
"https://github.com/dafthack/MailSniper"
] ,
"synonyms" : [
"MailSniper"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "692074ae-bb62-4a5e-a735-02cb6bde458c" ,
2019-10-25 10:12:22 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "b4694861-542c-48ea-9eb1-10d356e7140a" ,
2019-10-25 10:12:22 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "4bc31b94-045b-4752-8920-aebaebdb6470" ,
2019-10-25 10:12:22 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "999c4e6e-b8dc-4b4f-8d6e-1b829f29997e" ,
"value" : "MailSniper - S0413"
} ,
2018-12-09 09:16:03 +01:00
{
2019-04-30 19:07:57 +02:00
"description" : "[Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)" ,
2018-12-09 09:16:03 +01:00
"meta" : {
2019-04-30 19:07:57 +02:00
"external_id" : "S0361" ,
2018-12-09 09:16:03 +01:00
"mitre_platforms" : [
2019-04-30 19:07:57 +02:00
"Windows"
2018-12-09 09:16:03 +01:00
] ,
"refs" : [
2019-04-30 19:07:57 +02:00
"https://attack.mitre.org/software/S0361" ,
"https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/expand" ,
"http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"
] ,
"synonyms" : [
"Expand"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f2857333-11d4-45bf-b064-2c28d8525be5" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "bf90d72c-c00b-45e3-b3aa-68560560d4c5" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3ccef7ae-cb5e-48f6-8302-897105fbf55c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "ca656c25-44f1-471b-9d9f-e2a3bbb84973" ,
"value" : "Expand - S0361"
} ,
{
"description" : "[Tor](https://attack.mitre.org/software/S0183) is a software suite and network that provides increased anonymity on the Internet. It creates a multi-hop proxy network and utilizes multilayer encryption to protect both the message and routing information. [Tor](https://attack.mitre.org/software/S0183) utilizes \"Onion Routing,\" in which messages are encrypted with multiple layers of encryption; at each step in the proxy network, the topmost layer is decrypted and the contents forwarded on to the next node until it reaches its destination. (Citation: Dingledine Tor The Second-Generation Onion Router)" ,
"meta" : {
"external_id" : "S0183" ,
"mitre_platforms" : [
"Linux" ,
"Windows" ,
"macOS"
] ,
"refs" : [
"https://attack.mitre.org/software/S0183" ,
2018-12-09 09:16:03 +01:00
"http://www.dtic.mil/dtic/tr/fulltext/u2/a465464.pdf"
] ,
"synonyms" : [
"Tor"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "bf176076-b789-408e-8cba-7275e81c0ada" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "a782ebe2-daba-42c7-bc82-e8e9d923162d" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "ed7d0cb1-87a6-43b4-9f46-ef1bc56d6c68" ,
"value" : "Tor - S0183"
} ,
{
"description" : "[Forfiles](https://attack.mitre.org/software/S0193) is a Windows utility commonly used in batch jobs to execute commands on one or more selected files or directories (ex: list all directories in a drive, read the first line of all files created yesterday, etc.). Forfiles can be executed from either the command line, Run window, or batch files/scripts. (Citation: Microsoft Forfiles Aug 2016)" ,
"meta" : {
"external_id" : "S0193" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0193" ,
"https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753551(v=ws.11)"
] ,
"synonyms" : [
"Forfiles"
]
} ,
"related" : [
{
2019-10-27 21:06:26 +01:00
"dest-uuid" : "3b0e52ce-517a-4614-a523-1bd5deef6c5e" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-10-27 21:06:26 +01:00
"dest-uuid" : "7bc57495-ea59-4380-be31-a64af124ef18" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "3c4a2599-71ee-4405-ba1e-0e28414b4bc5" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "90ec2b22-7061-4469-b539-0989ec4f96c2" ,
"value" : "Forfiles - S0193"
} ,
2021-04-29 18:12:36 +02:00
{
"description" : "[Out1](https://attack.mitre.org/software/S0594) is a remote access tool written in python and used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least 2021.(Citation: Trend Micro Muddy Water March 2021)" ,
"meta" : {
"external_id" : "S0594" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0594" ,
"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
] ,
"synonyms" : [
"Out1"
]
} ,
"related" : [
{
"dest-uuid" : "d1fcf083-a721-4223-aedf-bf8960798d62" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3c4a2599-71ee-4405-ba1e-0e28414b4bc5" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "df8b2a25-8bdf-4856-953c-a04372b1c161" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1e9eb839-294b-48cc-b0d3-c45555a2a004" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "80c815bb-b24a-4b9c-9d73-ff4c075a278d" ,
"value" : "Out1 - S0594"
} ,
2018-12-09 09:16:03 +01:00
{
"description" : "Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. (Citation: GitHub Responder)" ,
"meta" : {
"external_id" : "S0174" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0174" ,
"https://github.com/SpiderLabs/Responder"
] ,
"synonyms" : [
"Responder"
]
} ,
"related" : [
{
"dest-uuid" : "3257eb21-f9a7-4430-8de1-d8b6e288f529" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "650c784b-7504-4df7-ab2c-4ea882384d1e" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "a1dd2dbd-1550-44bf-abcc-1a4c52e97719" ,
"value" : "Responder - S0174"
} ,
{
2021-04-29 18:12:36 +02:00
"description" : "[PowerSploit](https://attack.mitre.org/software/S0194) is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. (Citation: GitHub PowerSploit May 2012) (Citation: PowerShellMagazine PowerSploit July 2014) (Citation: PowerSploit Documentation)" ,
2018-12-09 09:16:03 +01:00
"meta" : {
"external_id" : "S0194" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0194" ,
"https://github.com/PowerShellMafia/PowerSploit" ,
"http://www.powershellmagazine.com/2014/07/08/powersploit/" ,
"http://powersploit.readthedocs.io"
] ,
"synonyms" : [
"PowerSploit"
]
} ,
"related" : [
{
"dest-uuid" : "8f4a33ec-8b1f-4b80-a2f6-642b2e479580" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2021-10-22 14:34:25 +02:00
"dest-uuid" : "4933e63b-9b77-476e-ab29-761bc5b7d15a" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "341e222a-a6e3-4f6f-b69c-831d792b1580" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f2877f7f-9a4c-4251-879f-1224e3006bee" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "5095a853-299c-4876-abd7-ac0050fb5462" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "09a60ea3-a8d1-4ae5-976e-5783248b72a4" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "25659dd6-ea12-45c4-97e6-381e3e4b593e" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "8d7bd4f5-3a89-4453-9c82-2c8894d5655e" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "9efb1ea7-c37b-4595-9640-b7680cd84279" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "2fee9321-3e71-4cf4-af24-d4d40d355b34" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "c4ad009b-6e13-4419-8d21-918a1652de02" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "b0533c6e-8fea-4788-874f-b799cacc4b92" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "3c4a2599-71ee-4405-ba1e-0e28414b4bc5" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "2959d63f-73fd-46a1-abd2-109d7dcede32" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "005a06c6-14bf-4118-afa0-ebcd8aebb0c9" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "dcaa092b-7de9-4a21-977f-7fcb77e89c48" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "970a3432-3237-47ad-bcca-7d8cbb217736" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "c32f7008-9fea-41f7-8366-5eb9b74bd896" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "1035cdf2-3e5f-446f-a7a7-e8f6d7925967" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "0259baeb-9f63-4c69-bf10-eb038c390688" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "01a5a209-b94c-450b-b7f9-946497d91055" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "767dbf9e-df3f-45cb-8998-4903ab5f80c0" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2020-10-18 20:00:48 +02:00
} ,
{
"dest-uuid" : "f4599aa0-4f85-4a32-80ea-fc39dc965945" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "0c2d00da-7742-49e7-9928-4514e5075d32" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "58af3705-8740-4c68-9329-ec015a7013c2" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "bf96a5a3-3bce-43b7-8597-88545984c07b" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "65f2d882-3f41-4d48-8a06-29af77ec9f90" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2021-04-29 18:12:36 +02:00
"dest-uuid" : "d336b553-5da9-46ca-98a8-0b23f49fb447" ,
2020-10-18 20:00:48 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-12-09 09:16:03 +01:00
}
] ,
"uuid" : "13cd9151-83b7-410d-9f98-25d0f0d1d80d" ,
"value" : "PowerSploit - S0194"
} ,
{
"description" : "[meek](https://attack.mitre.org/software/S0175) is an open-source Tor plugin that tunnels Tor traffic through HTTPS connections." ,
"meta" : {
"external_id" : "S0175" ,
"mitre_platforms" : [
"Linux" ,
"Windows" ,
"macOS"
] ,
"refs" : [
"https://attack.mitre.org/software/S0175"
] ,
"synonyms" : [
"meek"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "ca9d3402-ada3-484d-876a-d717bd6e05f2" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "65370d0b-3bd4-4653-8cf9-daf56f6be830" ,
"value" : "meek - S0175"
} ,
2021-04-29 18:12:36 +02:00
{
"description" : "[IronNetInjector](https://attack.mitre.org/software/S0581) is a [Turla](https://attack.mitre.org/groups/G0010) toolchain that utilizes scripts from the open-source IronPython implementation of Python with a .NET injector to drop one or more payloads including [ComRAT](https://attack.mitre.org/software/S0126).(Citation: Unit 42 IronNetInjector February 2021 )" ,
"meta" : {
"external_id" : "S0581" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0581" ,
" https://unit42.paloaltonetworks.com/ironnetinjector/"
] ,
"synonyms" : [
"IronNetInjector"
]
} ,
"related" : [
{
"dest-uuid" : "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3ccef7ae-cb5e-48f6-8302-897105fbf55c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "005a06c6-14bf-4118-afa0-ebcd8aebb0c9" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "f4599aa0-4f85-4a32-80ea-fc39dc965945" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "8f4a33ec-8b1f-4b80-a2f6-642b2e479580" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "cc3502b5-30cc-4473-ad48-42d51a6ef6d1" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "b1595ddd-a783-482a-90e1-8afc8d48467e" ,
"value" : "IronNetInjector - S0581"
} ,
{
"description" : "[ConnectWise](https://attack.mitre.org/software/S0591) is a legitimate remote administration tool that has been used since at least 2016 by threat actors including [MuddyWater](https://attack.mitre.org/groups/G0069) and [GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) to connect to and conduct lateral movement in target environments.(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)" ,
"meta" : {
"external_id" : "S0591" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0591" ,
"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies" ,
"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
] ,
"synonyms" : [
"ConnectWise" ,
"ScreenConnect"
]
} ,
"related" : [
{
"dest-uuid" : "6faf650d-bf31-4eb4-802d-1000cf38efaf" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "0259baeb-9f63-4c69-bf10-eb038c390688" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "970a3432-3237-47ad-bcca-7d8cbb217736" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "842976c7-f9c8-41b2-8371-41dc64fbe261" ,
"value" : "ConnectWise - S0591"
} ,
2018-12-09 09:16:03 +01:00
{
"description" : "[SDelete](https://attack.mitre.org/software/S0195) is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. (Citation: Microsoft SDelete July 2016)" ,
"meta" : {
"external_id" : "S0195" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0195" ,
"https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete"
] ,
"synonyms" : [
"SDelete"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "d63a3fb8-9452-4e9d-a60a-54be68d5998c" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2019-04-30 19:07:57 +02:00
} ,
{
"dest-uuid" : "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-12-09 09:16:03 +01:00
}
] ,
"uuid" : "d8d19e33-94fd-4aa3-b94a-08ee801a2153" ,
"value" : "SDelete - S0195"
} ,
{
"description" : "[MimiPenguin](https://attack.mitre.org/software/S0179) is a credential dumper, similar to [Mimikatz](https://attack.mitre.org/software/S0002), designed specifically for Linux platforms. (Citation: MimiPenguin GitHub May 2017)" ,
"meta" : {
"external_id" : "S0179" ,
"mitre_platforms" : [
"Linux"
] ,
"refs" : [
"https://attack.mitre.org/software/S0179" ,
"https://github.com/huntergregal/mimipenguin"
] ,
"synonyms" : [
"MimiPenguin"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "3120b9fa-23b8-4500-ae73-09494f607b7d" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "5a33468d-844d-4b1f-98c9-0e786c556b27" ,
"value" : "MimiPenguin - S0179"
} ,
{
"description" : "[Havij](https://attack.mitre.org/software/S0224) is an automatic SQL Injection tool distributed by the Iranian ITSecTeam security company. Havij has been used by penetration testers and adversaries. (Citation: Check Point Havij Analysis)" ,
"meta" : {
"external_id" : "S0224" ,
"mitre_platforms" : [
"Linux" ,
"Windows" ,
"macOS"
] ,
"refs" : [
"https://attack.mitre.org/software/S0224" ,
"https://blog.checkpoint.com/2015/05/14/analysis-havij-sql-injection-tool/"
] ,
"synonyms" : [
"Havij"
]
} ,
"related" : [
{
"dest-uuid" : "3f886f2a-874f-4333-b794-aa6075009b1c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "fbd727ea-c0dc-42a9-8448-9e12962d1ab5" ,
"value" : "Havij - S0224"
} ,
{
"description" : "[sqlmap](https://attack.mitre.org/software/S0225) is an open source penetration testing tool that can be used to automate the process of detecting and exploiting SQL injection flaws. (Citation: sqlmap Introduction)" ,
"meta" : {
"external_id" : "S0225" ,
"mitre_platforms" : [
"Linux" ,
"Windows" ,
"macOS"
] ,
"refs" : [
"https://attack.mitre.org/software/S0225" ,
"http://sqlmap.org/"
] ,
"synonyms" : [
"sqlmap"
]
} ,
"related" : [
{
"dest-uuid" : "3f886f2a-874f-4333-b794-aa6075009b1c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "9a2640c2-9f43-46fe-b13f-bde881e55555" ,
"value" : "sqlmap - S0225"
} ,
{
"description" : "[QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that is publicly available on GitHub. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language. (Citation: GitHub QuasarRAT) (Citation: Volexity Patchwork June 2018)" ,
"meta" : {
"external_id" : "S0262" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0262" ,
"https://github.com/quasar/QuasarRAT" ,
2019-08-01 15:51:03 +02:00
"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/" ,
2021-10-22 14:34:25 +02:00
"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf" ,
"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
2018-12-09 09:16:03 +01:00
] ,
"synonyms" : [
"QuasarRAT" ,
"xRAT"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "eb062747-2193-45de-8fa2-e62549c37ddf" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "837f9164-50af-4ac0-8219-379d8a74cefc" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "3fc9b85a-2862-4363-a64d-d692e3ffbee0" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "d1fcf083-a721-4223-aedf-bf8960798d62" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "09a60ea3-a8d1-4ae5-976e-5783248b72a4" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "354a7f88-63fb-41b5-a801-ce3b377b36f1" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "24bfaeba-cb0d-4525-b3dc-507c77ecec41" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "57340c81-c025-4189-8fa0-fc7ede51bae4" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "731f4f55-b6d0-41d1-a7a9-072a66389aea" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "005a06c6-14bf-4118-afa0-ebcd8aebb0c9" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "32901740-b42c-4fdd-bc02-345b5dc57082" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "6faf650d-bf31-4eb4-802d-1000cf38efaf" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2019-10-25 10:12:22 +02:00
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "58a3e6aa-4453-4cc8-a51f-4befe80b31a8" ,
2019-10-25 10:12:22 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2018-12-09 09:16:03 +01:00
}
] ,
"uuid" : "da04ac30-27da-4959-a67d-450ce47d9470" ,
"value" : "QuasarRAT - S0262"
} ,
{
"description" : "[spwebmember](https://attack.mitre.org/software/S0227) is a Microsoft SharePoint enumeration and data dumping tool written in .NET. (Citation: NCC Group APT15 Alive and Strong)" ,
"meta" : {
"external_id" : "S0227" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0227" ,
2021-04-29 18:12:36 +02:00
"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
2018-12-09 09:16:03 +01:00
] ,
"synonyms" : [
"spwebmember"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "0c4b4fda-9062-47da-98b9-ceae2dcf052a" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "33b9e38f-103c-412d-bdcf-904a91fff1e4" ,
"value" : "spwebmember - S0227"
} ,
{
2019-04-30 19:07:57 +02:00
"description" : "[Remcos](https://attack.mitre.org/software/S0332) is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. [Remcos](https://attack.mitre.org/software/S0332) has been observed being used in malware campaigns.(Citation: Riskiq Remcos Jan 2018)(Citation: Talos Remcos Aug 2018)" ,
2018-12-09 09:16:03 +01:00
"meta" : {
2019-04-30 19:07:57 +02:00
"external_id" : "S0332" ,
2018-12-29 18:40:21 +01:00
"mitre_platforms" : [
2019-04-30 19:07:57 +02:00
"Windows"
2018-12-29 18:40:21 +01:00
] ,
2018-12-09 09:16:03 +01:00
"refs" : [
2019-04-30 19:07:57 +02:00
"https://attack.mitre.org/software/S0332" ,
"https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/" ,
"https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html" ,
"https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html"
2018-12-09 09:16:03 +01:00
] ,
"synonyms" : [
2019-04-30 19:07:57 +02:00
"Remcos"
2018-12-09 09:16:03 +01:00
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "29be378d-262d-4e99-b00d-852d573628e6" ,
2018-12-09 09:16:03 +01:00
"tags" : [
2019-04-30 19:07:57 +02:00
"estimative-language:likelihood-probability=\"almost-certain\""
2018-12-09 09:16:03 +01:00
] ,
2019-04-30 19:07:57 +02:00
"type" : "uses"
2018-12-09 09:16:03 +01:00
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "09a60ea3-a8d1-4ae5-976e-5783248b72a4" ,
2018-12-09 09:16:03 +01:00
"tags" : [
2019-04-30 19:07:57 +02:00
"estimative-language:likelihood-probability=\"almost-certain\""
2018-12-09 09:16:03 +01:00
] ,
2019-04-30 19:07:57 +02:00
"type" : "uses"
2018-12-09 09:16:03 +01:00
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "1035cdf2-3e5f-446f-a7a7-e8f6d7925967" ,
2018-12-09 09:16:03 +01:00
"tags" : [
2019-04-30 19:07:57 +02:00
"estimative-language:likelihood-probability=\"almost-certain\""
2018-12-09 09:16:03 +01:00
] ,
2019-04-30 19:07:57 +02:00
"type" : "uses"
2018-12-09 09:16:03 +01:00
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "6faf650d-bf31-4eb4-802d-1000cf38efaf" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "731f4f55-b6d0-41d1-a7a9-072a66389aea" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2019-04-30 19:07:57 +02:00
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "d1fcf083-a721-4223-aedf-bf8960798d62" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "120d5519-3098-4e1c-9191-2aa61232f073" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7bc57495-ea59-4380-be31-a64af124ef18" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "0259baeb-9f63-4c69-bf10-eb038c390688" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "30973a08-aed9-4edf-8604-9084ce1b5c4f" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "57340c81-c025-4189-8fa0-fc7ede51bae4" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "9efb1ea7-c37b-4595-9640-b7680cd84279" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "cc3502b5-30cc-4473-ad48-42d51a6ef6d1" ,
2018-12-09 09:16:03 +01:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
2019-04-30 19:07:57 +02:00
"uuid" : "7cd0bc75-055b-4098-a00e-83dc8beaff14" ,
"value" : "Remcos - S0332"
} ,
{
2021-04-29 18:12:36 +02:00
"description" : "[PoshC2](https://attack.mitre.org/software/S0378) is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in [PowerShell](https://attack.mitre.org/techniques/T1059/001). Although [PoshC2](https://attack.mitre.org/software/S0378) is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.(Citation: GitHub PoshC2)" ,
2019-04-30 19:07:57 +02:00
"meta" : {
"external_id" : "S0378" ,
"mitre_platforms" : [
"Windows" ,
"Linux" ,
"macOS"
] ,
"refs" : [
"https://attack.mitre.org/software/S0378" ,
2019-10-25 10:12:22 +02:00
"https://github.com/nettitude/PoshC2_Python"
2019-04-30 19:07:57 +02:00
] ,
"synonyms" : [
"PoshC2"
]
} ,
"related" : [
{
"dest-uuid" : "a93494bb-4b80-4ea1-8695-3236a49916fd" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "767dbf9e-df3f-45cb-8998-4903ab5f80c0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "650c784b-7504-4df7-ab2c-4ea882384d1e" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "9db0cf3a-a3c9-4012-8268-123b9db6fd82" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "30208d3e-0d6b-43c8-883e-44462a514619" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "120d5519-3098-4e1c-9191-2aa61232f073" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "09a60ea3-a8d1-4ae5-976e-5783248b72a4" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b21c3b2d-02e6-45b1-980b-e69051040839" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "677569f9-a8b0-459e-ab24-7f18091fa7bf" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "e624264c-033a-424d-9fd7-fc9c3bbdb03e" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "731f4f55-b6d0-41d1-a7a9-072a66389aea" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "910906dd-8c0a-475a-9cc1-5e029e2fad58" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "01a5a209-b94c-450b-b7f9-946497d91055" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "65f2d882-3f41-4d48-8a06-29af77ec9f90" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "837f9164-50af-4ac0-8219-379d8a74cefc" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "00f90846-cbd1-4fc5-9233-df5c2bf2a662" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f1951e8a-500e-4a26-8803-76d95c4554b4" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "322bad5a-1c49-4d23-ab79-76d641794afa" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7e150503-88e7-4861-866b-ff1ac82c4475" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "354a7f88-63fb-41b5-a801-ce3b377b36f1" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "a01bf75f-00b2-4568-a58f-565ff9bf202b" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b6075259-dba3-44e9-87c7-e954f37ec0d5" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e3a12395-188d-4051-9a16-ea8e14d07b88" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3257eb21-f9a7-4430-8de1-d8b6e288f529" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "21875073-b0ee-49e3-9077-1e2a885359af" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7bc57495-ea59-4380-be31-a64af124ef18" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "df8b2a25-8bdf-4856-953c-a04372b1c161" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "dcaa092b-7de9-4a21-977f-7fcb77e89c48" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "25659dd6-ea12-45c4-97e6-381e3e4b593e" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "4b57c098-f043-4da2-83ef-7588a6d426bc" ,
"value" : "PoshC2 - S0378"
} ,
2021-04-29 18:12:36 +02:00
{
"description" : "[AdFind](https://attack.mitre.org/software/S0552) is a free command-line query tool that can be used for gathering information from Active Directory.(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: FireEye FIN6 Apr 2019)(Citation: FireEye Ryuk and Trickbot January 2019)" ,
"meta" : {
"external_id" : "S0552" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0552" ,
"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/ " ,
"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html" ,
"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"
] ,
"synonyms" : [
"AdFind"
]
} ,
"related" : [
{
"dest-uuid" : "767dbf9e-df3f-45cb-8998-4903ab5f80c0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e358d692-23c0-4a31-9eb6-ecc13a8d7735" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "21875073-b0ee-49e3-9077-1e2a885359af" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "2aed01ad-3df3-4410-a8cb-11ea4ded587c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "f59508a6-3615-47c3-b493-6676e1a39a87" ,
"value" : "AdFind - S0552"
} ,
{
"description" : "[RemoteUtilities](https://attack.mitre.org/software/S0592) is a legitimate remote administration tool that has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least 2021 for execution on target machines.(Citation: Trend Micro Muddy Water March 2021)" ,
"meta" : {
"external_id" : "S0592" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0592" ,
"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"
] ,
"synonyms" : [
"RemoteUtilities"
]
} ,
"related" : [
{
"dest-uuid" : "365be77f-fc0e-42ee-bac8-4faf806d9336" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7bc57495-ea59-4380-be31-a64af124ef18" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "0259baeb-9f63-4c69-bf10-eb038c390688" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "03c6e0ea-96d3-4b23-9afb-05055663cf4b" ,
"value" : "RemoteUtilities - S0592"
} ,
2019-04-30 19:07:57 +02:00
{
"description" : "[Xbot](https://attack.mitre.org/software/S0298) is an Android malware family that was observed in 2016 primarily targeting Android users in Russia and Australia. (Citation: PaloAlto-Xbot)" ,
"meta" : {
"external_id" : "S0298" ,
"mitre_platforms" : [
"Android"
] ,
"refs" : [
"https://attack.mitre.org/software/S0298" ,
"http://researchcenter.paloaltonetworks.com/2016/02/new-android-trojan-xbot-phishes-credit-cards-and-bank-accounts-encrypts-devices-for-ransom/"
] ,
"synonyms" : [
"Xbot"
]
} ,
"related" : [
{
"dest-uuid" : "e683cd91-40b4-4e1c-be25-34a27610a22e" ,
"tags" : [
"estimative-language:likelihood-probability=\"likely\""
] ,
"type" : "similar"
} ,
{
"dest-uuid" : "4cfa42a3-71d9-43e2-bf23-daa79f326387" ,
"tags" : [
"estimative-language:likelihood-probability=\"likely\""
] ,
"type" : "similar"
} ,
{
"dest-uuid" : "5a78ec38-8b93-4dde-a99e-0c9b77674838" ,
"tags" : [
"estimative-language:likelihood-probability=\"likely\""
] ,
"type" : "similar"
} ,
{
"dest-uuid" : "e8b4e1ec-8e3b-484c-9038-4459b1ed8060" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "9d7c32f4-ab39-49dc-8055-8106bc2294a1" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3dd58c80-4c2e-458c-9503-1b2cd273c4d2" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "d9e88203-2b5d-405f-a406-2933b1e3d7e4" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "da21929e-40c0-443d-bdf4-6b60d15448b4" ,
"value" : "Xbot - S0298"
} ,
{
2021-04-29 18:12:36 +02:00
"description" : "[Empire](https://attack.mitre.org/software/S0363) is an open source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure [PowerShell](https://attack.mitre.org/techniques/T1059/001) for Windows and Python for Linux/macOS. [Empire](https://attack.mitre.org/software/S0363) was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.(Citation: NCSC Joint Report Public Tools)(Citation: Github PowerShell Empire)(Citation: GitHub ATTACK Empire)" ,
2019-04-30 19:07:57 +02:00
"meta" : {
"external_id" : "S0363" ,
"mitre_platforms" : [
"Linux" ,
"macOS" ,
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0363" ,
2021-04-29 18:12:36 +02:00
"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools" ,
"https://github.com/EmpireProject/Empire" ,
2019-04-30 19:07:57 +02:00
"https://github.com/dstepanic/attck_empire"
] ,
"synonyms" : [
"Empire" ,
"EmPyre" ,
"PowerShell Empire"
]
} ,
"related" : [
{
"dest-uuid" : "5e4a2073-9643-44cb-a0b5-e7f4048446c7" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "09a60ea3-a8d1-4ae5-976e-5783248b72a4" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "837f9164-50af-4ac0-8219-379d8a74cefc" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "65f2d882-3f41-4d48-8a06-29af77ec9f90" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "6faf650d-bf31-4eb4-802d-1000cf38efaf" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "d1fcf083-a721-4223-aedf-bf8960798d62" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7bc57495-ea59-4380-be31-a64af124ef18" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "30973a08-aed9-4edf-8604-9084ce1b5c4f" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "768dce68-8d0d-477a-b01d-0eea98b963a1" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "60b508a1-6a5e-46b1-821a-9f7b78752abf" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f2877f7f-9a4c-4251-879f-1224e3006bee" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "0259baeb-9f63-4c69-bf10-eb038c390688" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3257eb21-f9a7-4430-8de1-d8b6e288f529" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "650c784b-7504-4df7-ab2c-4ea882384d1e" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f5946b5e-9408-485f-a7f7-b5efc88909b6" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7385dfaf-6886-4229-9ecd-6fd678040830" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "970a3432-3237-47ad-bcca-7d8cbb217736" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f1951e8a-500e-4a26-8803-76d95c4554b4" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "68a0c5ed-bee2-4513-830d-5b0d650139bd" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "9db0cf3a-a3c9-4012-8268-123b9db6fd82" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "677569f9-a8b0-459e-ab24-7f18091fa7bf" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "e624264c-033a-424d-9fd7-fc9c3bbdb03e" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "2db31dcd-54da-405d-acef-b9129b816ed6" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "005a06c6-14bf-4118-afa0-ebcd8aebb0c9" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "01a5a209-b94c-450b-b7f9-946497d91055" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "70e52b04-2a0c-4cea-9d18-7149f1df9dc5" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e3a12395-188d-4051-9a16-ea8e14d07b88" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "2fee9321-3e71-4cf4-af24-d4d40d355b34" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "2959d63f-73fd-46a1-abd2-109d7dcede32" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b21c3b2d-02e6-45b1-980b-e69051040839" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "5095a853-299c-4876-abd7-ac0050fb5462" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "120d5519-3098-4e1c-9191-2aa61232f073" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "b7dc639b-24cd-482d-a7f1-8897eda21023" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "635cbe30-392d-4e27-978e-66774357c762" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "1e9eb839-294b-48cc-b0d3-c45555a2a004" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "47f2d673-ca62-47e9-929b-1b0be9657611" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "9efb1ea7-c37b-4595-9640-b7680cd84279" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "21875073-b0ee-49e3-9077-1e2a885359af" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "df8b2a25-8bdf-4856-953c-a04372b1c161" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "f879d51c-5476-431c-aedf-f14d207e4d1e" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "bf1b6176-597c-4600-bfcd-ac989670f96b" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "92d7da27-2d91-488e-a00c-059dc162766d" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3489cfc5-640f-4bb3-a103-9137b97de79f" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "8f4a33ec-8b1f-4b80-a2f6-642b2e479580" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7e150503-88e7-4861-866b-ff1ac82c4475" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "354a7f88-63fb-41b5-a801-ce3b377b36f1" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "cba37adb-d6fb-4610-b069-dd04c0643384" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "bf176076-b789-408e-8cba-7275e81c0ada" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "391d824f-0ef1-47a0-b0ee-c59a75e27670" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2021-04-29 18:12:36 +02:00
"dest-uuid" : "5d2be8b9-d24c-4e98-83bf-2f5f79477163" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "767dbf9e-df3f-45cb-8998-4903ab5f80c0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2019-10-25 10:12:22 +02:00
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "58a3e6aa-4453-4cc8-a51f-4befe80b31a8" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7610cada-1499-41a4-b3dd-46467b68d177" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "86a96bf6-cf8b-411c-aaeb-8959944d64f7" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "dcaa092b-7de9-4a21-977f-7fcb77e89c48" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "d273434a-448e-4598-8e14-607f4a0d5e27" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "25659dd6-ea12-45c4-97e6-381e3e4b593e" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "0c2d00da-7742-49e7-9928-4514e5075d32" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "58af3705-8740-4c68-9329-ec015a7013c2" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "bf96a5a3-3bce-43b7-8597-88545984c07b" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "c92e3d68-2349-49e4-a341-7edca2deff96" ,
2019-10-25 10:12:22 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2021-04-29 18:12:36 +02:00
} ,
{
"dest-uuid" : "fc742192-19e3-466c-9eb5-964a97b29490" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2021-10-22 14:34:25 +02:00
} ,
{
"dest-uuid" : "1b20efbf-8063-4fc3-a07d-b575318a301b" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2019-04-30 19:07:57 +02:00
}
] ,
"uuid" : "3433a9e8-1c47-4320-b9bf-ed449061d1c3" ,
"value" : "Empire - S0363"
} ,
2021-10-22 14:34:25 +02:00
{
"description" : "[Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control framework written in Golang.(Citation: Bishop Fox Sliver Framework August 2019)" ,
"meta" : {
"external_id" : "S0633" ,
"mitre_platforms" : [
"Windows" ,
"Linux" ,
"macOS"
] ,
"refs" : [
"https://attack.mitre.org/software/S0633" ,
"https://labs.bishopfox.com/tech-blog/sliver"
] ,
"synonyms" : [
"Sliver"
]
} ,
"related" : [
{
"dest-uuid" : "1996eef1-ced3-4d7f-bf94-33298cabbf72" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "bf176076-b789-408e-8cba-7275e81c0ada" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "df8b2a25-8bdf-4856-953c-a04372b1c161" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "dcaa092b-7de9-4a21-977f-7fcb77e89c48" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "04fd5427-79c7-44ea-ae13-11b24778ff1c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "eec23884-3fa1-4d8a-ac50-6f104d51e235" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "24bfaeba-cb0d-4525-b3dc-507c77ecec41" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "92d7da27-2d91-488e-a00c-059dc162766d" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "0259baeb-9f63-4c69-bf10-eb038c390688" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7e150503-88e7-4861-866b-ff1ac82c4475" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7bc57495-ea59-4380-be31-a64af124ef18" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "11f8d7eb-1927-4806-9267-3a11d4d4d6be" ,
"value" : "Sliver - S0633"
} ,
2019-04-30 19:07:57 +02:00
{
"description" : "[RawDisk](https://attack.mitre.org/software/S0364) is a legitimate commercial driver from the EldoS Corporation that is used for interacting with files, disks, and partitions. The driver allows for direct modification of data on a local computer's hard drive. In some cases, the tool can enact these raw disk modifications from user-mode processes, circumventing Windows operating system security features.(Citation: EldoS RawDisk ITpro)(Citation: Novetta Blockbuster Destructive Malware)" ,
"meta" : {
"external_id" : "S0364" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0364" ,
"https://www.itprotoday.com/windows-78/eldos-provides-raw-disk-access-vista-and-xp" ,
"https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"
] ,
"synonyms" : [
"RawDisk"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "0af0ca99-357d-4ba1-805f-674fdfb7bef9" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "fb640c43-aa6b-431e-a961-a279010424ac" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "3ffbdc1f-d2bf-41ab-91a2-c7b857e98079" ,
"value" : "RawDisk - S0364"
} ,
{
"description" : "[LaZagne](https://attack.mitre.org/software/S0349) is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. [LaZagne](https://attack.mitre.org/software/S0349) is publicly available on GitHub.(Citation: GitHub LaZagne Dec 2018)" ,
"meta" : {
"external_id" : "S0349" ,
"mitre_platforms" : [
"Linux" ,
"macOS" ,
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0349" ,
"https://github.com/AlessandroZ/LaZagne"
] ,
"synonyms" : [
"LaZagne"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "65f2d882-3f41-4d48-8a06-29af77ec9f90" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3fc9b85a-2862-4363-a64d-d692e3ffbee0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "58a3e6aa-4453-4cc8-a51f-4befe80b31a8" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "837f9164-50af-4ac0-8219-379d8a74cefc" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1ecfdab8-7d59-4c98-95d4-dc41970f57fc" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "6add2ab5-2711-4e9d-87c8-7a0be8531530" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1eaebf46-e361-4437-bc23-d5d65a3b92e3" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "3120b9fa-23b8-4500-ae73-09494f607b7d" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2019-10-25 10:12:22 +02:00
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "d0b4fcdb-d67d-4ed2-99ce-788b12f8c0f4" ,
2019-10-25 10:12:22 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2021-04-29 18:12:36 +02:00
} ,
{
"dest-uuid" : "d336b553-5da9-46ca-98a8-0b23f49fb447" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
2019-04-30 19:07:57 +02:00
}
] ,
"uuid" : "b76b2d94-60e4-4107-a903-4a3a7622fb3b" ,
"value" : "LaZagne - S0349"
} ,
{
"description" : "[Impacket](https://attack.mitre.org/software/S0357) is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. [Impacket](https://attack.mitre.org/software/S0357) contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.(Citation: Impacket Tools)" ,
"meta" : {
"external_id" : "S0357" ,
"mitre_platforms" : [
"Linux" ,
"macOS" ,
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0357" ,
"https://www.secureauth.com/labs/open-source-tools/impacket"
] ,
"synonyms" : [
"Impacket"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "1644e709-12d2-41e5-a60f-3470991f5011" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3257eb21-f9a7-4430-8de1-d8b6e288f529" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f2877f7f-9a4c-4251-879f-1224e3006bee" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "f1951e8a-500e-4a26-8803-76d95c4554b4" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "01a5a209-b94c-450b-b7f9-946497d91055" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "650c784b-7504-4df7-ab2c-4ea882384d1e" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "65f2d882-3f41-4d48-8a06-29af77ec9f90" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "edf91964-b26e-4b4a-9600-ccacd7d7df24" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1ecfdab8-7d59-4c98-95d4-dc41970f57fc" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "26c87906-d750-42c5-946c-d4162c73fc7b" ,
"value" : "Impacket - S0357"
} ,
{
"description" : "[Ruler](https://attack.mitre.org/software/S0358) is a tool to abuse Microsoft Exchange services. It is publicly available on GitHub and the tool is executed via the command line. The creators of [Ruler](https://attack.mitre.org/software/S0358) have also released a defensive tool, NotRuler, to detect its usage.(Citation: SensePost Ruler GitHub)(Citation: SensePost NotRuler)" ,
"meta" : {
"external_id" : "S0358" ,
"mitre_platforms" : [
2020-10-18 20:00:48 +02:00
"Windows" ,
"Office 365"
2019-04-30 19:07:57 +02:00
] ,
"refs" : [
"https://attack.mitre.org/software/S0358" ,
"https://github.com/sensepost/ruler" ,
"https://github.com/sensepost/notruler"
] ,
"synonyms" : [
"Ruler"
]
} ,
"related" : [
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "4bc31b94-045b-4752-8920-aebaebdb6470" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "bf147104-abf9-4221-95d1-e81585859441" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3d1b9d7e-3921-4d25-845a-7d9f15c0da44" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
2020-10-18 20:00:48 +02:00
"dest-uuid" : "a9e2cea0-c805-4bf8-9e31-f5f0513a3634" ,
2019-04-30 19:07:57 +02:00
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "90ac9266-68ce-46f2-b24f-5eb3b2a8ea38" ,
"value" : "Ruler - S0358"
} ,
{
"description" : "[Nltest](https://attack.mitre.org/software/S0359) is a Windows command-line utility used to list domain controllers and enumerate domain trusts.(Citation: Nltest Manual)" ,
"meta" : {
"external_id" : "S0359" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0359" ,
"https://ss64.com/nt/nltest.html"
] ,
"synonyms" : [
"Nltest"
]
} ,
"related" : [
{
"dest-uuid" : "767dbf9e-df3f-45cb-8998-4903ab5f80c0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e358d692-23c0-4a31-9eb6-ecc13a8d7735" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "981acc4c-2ede-4b56-be6e-fa1a75f37acf" ,
"value" : "Nltest - S0359"
2020-10-18 20:00:48 +02:00
} ,
{
"description" : "[ShimRatReporter](https://attack.mitre.org/software/S0445) is a tool used by suspected Chinese adversary [Mofang](https://attack.mitre.org/groups/G0103) to automatically conduct initial discovery. The details from this discovery are used to customize follow-on payloads (such as [ShimRat](https://attack.mitre.org/software/S0444)) as well as set up faux infrastructure which mimics the adversary's targets. [ShimRatReporter](https://attack.mitre.org/software/S0445) has been used in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development.(Citation: FOX-IT May 2016 Mofang)" ,
"meta" : {
"external_id" : "S0445" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0445" ,
"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"
] ,
"synonyms" : [
"ShimRatReporter"
]
} ,
"related" : [
{
"dest-uuid" : "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "72b74d71-8169-42aa-92e0-e7b04b9f5a08" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "8f4a33ec-8b1f-4b80-a2f6-642b2e479580" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "354a7f88-63fb-41b5-a801-ce3b377b36f1" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "df8b2a25-8bdf-4856-953c-a04372b1c161" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "774a3188-6ba9-4dc4-879d-d54ee48a5ce9" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "30208d3e-0d6b-43c8-883e-44462a514619" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "15dbf668-795c-41e6-8219-f0447c0e64ce" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e3b6daca-e963-4a69-aee6-ed4fd653ad58" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7e150503-88e7-4861-866b-ff1ac82c4475" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "391d824f-0ef1-47a0-b0ee-c59a75e27670" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "92d7da27-2d91-488e-a00c-059dc162766d" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "115f88dd-0618-4389-83cb-98d33ae81848" ,
"value" : "ShimRatReporter - S0445"
} ,
{
"description" : "[CARROTBALL](https://attack.mitre.org/software/S0465) is an FTP downloader utility that has been in use since at least 2019. [CARROTBALL](https://attack.mitre.org/software/S0465) has been used as a downloader to install [SYSCON](https://attack.mitre.org/software/S0464).(Citation: Unit 42 CARROTBAT January 2020)" ,
"meta" : {
"external_id" : "S0465" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0465" ,
"https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"
] ,
"synonyms" : [
"CARROTBALL"
]
} ,
"related" : [
{
"dest-uuid" : "9a60a291-8960-4387-8a4a-2ab5c18bb50b" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e6919abc-99f9-4c6c-95a5-14761e7b2add" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "232b7f21-adf9-4b42-b936-b9d6f7df856e" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "5fc81b43-62b5-41b1-9113-c79ae5f030c4" ,
"value" : "CARROTBALL - S0465"
2020-11-25 07:45:48 +01:00
} ,
2021-10-22 14:34:25 +02:00
{
"description" : "[Wevtutil](https://attack.mitre.org/software/S0645) is a Windows command-line utility that enables administrators to retrieve information about event logs and publishers.(Citation: Wevtutil Microsoft Documentation)" ,
"meta" : {
"external_id" : "S0645" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0645" ,
"https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil"
] ,
"synonyms" : [
"Wevtutil"
]
} ,
"related" : [
{
"dest-uuid" : "4eb28bed-d11a-4641-9863-c2ac017d910a" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3c4a2599-71ee-4405-ba1e-0e28414b4bc5" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "6495ae23-3ab4-43c5-a94f-5638a2c31fd2" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "f91162cc-1686-4ff8-8115-bf3f61a4cc7a" ,
"value" : "Wevtutil - S0645"
} ,
2020-11-25 07:45:48 +01:00
{
"description" : "[CrackMapExec](https://attack.mitre.org/software/S0488), or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. [CrackMapExec](https://attack.mitre.org/software/S0488) collects Active Directory information to conduct lateral movement through targeted networks.(Citation: CME Github September 2018)" ,
"meta" : {
"external_id" : "S0488" ,
"mitre_platforms" : [
"Windows"
] ,
"refs" : [
"https://attack.mitre.org/software/S0488" ,
"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"
] ,
"synonyms" : [
"CrackMapExec"
]
} ,
"related" : [
{
"dest-uuid" : "707399d6-ab3e-4963-9315-d9d3818cd6a0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "57340c81-c025-4189-8fa0-fc7ede51bae4" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e624264c-033a-424d-9fd7-fc9c3bbdb03e" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "970a3432-3237-47ad-bcca-7d8cbb217736" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "354a7f88-63fb-41b5-a801-ce3b377b36f1" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "2aed01ad-3df3-4410-a8cb-11ea4ded587c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "01a5a209-b94c-450b-b7f9-946497d91055" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "edf91964-b26e-4b4a-9600-ccacd7d7df24" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "3489cfc5-640f-4bb3-a103-9137b97de79f" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "f3d95a1f-bba2-44ce-9af7-37866cd63fd0" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1ecfdab8-7d59-4c98-95d4-dc41970f57fc" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "a93494bb-4b80-4ea1-8695-3236a49916fd" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7bc57495-ea59-4380-be31-a64af124ef18" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "692074ae-bb62-4a5e-a735-02cb6bde458c" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "b6075259-dba3-44e9-87c7-e954f37ec0d5" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "21875073-b0ee-49e3-9077-1e2a885359af" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "1644e709-12d2-41e5-a60f-3470991f5011" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "7e150503-88e7-4861-866b-ff1ac82c4475" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
} ,
{
"dest-uuid" : "e358d692-23c0-4a31-9eb6-ecc13a8d7735" ,
"tags" : [
"estimative-language:likelihood-probability=\"almost-certain\""
] ,
"type" : "uses"
}
] ,
"uuid" : "c4810609-7da6-48ec-8057-1b70a7814db0" ,
"value" : "CrackMapExec - S0488"
2017-10-26 10:28:53 +02:00
}
] ,
2021-10-22 14:34:25 +02:00
"version" : 21
2019-03-20 12:58:18 +01:00
}
