Waterbear
Software · ATTACK:enterprise:S0579
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0579",
"title": "Waterbear",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0579",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--f3f1fbed-7e29-49cb-8579-4a378f858deb",
"external_id": "S0579",
"domain": "enterprise",
"created": "2021-02-22T16:35:33.673Z",
"modified": "2024-04-10T22:14:28.440Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Waterbear"
},
{
"source_name": "Trend Micro Waterbear December 2019",
"url": "https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44bbd0e1-acdf-458c-934c-a64e8a7a371c
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1055.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4aa3b66d-f312-4f1f-912a-b7b1762f9d82
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56e0b679-1c1b-4c82-9346-bde619c21117
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c3a903f-5934-48ec-84da-e88e0d1b4e68
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--631ba90c-982c-4415-a13c-75cf06e53252
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e73108a-836f-47ad-b88a-6b9a70ebcb7b
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b6c1b21-67e7-4930-82e3-8b13d8aac0ce
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88d6a08e-2e96-41de-868f-b41c07d11541
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93741cce-12ce-4cc0-9fa6-5db7d8a1309a
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b8341df-94d6-4989-9662-9af1b2233036
Trend Micro Waterbear December 2019ATTACK:enterprise:G0098 → uses → ATTACK:enterprise:S0579
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d14e6464-a6c5-4554-a463-88e267828397
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9b4c254-8e05-4410-ae4d-a47f55e6bf51
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dfcfd396-1c1f-42c0-ad12-da75d275ccc9
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1027.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e041070a-ff38-47ee-aebd-8d1bc714231e
Trend Micro Waterbear December 2019ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f950da7f-1b35-48e5-9209-9fff55c3913f
Trend Micro Waterbear December 2019