Skip to content

Mythic

Software · ATTACK:enterprise:S0699

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0699",
  "title": "Mythic",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0699",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--d505fc8b-2e64-46eb-96d6-9ef7ffca5b66",
  "external_id": "S0699",
  "domain": "enterprise",
  "created": "2022-03-26T01:38:12.966Z",
  "modified": "2025-04-16T20:38:56.653Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "RecordedFuture 2021 Ad Infra",
      "url": "https://go.recordedfuture.com/hubfs/reports/cta-2022-0118.pdf"
    },
    {
      "source_name": "Mythic Github",
      "url": "https://github.com/its-a-feature/Mythic"
    },
    {
      "source_name": "Mythic SpecterOps",
      "url": "https://posts.specterops.io/a-change-of-mythic-proportions-21debeb03617"
    },
    {
      "source_name": "Mythc Documentation",
      "url": "https://docs.mythic-c2.net/"
    }
  ]
}

Explicit source assertions (13)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25ffefb1-15cc-4365-b401-b2975494f36b

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1071.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--364f1a31-7710-4b81-91ce-919a89cdedcf

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1573.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3843a4eb-cf3b-4cf9-91db-5a481ce3f32d

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a8ce0e1-0c2e-4ce5-bd21-8d51b3027376

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f0d3b07-9996-40bc-a2c3-6ed7eb39e5fc

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1132

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--448cab31-deb1-40d5-a7f6-848d0116c4b6

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a5914f0-4e99-494b-bcf3-b199f623e36d

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e168a94-8882-4e6d-bc61-e86588b52242

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1030

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac603ee0-cb62-4ad5-852a-29b70b225c5f

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1119

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd651c13-04c8-4bff-9e68-b53b5f662510

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1572

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0228817-aba0-46c8-9449-de757f9238ac

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1090.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0d8c9a9-48bb-4369-9631-f33fe2aa189e

Mythc Documentation

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1ab6a18-2624-4d35-b9e2-3f3a4288bcac

Mythc Documentation

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.