netstat
Software · ATTACK:enterprise:S0104
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0104",
"title": "netstat",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0104",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--4664b683-f578-434f-919b-1c1aad2a1111",
"external_id": "S0104",
"domain": "enterprise",
"created": "2017-05-31T21:33:04.545Z",
"modified": "2026-05-12T15:12:00.740Z",
"version": "1.4",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "TechNet Netstat",
"url": "https://technet.microsoft.com/en-us/library/bb490947.aspx"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03affe06-c8b3-436d-84c2-b5943f37ff47
FoxIT Wocao December 2019ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14080577-f5de-46fd-b363-e3f4b4e73495
Kaspersky Lyceum October 2021ATTACK:enterprise:S0104 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28189361-4cd2-4925-a095-d7ebd07ebd57
TechNet NetstatATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--325ccde0-2d5a-4306-9c4e-e1a554ee0d87
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and StrongATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3643f451-322d-4f38-91a4-00a55a42c7f5
Kaspersky TurlaATTACK:enterprise:G0071 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d988f8f-2448-409c-ac41-4a507bb8cf23
Symantec Orangeworm April 2018ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f27ef2a-48e8-4d37-8618-fe61dfcafd3e
FireEye APT41 Aug 2019ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5744b31d-6633-44ca-8170-17489fec124c
Palo Alto OilRig May 2016 · FireEye APT34 Dec 2017 · Symantec Crambus OCT 2023ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b38c61f-d128-4496-a15f-c91d121b39f6
Trend Micro DRBControl February 2020ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b55c302-7e18-4727-a27d-6e4f0b3cecd6
Kaspersky ToddyCat Check Logs October 2023ATTACK:enterprise:C0026 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0bf4e01-2df1-4256-90fe-a504c76c6baf
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:C0007 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce903557-bfa5-4796-be0a-9211f08da2e7
Bitdefender FunnyDream Campaign November 2020ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d75ee2bd-801c-4521-8d70-f5e2d64c87f9
FireEye admin@338ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db5e78f9-bddd-4f56-870a-b56ea33d4032
CERT PolskaATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1a885f7-b364-4f39-a15c-37dd59b9be7e
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eef3ac92-4c31-4401-84fe-b6e298610ed9
Mandiant Pulse Secure Update May 2021