Skip to content

CHIMNEYSWEEP

Software · ATTACK:enterprise:S1149

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S1149",
  "title": "CHIMNEYSWEEP",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1149",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--542e3384-341a-455b-bb48-4917b25e3b00",
  "external_id": "S1149",
  "domain": "enterprise",
  "created": "2024-08-07T20:03:17.762Z",
  "modified": "2024-08-09T17:29:21.238Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Mandiant ROADSWEEP August 2022",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"
    }
  ]
}

Explicit source assertions (32)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0764c8ee-8577-4124-9658-7cc90f74726f

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--089cfcb7-2e3b-43f2-8e63-5e42fcbdcf06

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1218.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c45658b-2911-4b06-8b57-d34cc16d1e1d

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cd688c6-1e0b-4004-b4fd-bbfb79478dd4

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a1fd6b3-bc40-4646-958a-34c35d1b0451

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23b98d85-7ae7-4611-80a4-36441c2462e3

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1120

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2afd76e6-335e-4769-8c2e-54b951753c2d

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--343d7841-5334-4621-8e2d-8a3cc92e4b0e

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--376f951c-844c-474b-b805-7f36caa07579

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1027.009

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a1ee04f-672a-4fc6-80fe-40feb5472625

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:S1149

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a3f586e-9444-489b-871d-616dfb0a5bc9

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1027.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43b702d2-0a17-4394-8dff-40a22b2c753f

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a0c829e-1590-407a-bc3f-64793050e039

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--551f1eb5-0cb9-4f5b-a97d-c61c081eea9e

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--565d5e3a-8a10-44cd-b45d-75fe2abe2677

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e53c0fb-e7f9-4b6d-a0a0-b7c64b5a3b6e

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6aace1a6-2422-45de-a72e-eb66ebbbca0a

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d28f0c8-b835-4a42-b792-bb7660e47ee7

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6da35448-bec3-44cd-8596-2ded87b6fcaa

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1132.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71c1ca7f-0086-4168-94c2-b6d4bfa5938a

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81cb331d-a24d-4100-a26a-447b0dc73260

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--884e2dbe-6641-400b-93db-2df91ffe5a33

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97e7c5ec-8f7e-48a8-9ef4-f736e6e481bf

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b062c271-ce67-4134-bf86-033123d351ff

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1529

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b153b867-6888-4071-bf34-d40305ca4150

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1027.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b64f2e15-a8cb-4f18-b440-141779efc1fd

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1102

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c313b2dd-2f30-408d-aeef-59e41ef38927

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce9f3239-13ee-4741-b839-8e7c68d5f9ef

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1548.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6b31077-90cf-4279-9064-f83550834447

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1070.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d92cf7e9-db9f-486c-a8e6-6018ad3d3959

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1112

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea54979f-3e4c-459c-bfaa-1435e36729e1

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f21cd1d0-f4ea-4443-8835-c55e468363af

Mandiant ROADSWEEP August 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.