BADHATCH
Software · ATTACK:enterprise:S1081
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S1081",
"title": "BADHATCH",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1081",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--3553b49d-d4ae-4fb6-ab17-0adbc520c888",
"external_id": "S1081",
"domain": "enterprise",
"created": "2023-08-01T18:07:26.353Z",
"modified": "2024-04-11T02:55:51.310Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Gigamon BADHATCH Jul 2019",
"url": "https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/"
},
{
"source_name": "BitDefender BADHATCH Mar 2021",
"url": "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"
}
]
}Explicit source assertions (36)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--003eed51-a560-44f1-9149-5a11bdaebe6f
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1620
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04a55a4d-7888-4e52-8d6f-6befbc82f6f2
Gigamon BADHATCH Jul 2019ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07ef8045-6a01-4764-a351-a8a2ee2170f7
Gigamon BADHATCH Jul 2019 · BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17ec5db7-d1cd-4057-9d95-a6da56b06825
Gigamon BADHATCH Jul 2019 · BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18c44352-1eca-4d6e-9eac-9793b75223df
BitDefender BADHATCH Mar 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S1081
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2275a778-0ba1-40a7-8421-1659dc2e38d4
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2863b77b-a029-4c9e-a573-e5e16d979391
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c88062e-f63f-4313-85ef-3d68a9d3fde5
Gigamon BADHATCH Jul 2019 · BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33fb5b08-700d-4c29-a971-c7493b904d1a
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1027.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36929435-86c4-41f9-8922-ad5e1fc512b1
Gigamon BADHATCH Jul 2019ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39f8de6f-9df3-4e6b-9076-bd3464a2d5d2
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d829924-77dc-42cf-897c-a7def75b6be6
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--422ae7c9-d403-4d3e-89d4-593e03f3b4a3
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52625b6a-41f0-4e87-ba03-5c037425c245
Gigamon BADHATCH Jul 2019 · BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ea72071-0251-4826-8a7b-7677ec52eadb
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62d56cae-9131-4088-ad0a-810a731d2a9f
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1106
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d49721f-17a2-4f02-a760-f0bfe9c0b759
Gigamon BADHATCH Jul 2019ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e906ef1-2984-4d8e-ba9f-5f40f30f996e
Gigamon BADHATCH Jul 2019ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6eaf57d7-1e0c-437a-b5e6-4b4dc6f00ae1
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--785e8778-84d2-46a5-b96a-ea71b1adc650
Gigamon BADHATCH Jul 2019ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--922d5db0-2588-46d9-9a91-e5d4ccc3c84c
Gigamon BADHATCH Jul 2019ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1027.015
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--940e8f94-a0bf-43e9-b2e8-53dd9a3f0e6e
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f3ded7a-feef-4180-b89c-baca3c08f96c
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f5593f4-2cd8-4e98-81ff-8afb615d88ef
Gigamon BADHATCH Jul 2019ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abb5f6e2-1813-4d0e-8269-cceec54b4843
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2bd8d90-28ca-4524-85f7-07aaf066b485
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1550.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b33a7611-2426-434d-873a-6d74a8f91974
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7b996f4-eb93-457d-a0e7-999e2dd39182
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca47d783-2a71-4ff9-b5aa-df2c1805ea7a
Gigamon BADHATCH Jul 2019 · BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1071.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d31bacda-9a8f-4807-b0d6-51a47f0af986
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d47ea1ea-ea4c-46e0-b761-9b6c24888be6
Gigamon BADHATCH Jul 2019 · BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9e56665-26bb-49e2-99b4-6b4e7ccb38e3
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dcdf4518-1248-4549-b536-193ab1848d31
Gigamon BADHATCH Jul 2019 · BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1134.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dd28aa9c-762c-4726-b402-6536bae9490c
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb08d5b1-786c-43c8-9984-5b7b92d90d91
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f4dc0552-707f-453b-96c9-5e757a408e53
Gigamon BADHATCH Jul 2019 · BitDefender BADHATCH Mar 2021