WarzoneRAT
Software · ATTACK:enterprise:S0670
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0670",
"title": "WarzoneRAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0670",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--fde19a18-e502-467f-be14-58c71b4e7f4b",
"external_id": "S0670",
"domain": "enterprise",
"created": "2021-12-27T17:21:18.652Z",
"modified": "2023-10-03T19:33:26.976Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Ave Maria"
},
{
"source_name": "Check Point Warzone Feb 2020",
"url": "https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"
},
{
"source_name": "Uptycs Warzone UAC Bypass November 2020",
"url": "https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique"
}
]
}Explicit source assertions (33)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--057815bb-550c-4e00-bfdb-c7e4bf6461cb
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b3b2d98-213c-487f-b526-9336c2ed4555
Check Point Warzone Feb 2020 · Uptycs Warzone UAC Bypass November 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f90920b-ab2e-4c79-95a5-5438c172a46d
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1873a6d4-fc01-4fd5-aa85-ded977998eab
Check Point Warzone Feb 2020 · Uptycs Confucius APT Jan 2021ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1685
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b61a1d1-c1e1-4fce-a84c-c1bccbf101fc
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--213ea969-5e60-4128-9794-a09fb5f5eb5e
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25a92f58-75d6-46a5-8e82-7f576f9659a5
Check Point Warzone Feb 2020 · Uptycs Warzone UAC Bypass November 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26fd5ea0-6f63-4c0a-9a84-23e489c1161c
Check Point Warzone Feb 2020 · Uptycs Warzone UAC Bypass November 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e87ee5b-2cf9-427f-b8c7-363e37daed88
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f081501-0c5c-4662-b7b4-3dc5a8a3b1af
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--384b6787-f69b-4d81-bc5e-c01a5c5b026e
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--384c2ef7-ae14-4ba2-ad86-bfeea3c14f33
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3db5259f-5426-4c47-8fc3-44118f63f985
Check Point Warzone Feb 2020ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:S0670
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f15c9e4-93d9-4fd9-891f-3d9ca982a030
Proofpoint TA2541 February 2022ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--419d663c-0fa5-411c-9697-468debf7efc5
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--42a2aec6-4efb-44d0-8ae8-32a208c05da6
Check Point Warzone Feb 2020 · Uptycs Warzone UAC Bypass November 2020ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:S0670
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--478544be-5304-423f-8065-0f11cd4cfade
Check Point Scattered Spider JUL 2025 · CISA Scattered Spider Advisory November 2023ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1546.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--581061d3-6216-4a58-aa46-3640d8e94b02
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1564
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bceaa15-bfcf-464f-a3d3-030d389080b5
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73e00ae6-71f1-4ad7-861a-f0643b42c2ac
Check Point Warzone Feb 2020 · Uptycs Confucius APT Jan 2021ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e941100-b4aa-43fa-a7c5-328fb211ecce
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8432770c-a920-43dc-855c-216320a70a88
Check Point Warzone Feb 2020 · Uptycs Warzone UAC Bypass November 2020ATTACK:enterprise:G0142 → uses → ATTACK:enterprise:S0670
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--994462e4-b75a-45b5-9b63-43e449bb1b10
Check Point Warzone Feb 2020 · Uptycs Confucius APT Jan 2021ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e9daac0-86ce-493f-a1b4-6c4e9d0e39ff
Uptycs Warzone UAC Bypass November 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aba4daa2-5022-4fe9-8359-7c0af1f58b86
Check Point Warzone Feb 2020 · Uptycs Warzone UAC Bypass November 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b0bac30d-7e77-41dd-9af8-c3daab9fa7b8
Bitdefender Trickbot VNC module Whitepaper 2021ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b27650da-9a26-4bd3-9e9e-2559a0b6dc86
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd6d8071-bcca-45ee-a477-3547d23d7758
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1021.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf546d75-f689-4033-83eb-40a3edd71877
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1221
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d04d88d0-541d-4da2-ac58-888f1d418f20
Uptycs Confucius APT Jan 2021ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d580bb98-25fb-4cf4-9b3f-79b007939202
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6624fc4-3aed-47c9-a4d9-aafc008f876f
Check Point Warzone Feb 2020ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eeb368b7-52b9-4320-a34f-8f3235beb22f
Check Point Warzone Feb 2020