Cardinal RAT
Software · ATTACK:enterprise:S0348
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0348",
"title": "Cardinal RAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0348",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--b879758f-bbc4-4cab-b5ba-177ac9b009b4",
"external_id": "S0348",
"domain": "enterprise",
"created": "2019-01-30T16:39:53.573Z",
"modified": "2024-04-11T02:47:11.431Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Cardinal RAT"
},
{
"source_name": "PaloAlto CardinalRat Apr 2017",
"url": "https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"
}
]
}Explicit source assertions (22)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ffac810-9c9e-4060-9902-737085ba8bc5
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e83c5c4-76f3-46a3-980f-0063069671cf
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3572a770-9151-42d5-82b5-360002725052
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--395fbd2c-7827-49b3-8121-72d54181f0b1
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--458eebea-e73b-4417-9ce0-11417f6b0289
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d6a3a5b-58c2-4dab-8710-fe7e6b893f98
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7571e0ac-281a-495b-bc7a-9cffd7dfc09f
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1560.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--811ad4bc-198d-400a-a5f0-10d0ef856794
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8875e27f-9f8d-418b-8937-a2c4d1858607
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1027.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94bb62b3-e917-47cb-a717-560b28ea3d56
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a03d084b-c216-4962-93e8-6c0dc8f0cb91
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a24d8975-fa51-4ac1-b928-9af5b5660109
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2e37152-fda1-4d4f-8d9b-3ad85f1f764e
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bfe474ce-d88f-4372-9918-a04470ba080e
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c50c585a-b5c4-41c7-91a2-b6bb14b7e1f0
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1008
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3e0b0b8-797f-4638-bcb6-aa688c3a0a9a
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d53cb718-c7a5-42e5-bc2b-dc14ceebbb17
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7983dcd-1970-4d84-82e7-a61d2125caeb
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df05fecd-1eee-4139-8090-794a3310b478
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed51de86-8e28-4436-a663-94b66f22a7df
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f44842c1-f17d-4bb0-8803-3eee13cf831e
PaloAlto CardinalRat Apr 2017ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff950ea2-2982-4bfd-8361-7755e83778fd
PaloAlto CardinalRat Apr 2017