esentutl
Software · ATTACK:enterprise:S0404
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0404",
"title": "esentutl",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0404",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--c256da91-6dd5-40b2-beeb-ee3b22ab3d27",
"external_id": "S0404",
"domain": "enterprise",
"created": "2019-09-03T18:25:36.963Z",
"modified": "2023-09-28T03:45:36.045Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Microsoft Esentutl",
"url": "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh875546(v=ws.11)"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0404 → uses → ATTACK:enterprise:T1006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18d36fff-42e8-4b33-b747-9b898a594eb2
Cary Esentutl · LOLBAS EsentutlATTACK:enterprise:S0404 → uses → ATTACK:enterprise:T1570
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b10d114-ce08-4c8f-b8c6-e2ed13e04912
LOLBAS EsentutlATTACK:enterprise:S0404 → uses → ATTACK:enterprise:T1003.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4faa4943-e54e-420d-a391-350ef629e766
Cary Esentutl · LOLBAS EsentutlATTACK:enterprise:S0404 → uses → ATTACK:enterprise:T1564.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5181727e-706d-4e57-8a41-628a27e03c6c
LOLBAS EsentutlATTACK:enterprise:G0114 → uses → ATTACK:enterprise:S0404
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93bc896f-d2c2-4d6b-b231-fdc084aeed69
NCC Group Chimera January 2021ATTACK:enterprise:S0404 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb4f1b15-8382-44f9-b201-6726e83b79b0
LOLBAS EsentutlATTACK:enterprise:G1032 → uses → ATTACK:enterprise:S0404
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcbe375f-f724-4d85-a797-3a4008f7d1f5
SentinelOne INC Ransomware · SOCRadar INC Ransom January 2024ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0404
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d608c524-ad0a-4595-8fe2-4a0ec0dbf501
FireEye APT10 Sept 2018ATTACK:enterprise:S0404 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dcca4e73-fa98-4d67-8ed3-590da7a32d43
Red Canary 2021 Threat Detection Report March 2021