Skip to content

PoshC2

Software · ATTACK:enterprise:S0378

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0378",
  "title": "PoshC2",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0378",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--4b57c098-f043-4da2-83ef-7588a6d426bc",
  "external_id": "S0378",
  "domain": "enterprise",
  "created": "2019-04-23T12:31:58.125Z",
  "modified": "2025-04-16T20:38:51.558Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "GitHub PoshC2",
      "url": "https://github.com/nettitude/PoshC2_Python"
    }
  ]
}

Explicit source assertions (35)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--092b3643-670d-447c-b05d-f7a54a945412

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e46421a-6804-488e-adad-42cac34065be

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1557.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13f5f3ac-e16b-4b7a-8b6d-6eaf129231e7

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16e57ad0-b460-41bd-bef0-5bf110d8db8f

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c715763-19ea-475d-9d5c-8d4434b4095f

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--209075a3-e836-4894-b931-663bb785e96b

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1068

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--248b1bfc-5f9a-4f2c-ad6c-556045d9e83b

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0378

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27f3f0b2-4743-420d-a4dd-842de6cb9e70

FireEye APT33 Guardrail · Symantec Elfin Mar 2019

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--317b8a78-1c04-4cd7-a249-619bacfc7a44

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1134.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--331528b5-fe7e-4ca4-ad3a-c18b20298f28

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3657d3de-d279-47f0-ab54-68ca82f4536d

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37b7ba1e-5093-4a0d-920b-c86d3c9c766b

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--426daf58-7fab-49c8-b5cb-722f3e46a75a

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45d6e0d0-5de1-4382-ae08-acf4f035a740

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59fe8c5d-f008-4be7-a187-39d70073914d

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f8f4204-228c-49d3-8ec6-863b13038001

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60f2ddcf-9b88-4a87-8baf-2777c9c49d39

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--617ce344-2317-433a-b283-8e67b90b00f7

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64f33d8d-6060-40ab-8fbb-bd8b249702f7

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1069.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75fcbeab-4f32-4e6d-a02a-9d5509fd4c4f

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7af39008-1480-4524-b8ce-e285628f61be

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82758a74-b7e2-4839-ad52-bdc6c57c0dba

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1110

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8303719d-b2ed-4860-9af4-57b636c4f865

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c1446c4-66b2-4b70-96df-7fd2414522be

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95fac0e8-32e3-4854-b542-5eb897d76f2e

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1210

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd1282fe-7a81-432b-9ac7-f93fb8f8b33f

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8f79da7-cfd6-41fd-89d4-c015e7289b64

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1134

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb498ebf-bdb4-476c-9b7a-1a83c19d03fb

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0378

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbc0733e-b673-41fb-8c18-e037f7794a69

mandiant_apt44_unearthing_sandworm

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e45bff55-f8b0-406b-ba7d-03af2e7be8c8

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f461e96f-1d76-4a40-ad84-8f7f7c3cc202

SecureWorks August 2019

ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:S0378

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f612ed23-f9c3-4527-b23a-3361f90f5fe1

SecureWorks August 2019

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1040

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9fb0958-7f80-4bd5-80c2-9665124f1d0e

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1546.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fbce0681-c5d2-4ea9-b48a-4fc42448f9e0

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1201

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd074370-f9d4-43a1-bf1f-0afdb46ab28b

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.