Wevtutil
Software · ATTACK:enterprise:S0645
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0645",
"title": "Wevtutil",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0645",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--f91162cc-1686-4ff8-8115-bf3f61a4cc7a",
"external_id": "S0645",
"domain": "enterprise",
"created": "2021-09-14T21:45:30.280Z",
"modified": "2026-05-12T15:12:00.741Z",
"version": "1.3",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Wevtutil Microsoft Documentation",
"url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S0645
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e8f455a-5773-483a-8636-045774732bef
Crowdstrike DNC June 2016ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:S0645
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--120d84d1-e769-421d-8743-645b024d292b
Crowdstrike HuntReport 2022ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0645
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30a53a55-718d-4108-9063-45dc9bfacc93
CISA AA24-038A PRC Critical Infrastructure February 2024 · Joint Cybersecurity Advisory Volt Typhoon June 2023ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:S0645
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49dd9dc3-b0b8-499f-8fad-177779d494df
FoxIT Wocao December 2019ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:S0645
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d0084c8-b0e9-48f2-9e8e-b7aadbdf4788
BradyUnit42_TheGentlemen_July2026ATTACK:enterprise:S0645 → uses → ATTACK:enterprise:T1685.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67539c7a-5b11-4080-aa6b-1b370e0d321d
Wevtutil Microsoft DocumentationATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0645
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--867ca425-de4a-4bab-b7a3-5de71cf95c7e
Trend Micro Ransomware Spotlight Play July 2023ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:S0645
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91c0aeed-d3f8-430a-8443-ff2ae2fa2524
Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023ATTACK:enterprise:S0645 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c559e9a-0ad1-42cb-9848-5b54112a543b
F-Secure Lazarus Cryptocurrency Aug 2020 · Wevtutil Microsoft DocumentationATTACK:enterprise:S0645 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1f1c1a4-858d-45a8-a7e6-7d9715a951d4
Wevtutil Microsoft Documentation · Crowdstrike DNC June 2016ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:S0645
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e3888f07-1a1a-442a-8492-ff3c807df9f6
JPCERT MirrorFace JUL 2024