PoetRAT
Software · ATTACK:enterprise:S0428
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0428",
"title": "PoetRAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0428",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--cc5497f7-a9e8-436f-94da-b2b4a9b9ad3c",
"external_id": "S0428",
"domain": "enterprise",
"created": "2020-04-27T20:21:16.487Z",
"modified": "2024-08-05T18:24:31.652Z",
"version": "2.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Dragos Threat Report 2020",
"url": "https://hub.dragos.com/hubfs/Year-in-Review/Dragos_2020_ICS_Cybersecurity_Year_In_Review.pdf?hsCtaTracking=159c0fc3-92d8-425d-aeb8-12824f2297e8%7Cf163726d-579b-4996-9a04-44e5a124d770"
},
{
"source_name": "Talos PoetRAT April 2020",
"url": "https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"
},
{
"source_name": "Talos PoetRAT October 2020",
"url": "https://blog.talosintelligence.com/2020/10/poetrat-update.html"
}
]
}Explicit source assertions (35)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00e25bca-7df1-464e-94a4-cc13124e1d0c
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03f69381-89e2-411a-8302-323c8a1bddfa
Talos PoetRAT October 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1071.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a0c827d-98ba-4f95-a6ef-b0a34765d0f4
Talos PoetRAT October 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bb3a317-c459-4c7f-b47b-c0521d15bf62
Talos PoetRAT October 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17db0e04-2e71-4f29-9086-266503e6d000
Talos PoetRAT October 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1048
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b29f7b8-78fe-4bae-b943-59641a12a023
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20118b8d-dc6e-4c71-8d99-789901c10e73
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--207f1084-a466-4e08-a157-886db373f09a
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2606ed25-9f1d-4e85-822a-af39ce0d8e66
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29686ce0-db1e-4d77-a21c-7b1e97ee51ac
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2bcaf336-cd02-47e3-b73f-6f0c5cc3592f
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3337112a-0b29-450f-9183-a0ec428c4898
Talos PoetRAT April 2020 · Talos PoetRAT October 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3758634e-bb33-4354-98f3-b662e8e7e83f
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1119
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47aebf09-4bee-4639-94e3-27b095d7558a
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52ad9918-ffba-4897-bbdc-261504094339
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1048.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--613ba18d-d23b-443a-9e1a-c2d564132fe2
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6340a1e8-4880-4c91-b4fd-ce909b35b87f
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64f0efcd-e46a-4bcf-9cbe-4c890e13c01b
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d1818b1-0a98-4a1f-9c89-9c44f305e447
Talos PoetRAT October 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77d954c5-de84-4f4b-98b6-5ad35603ae7a
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1559.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ed3bfbd-41a7-46c4-acf7-43330dd50784
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9dcf5d9f-7e68-4a5c-a51c-f3c87d5833cd
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab2602d5-a3f5-45d2-a522-9b4f87bc7a24
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b078c987-40be-459f-9045-4b2b92cc145b
Talos PoetRAT April 2020 · Talos PoetRAT October 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c46db015-9917-4c7b-8152-c6ad1394baf7
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d32fb833-c8ad-4d04-b998-3d62a6916966
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9338b91-b07b-4ea1-9e2f-4fe06e58ce62
Talos PoetRAT April 2020 · Dragos Threat Report 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df0ee75f-5e10-40d7-a0ac-e6c281e0d4b9
Talos PoetRAT October 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e159049f-70c1-4349-b299-c1d99d06901d
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1059.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3c9ddee-8ace-4847-81ea-f7dfb8936d3b
Talos PoetRAT October 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7f60c3a-5b9e-4175-8bac-72773f580dad
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eeb86f2c-852e-42e6-8809-8d244727bdfe
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3927864-d7dd-4bf3-8b2a-2a5445eb4004
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f64733fd-acc7-4570-90ee-79c117c37d7e
Talos PoetRAT April 2020ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fac88cac-2935-4c68-af9f-c16fb93d6eac
Talos PoetRAT April 2020