NBTscan
Software · ATTACK:enterprise:S0590
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0590",
"title": "NBTscan",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0590",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--b63970b7-ddfb-4aee-97b1-80d335e033a8",
"external_id": "S0590",
"domain": "enterprise",
"created": "2021-03-17T15:26:20.015Z",
"modified": "2025-04-25T14:45:26.872Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Debian nbtscan Nov 2019",
"url": "https://manpages.debian.org/testing/nbtscan/nbtscan.1.en.html"
},
{
"source_name": "FireEye APT39 Jan 2019",
"url": "https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"
},
{
"source_name": "SecTools nbtscan June 2003",
"url": "https://sectools.org/tool/nbtscan/"
},
{
"source_name": "Symantec Waterbug Jun 2019",
"url": "https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05509bce-dc88-4cc9-8c39-40549cbc8603
FireEye APT39 Jan 2019ATTACK:enterprise:S0590 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06711c3f-230b-4d44-9c88-4861c48d2716
Debian nbtscan Nov 2019 · SecTools nbtscan June 2003ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a23a684-c5e4-4ef1-8eb3-f55024cc71d5
Unit42 Agrius 2023ATTACK:enterprise:S0590 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f5655b0-7b7f-453c-9c2c-47a23fcc6222
Debian nbtscan Nov 2019 · SecTools nbtscan June 2003ATTACK:enterprise:S0590 → uses → ATTACK:enterprise:T1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--306eba85-eeb9-4fcb-8b23-ce38b09bbf24
Debian nbtscan Nov 2019 · SecTools nbtscan June 2003ATTACK:enterprise:S0590 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61de6721-267c-4224-8000-b3329f3057cf
Debian nbtscan Nov 2019 · SecTools nbtscan June 2003ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b26be81-0112-43be-a3e5-a94d5b15c738
ESET BackdoorDiplomacy Jun 2021ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a20e2809-ec0d-4378-8ee2-0691b651236c
Symantec Bilbug 2022ATTACK:enterprise:S0590 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be8fb0e9-a924-47be-9bb6-1eebe05881b7
Debian nbtscan Nov 2019 · SecTools nbtscan June 2003ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c20cc0d1-fe0b-4683-b6ed-bbb8736fe2ca
TrendMicro Tonto Team October 2020ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cc443415-7c35-49ab-92a9-3d0cfa68c7b2
Cybereason Soft Cell June 2019ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d63355e9-94d1-4eb2-b24d-d8c8b11923ef
Secureworks BRONZE PRESIDENT December 2019 · Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1130af1-b49f-4106-8846-7f3e65a65535
TrendMicro EarthLusca 2022ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e515dc29-7a69-4d0f-8a2a-d27722f3bd6b
Symantec Waterbug Jun 2019ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0590
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e7740e58-d87c-44c4-907c-f66b88851ffc
Dell TG-3390 · Trend Micro DRBControl February 2020