Skip to content

RDAT

Software · ATTACK:enterprise:S0495

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0495",
  "title": "RDAT",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0495",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--4b346d12-7f91-48d2-8f06-b26ffa0d825b",
  "external_id": "S0495",
  "domain": "enterprise",
  "created": "2020-07-28T17:26:36.168Z",
  "modified": "2025-04-25T14:43:13.198Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Unit42 RDAT July 2020",
      "url": "https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/"
    }
  ]
}

Explicit source assertions (21)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00f4c60b-36c4-4ec5-affd-38f89687d957

Unit42 RDAT July 2020

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0495

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0783831d-da64-4bb3-a54e-c5149e7e0d76

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1027.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15698fb0-12df-4135-8ecb-093e9fd268a2

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--240ba2e0-c718-4327-a6a6-cb35d6145c35

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34810a1f-a9bd-4f1b-bbdc-4e8c4ec1ef21

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d70f1d9-366a-4510-91f6-fe15ca06d7a8

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4899bf68-d60e-4132-a962-faafd35f0c4a

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49d50fde-cfbc-4007-befc-f4b22b9bc9f5

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4de4cf78-542c-4f7a-a83b-f876a59e2553

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1132.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ef6ff08-0567-4366-a1df-13184c460cc4

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61ce8307-ddb8-4f29-ab77-6532c2b90266

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63b6fd1d-65a7-4c94-8045-16fd198802f1

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1573.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78665233-dd3d-4a86-981f-4342e4e0cbee

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1071.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--804fb819-6b91-4295-aec9-b9299fb3472b

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1001.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a760c63f-6459-430d-88ce-291513c47d11

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1030

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a901b584-c676-4419-9357-943de685114e

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abca8fe1-0303-43a8-b469-a7921358a3f1

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4445491-4549-4333-b6b8-034ab4932295

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cfff835f-4c2b-4c90-b316-3807796269fc

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d96db78c-e7b8-4877-8187-07c5e801cead

Unit42 RDAT July 2020

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd4423f6-b526-4856-aa00-2c4aa36617da

Unit42 RDAT July 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.