Skip to content

DarkWatchman

Software · ATTACK:enterprise:S0673

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0673",
  "title": "DarkWatchman",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0673",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--63686509-069b-4143-99ea-4e59cad6cb2a",
  "external_id": "S0673",
  "domain": "enterprise",
  "created": "2022-01-10T19:43:47.281Z",
  "modified": "2024-08-26T16:28:39.922Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Prevailion DarkWatchman 2021",
      "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"
    }
  ]
}

Explicit source assertions (34)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1614

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00ed8575-5d79-46c3-adea-d0e1bf5dc14a

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10a4e987-0b9d-4ea1-b82f-4b93d6a10a45

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1027.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19151c17-b3cb-436f-88dc-16aabd96e04f

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1027.015

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a3a4c9d-36d5-42c9-9375-063772d70e88

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e126b9a-f902-4077-963e-64185c9544ff

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--331e8ea2-15c4-4cba-8a26-163b24d819b7

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--343c6e94-fda1-41d6-865e-6a30570afb98

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42c6147c-8626-4ea1-bc69-7b35ea69e2ed

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43ec2047-44fb-49a5-b24a-9edcb5378e5c

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5113edc5-a4ee-4888-89b1-0c3353ea05da

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68130387-da58-4676-889b-0b8c5b2c3a65

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6bca8252-8339-470b-a994-519eee5ea3ec

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1568.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6be9fb86-54b4-4979-95f8-c2a27cba785c

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--794caee4-34cd-493f-a047-1f4a8b4c8de8

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1129

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bbc0809-d6ba-4be5-9397-e44b9481f317

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1217

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e160715-2735-4d96-8918-14036c2804a7

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1132.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--827f9dc6-9dbd-4556-a817-efb9b115cac1

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c677ccc-427f-43b8-a7b8-0c7a00001b9b

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92dc3823-559b-422a-b801-4669d53f0135

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94cbcde4-3323-41ba-948c-95f798d39a89

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1d982c7-bb95-4533-9feb-05c5350b8359

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6bb9c7f-3e1c-429a-a81d-0d446f4abe9a

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa60abd5-cc76-48b0-b39f-510317b18434

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b87f6c02-8f95-4e40-a848-b6e3c069d703

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1027.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2260326-b220-46e4-ba11-3f14ec89f45f

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7563ead-61fb-4f5e-8832-64ce81c0ecb1

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d880473f-da6f-452b-8ea4-5723ab87226c

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de539175-4740-4d78-a46d-5555be905dcf

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e67bb9cd-a76c-4666-a3e5-1e466dceb22b

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ecb55914-837c-4600-a0f8-65d83d2d726b

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3d2f8a8-da3a-4635-90e5-95f6fee86a9c

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f54e5455-c539-4bcb-9a06-92440314324f

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fdbd14e9-fffa-4120-a979-24eead47ffa4

Prevailion DarkWatchman 2021

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff2f9b25-f36a-4031-8013-1e746cc40948

Prevailion DarkWatchman 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.