aol.pm

Hikit

Software · ATTACK:enterprise:S0009

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0009",
  "title": "Hikit",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0009",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--95047f03-4811-4300-922e-1ba937d53a61",
  "external_id": "S0009",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:14.124Z",
  "modified": "2024-11-17T15:43:38.148Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "FireEye Hikit Rootkit",
      "url": "https://web.archive.org/web/20190216180458/https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html"
    },
    {
      "source_name": "Novetta-Axiom",
      "url": "https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"
    }
  ]
}

Explicit source assertions (12)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1566

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0866161a-0753-44ab-bb14-a977654ddc68

Novetta-Axiom

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ad315e2-1693-427a-9a04-a613bd0e2f22

FireEye Hikit Rootkit

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c29e6cf-a177-4578-bf1f-fd73ae254edd

Novetta-Axiom

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1553.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c92afd0-50e1-42a7-97e0-6cec9b4f40cb

FireEye HIKIT Rootkit Part 2

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--667c86bd-54f8-4602-a94a-054195de2808

FireEye HIKIT Rootkit Part 2

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8eac6ff8-7c47-4a81-94ad-e5844d2533f1

FireEye HIKIT Rootkit Part 2

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1553.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a78f409-0f6b-41fd-a18f-f38366e4703e

Sood and Enbody

ATTACK:enterprise:G0001 → uses → ATTACK:enterprise:S0009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8122755-90fe-4b68-8fa1-55ed7be90931

Cisco Group 72 · Novetta-Axiom

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1014

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aacb43b8-2d3a-40bc-9f7b-1acb5b2474f2

FireEye Hikit Rootkit · FireEye HIKIT Rootkit Part 2

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7c40b1d-efe6-4869-9754-6494d45f51f1

Novetta-Axiom

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd82187a-7a40-45c3-a1d2-66d37bc6146e

Novetta-Axiom

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb0206c4-ed10-4922-9935-cbb2c7462acd

Novetta-Axiom

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.