Raindrop
Software · ATTACK:enterprise:S0565
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0565",
"title": "Raindrop",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0565",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--4efc3e00-72f2-466a-ab7c-8a7dc6603b19",
"external_id": "S0565",
"domain": "enterprise",
"created": "2021-01-19T19:43:27.828Z",
"modified": "2024-04-11T00:23:21.599Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Raindrop"
},
{
"source_name": "Microsoft Deep Dive Solorigate January 2021",
"url": "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"
},
{
"source_name": "Symantec RAINDROP January 2021",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1497.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00701b4a-9eab-41cc-9c09-f904a9799201
Symantec RAINDROP January 2021ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03cd94c9-73aa-4eed-b724-629d180e3002
Microsoft Deep Dive Solorigate January 2021 · Symantec RAINDROP January 2021ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c8951ff-5de9-4842-b889-0c439aa76e8f
Symantec RAINDROP January 2021 · Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--288d8f70-d2af-44f8-86c9-fb8c2cd5103f
Symantec RAINDROP January 2021 · Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a942244-9b88-43d0-9a1c-c0277e7903e8
Symantec RAINDROP January 2021 · Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0565
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a45bd763-a162-4b02-86f2-6042ff0eaa4a
MSTIC Nobelium Toolset May 2021 · Secureworks IRON RITUAL Profile · Symantec RAINDROP January 2021ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1027.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6572007-a3f6-40d1-bfd2-37abf6a63b58
Symantec RAINDROP January 2021ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:S0565
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7f2fab9-7a97-4892-9fee-fe9b98c8f0a0
Microsoft Deep Dive Solorigate January 2021 · Symantec RAINDROP January 2021ATTACK:enterprise:S0565 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff10b414-cc17-4335-9030-1262e5401b39
Symantec RAINDROP January 2021 · Microsoft Deep Dive Solorigate January 2021