NativeZone
Software · ATTACK:enterprise:S0637
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0637",
"title": "NativeZone",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0637",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--b4783be3-35d9-4a56-ac8d-1f3e1c9d9a84",
"external_id": "S0637",
"domain": "enterprise",
"created": "2021-08-04T19:36:55.518Z",
"modified": "2025-04-25T14:44:28.081Z",
"version": "1.0",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "MSTIC Nobelium Toolset May 2021",
"url": "https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"
},
{
"source_name": "SentinelOne NobleBaron June 2021",
"url": "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"
}
]
}Explicit source assertions (7)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0637 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19ca041f-64be-42f8-9ed1-361410a4c28b
MSTIC Nobelium Toolset May 2021ATTACK:enterprise:S0637 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--983e91df-bb1a-4658-aaad-7549b1a81917
MSTIC Nobelium Toolset May 2021ATTACK:enterprise:S0637 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6e374d3-1de7-4f5e-8fce-42cc326886bc
SentinelOne NobleBaron June 2021ATTACK:enterprise:S0637 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abeb8fca-e470-4119-a07f-a6ec2f4b4667
MSTIC Nobelium Toolset May 2021ATTACK:enterprise:S0637 → uses → ATTACK:enterprise:T1480
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b704b2b0-50c5-4fba-ab6c-db346b3524c7
MSTIC Nobelium Toolset May 2021 · SentinelOne NobleBaron June 2021ATTACK:enterprise:S0637 → uses → ATTACK:enterprise:T1036
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc2fe4e7-cb7c-4707-b28b-a709c2ac017d
SentinelOne NobleBaron June 2021ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0637
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bda1324a-9c51-4d91-bf21-39209633b985
SentinelOne NobleBaron June 2021