QUADAGENT
Software · ATTACK:enterprise:S0269
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0269",
"title": "QUADAGENT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0269",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--7e6c2a9d-9dc1-4eb0-b27c-91e8076a9d77",
"external_id": "S0269",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2025-04-16T20:38:19.712Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "QUADAGENT"
},
{
"source_name": "Unit 42 QUADAGENT July 2018",
"url": "https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"
}
]
}Explicit source assertions (18)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1071.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01292102-1f89-4358-b62c-bc0afd49fc52
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c225034-209b-4ea5-b311-65ee9e82f8fe
Unit 42 QUADAGENT July 2018ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0269
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1652bf3a-085a-4388-839a-04858b14affd
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--198cddce-40f7-43eb-aeac-60171f111065
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37f48df4-80b1-4f5b-917c-8ac699e5cc0e
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69b07a47-2d70-4672-9771-92fa4280b3d3
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c130246-6222-4395-8edc-cb325b437696
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b5178ce-a9bc-405e-b062-22b4276fbf99
GitHub Invoke-Obfuscation · Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80c122f6-6aea-4e27-aff2-09467bc4a628
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86b103ec-dfa0-4c0a-ad96-b885345b4711
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1027.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91aa29c1-28a9-414a-aa3c-a6293b8d078f
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b80516ee-1635-43da-babf-201d9f76c1d8
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2e58b40-7644-4c0c-92ac-b63a565aca44
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d42a4f15-98c5-43df-9e25-7455a764070d
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc4bc74b-cd60-4853-a436-8d5e34b01564
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0999d7e-deec-446b-a86b-4c8988e20a96
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fc52b3a9-96b2-4595-bedf-54289a42117a
Unit 42 QUADAGENT July 2018ATTACK:enterprise:S0269 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff2b7bc3-d6ca-488a-bdd5-1f2f27dfc8bd
Unit 42 QUADAGENT July 2018