Caterpillar WebShell
Software · ATTACK:enterprise:S0572
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0572",
"title": "Caterpillar WebShell",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0572",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--751b77e6-af1f-483b-93fe-eddf17f92a64",
"external_id": "S0572",
"domain": "enterprise",
"created": "2021-02-10T18:20:51.309Z",
"modified": "2025-04-25T14:43:46.592Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Caterpillar WebShell"
},
{
"source_name": "ClearSky Lebanese Cedar Jan 2021",
"url": "https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"
},
{
"source_name": "CheckPoint Volatile Cedar March 2015",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"
}
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--333c5688-edc4-40ba-a382-e98f4473d8c7
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33deb846-1334-4eb7-98fc-faff39b3ad16
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37fd810c-c64d-482b-98d5-5a19ce77f9f6
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f824a1b-70d5-4859-bd55-6b084f602a52
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cf22fd0-af3a-41b7-b0ad-07b73b6d5516
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:G0123 → uses → ATTACK:enterprise:S0572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b642677-f57c-4eb7-9e9e-33e12de48cd1
ClearSky Lebanese Cedar Jan 2021 · CheckPoint Volatile Cedar March 2015ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6188b02d-e7cb-417a-9093-e2d2eea5883f
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7542421c-f673-4f85-85ae-b4283173c48d
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ecc61b0-c0b9-4f3a-a6b4-53c88e1d9bb7
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1069.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c089e25-2028-4afb-9f05-b28d5055f444
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1c31042-ca50-4bcc-bd05-20eb48c655ef
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b844919a-e7d8-4317-9f0d-56338bae818c
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c22f5416-2726-491e-ae10-35ec32ff9173
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4dc5fe6-fbfb-4718-8a7f-cd1eca70db61
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f16c71ae-99b1-4aff-b276-13eb7c3ad889
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f46bb223-1276-4266-b653-d6b8c2943adf
ClearSky Lebanese Cedar Jan 2021