IceApple
Software · ATTACK:enterprise:S1022
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1022",
"title": "IceApple",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1022",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--dd889a55-fb2c-4ec7-8e9f-c399939a49e1",
"external_id": "S1022",
"domain": "enterprise",
"created": "2022-06-27T15:22:22.979Z",
"modified": "2025-04-16T20:38:38.400Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CrowdStrike IceApple May 2022",
"url": "https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"
}
]
}Explicit source assertions (19)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--071f5618-aac7-45ca-9fb5-c863b5d6a179
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1919b6a0-302d-4e7e-b15d-e64125b11187
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1003.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21fa2533-b082-408b-857c-ad6d85a74238
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25398304-d7db-4180-864c-e123cd2ba041
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f54b318-43d1-4ae3-b6e5-912d2408dc0c
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1552.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56faef01-6a5b-41a7-a7fe-888860750abe
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64b3a1a6-42c3-4874-a081-e620577f5cfd
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1505.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--652ba0d5-1bd3-4dcb-93c5-f339ffdae886
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d3e0454-ffd1-46a7-9fcc-d4c8902707b7
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--753b0a84-4455-4706-babf-f9bf75e530be
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a45b5fc-2d41-445b-b478-fbf5d1bc3c30
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d67040f-625a-49bd-aacb-48024fc7c4b2
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1056.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae64efe5-a482-418f-9be1-3a88db40f6ab
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1ed24fb-6777-4001-88b4-a284091cde64
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca765e99-996e-4d0f-ada0-5c44d3930404
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce67a5bb-66a8-4926-ae72-64ef08040770
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d682570b-068d-421e-a6b4-a93640bd34dc
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8f14118-ba84-44b0-a0b6-ad2348e42906
CrowdStrike IceApple May 2022ATTACK:enterprise:S1022 → uses → ATTACK:enterprise:T1003.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4030866-a970-4af5-9d50-b33c7751a8ba
CrowdStrike IceApple May 2022