Dok
Software · ATTACK:enterprise:S0281
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0281",
"title": "Dok",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0281",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--f36b2598-515f-4345-84e5-5ccde253edbe",
"external_id": "S0281",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2024-11-17T17:15:10.558Z",
"version": "2.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Dok"
},
{
"source_name": "Retefe"
},
{
"source_name": "hexed osx.dok analysis 2019",
"url": "https://web.archive.org/web/20221007144948/http://www.hexed.in/2019/07/osxdok-analysis.html"
},
{
"source_name": "CheckPoint Dok",
"url": "https://blog.checkpoint.com/2017/04/27/osx-malware-catching-wants-read-https-traffic/"
},
{
"source_name": "objsee mac malware 2017",
"url": "https://objective-see.com/blog/blog_0x25.html"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1557
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--135df9c1-63cf-4323-a803-6d54a9ac8b22
objsee mac malware 2017 · CheckPoint DokATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30db098c-7e7b-42bc-b4dc-f2b54e7dde65
hexed osx.dok analysis 2019ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1543.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4065a71f-ae1b-4dfc-9825-56d2af6d589c
objsee mac malware 2017 · CheckPoint DokATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1059.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79958f80-16ca-4287-b691-9c748d6baf66
objsee mac malware 2017ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1222.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8cb06251-a974-439f-8c36-a3fc65b7d154
CheckPoint DokATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1048.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96667f6c-e625-4696-92b5-d65d142b3f43
hexed osx.dok analysis 2019ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1553.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97c225e6-64ad-42af-8cc4-4fb4deea39fc
hexed osx.dok analysis 2019 · objsee mac malware 2017ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1548.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1ca87ad-0cfc-48e7-a0e4-cee3d81cf917
hexed osx.dok analysis 2019ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1056.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7744970-817e-43c6-89e4-86907ac20361
objsee mac malware 2017ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9bf9268-1c45-4293-a5c2-c493556ad546
objsee mac malware 2017ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1547.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3e06c85-ec0b-4e6d-b1f0-f65ff9bc5e3a
hexed osx.dok analysis 2019