Skip to content

LSASS Memory

Subtechnique · ATTACK:enterprise:T1003.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1003.001",
  "title": "LSASS Memory",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1003/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--65f2d882-3f41-4d48-8a06-29af77ec9f90",
  "external_id": "T1003.001",
  "domain": "enterprise",
  "created": "2020-02-11T18:41:44.783Z",
  "modified": "2026-05-12T15:12:00.637Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "credential-access"
  ],
  "source_references": [
    {
      "source_name": "Medium Detecting Attempts to Steal Passwords from Memory",
      "url": "https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea"
    },
    {
      "source_name": "Deep Instinct LSASS",
      "url": "https://www.deepinstinct.com/blog/lsass-memory-dumps-are-stealthier-than-ever-before-part-2"
    },
    {
      "source_name": "Graeber 2014",
      "url": "http://docplayer.net/20839173-Analysis-of-malicious-security-support-provider-dlls.html"
    },
    {
      "source_name": "Volexity Exchange Marauder March 2021",
      "url": "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"
    },
    {
      "source_name": "Powersploit",
      "url": "https://github.com/mattifestation/PowerSploit"
    },
    {
      "source_name": "Symantec Attacks Against Government Sector",
      "url": "https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf"
    },
    {
      "source_name": "TechNet Blogs Credential Protection",
      "url": "https://blogs.technet.microsoft.com/askpfeplat/2016/04/18/the-importance-of-kb2871997-and-kb2928120-for-credential-protection/"
    }
  ]
}

Explicit source assertions (87)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--000aa4d0-315e-40d7-b2b6-76e91ecf0fe8

Symantec WastedLocker June 2020

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02a05d88-504c-4b79-bc55-1174b02e62c2

FoxIT Wocao December 2019

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fa0f5d6-be0b-4a48-938c-6d9bb8b1a170

FireEye APT34 July 2019 · FireEye APT34 Webinar Dec 2017 · FireEye APT35 2018 · Unit42 OilRig Playbook 2023

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c7b9a1b-e874-4881-884a-e3c3d1fd8aed

Cylance Cleaver

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21198a81-0fa4-4114-9a75-478e7212b87a

Symantec Leafminer July 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21f2fd40-073c-4c25-bf4e-19339ac1f99d

Dell TG-3390 · SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--277ac06b-0bb0-4384-b275-df180922b790

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28b27852-4125-4639-a07b-0b97dfdb650a

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b7df536-1a64-487a-9588-42f3bd411f3f

Volexity Ivanti Zero-Day Exploitation January 2024

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31a8dc85-abb8-4144-9fe8-6d9a71339c0e

FireEye APT40 March 2019

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--331e59e9-0d10-4c2d-ba92-e8eb0de1cc95

FireEye Know Your Enemy FIN8 Aug 2016

ATTACK:enterprise:S0349 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43619944-94e9-43d9-a761-8e4db2113eef

GitHub LaZagne Dec 2018

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--467d9812-8d19-4fca-a2fd-5a8e1dbb43f7

Rapid7 HAFNIUM Mar 2021 · Volexity Exchange Marauder March 2021 · Microsoft HAFNIUM March 2020

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--516e746b-6208-41db-8ea8-4e3fa42f5053

Microsoft Disable NTLM Nov 2012 · Microsoft WDigest Mit

ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56af2eea-6c9d-4917-b7d9-275877cb552a

RedCanary Mockingbird May 2020

ATTACK:enterprise:S0121 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56e40368-38a7-4415-9ebc-8c84694bc7d6

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58b1c6e7-5481-4162-a90c-0b7122c3680d

BiZone Lizar May 2021 · Threatpost Lizar May 2021

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c96f40f-8cbc-4561-9a1f-ce9dad5808d5

CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023

ATTACK:enterprise:G0107 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ee2ba47-9b66-4a62-8bde-ff29409d4830

Symantec Whitefly March 2019

ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fd13ed0-28df-4131-a653-0fa5a760ff95

Symantec Elfin Mar 2019 · FireEye APT33 Guardrail

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60077740-36a0-4fd6-8c07-0694143b722e

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6051e3e5-dd5c-4753-8e7d-66c2e18a044a

Microsoft SharePoint Exploit JUL 2025

ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62c9428a-c3cf-476e-b125-a6478bc1bfa1

ESET Bad Rabbit

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63835d80-f52b-472c-a605-b0360eea3539

Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63aa99ad-a780-44ca-acf3-3bc827fabd8b

JPCERT MirrorFace JUL 2024

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66b3723c-4738-4f3c-a0e4-b3e93eef8e9d

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b9cd57b-bd66-4bba-a2d5-09ee2bec19e5

Check Point VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--714ae0c0-aa49-45c6-a977-c86783f057dc

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:M1043 → mitigates → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72f97322-c7d1-41ea-a654-50e8039a8665

TechNet Credential Guard · GitHub SHB Credential Guard

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77f71aa5-b5d3-4cac-83a7-3ed5e2bc03f0

Unit42 Agrius 2023

ATTACK:enterprise:S0046 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78c889da-e1e2-4230-a91d-9934627fecf6

F-Secure CozyDuke

ATTACK:enterprise:S0357 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78daa7e5-f5e5-452b-a7fd-cece272294fd

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7adea746-109e-41c2-bf48-20e0282038a0

Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019

ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cfb528c-6c2d-4f67-b59e-c343678db839

Talos Nyetya June 2017 · US-CERT NotPetya 2017 · NCSC Joint Report Public Tools

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ebe873c-07f5-43a7-a59f-9305f9ec55a5

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81ce1970-88fa-4820-8f08-9a2a8332df77

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82a7e330-e4b1-4db8-8c73-03cabd9b8991

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:M1025 → mitigates → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--871cce82-c9fe-47e3-bd03-94a29a295f90

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c1446c4-66b2-4b70-96df-7fd2414522be

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c1d86fe-96c6-43e7-ab15-a45ee477006f

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f897f1c-7bc6-4a85-8d3b-627f976af215

Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:S0005 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--935971d6-0af2-4683-971a-9acb523733fe

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--948eaafc-3440-43f3-b9e4-39eb77197d72

FireEye APT39 Jan 2019

ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94cc0bdc-a2a6-4032-8099-34124c45976b

FireEye TRITON 2018

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98d076a5-9640-4337-a5a0-27c0c8a3374b

DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · FireEye APT35 2018 · Microsoft Iranian Threat Actor Trends November 2021

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d82c2c5-7d98-40dd-9171-1d605f259064

TrendMicro EarthLusca 2022

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9dcf5d9f-7e68-4a5c-a51c-f3c87d5833cd

Talos PoetRAT April 2020

ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ead9e4e-20c7-4c39-86c2-adcea93e04b8

CISA Iran Albanian Attacks September 2022

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fa7c256-046d-4c4b-8549-1187320002a7

Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0321bbd-edab-4ee6-be37-979015511e4a

emotet_hc3_nov2023 · Trend Micro Emotet Jan 2019

ATTACK:enterprise:G0068 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a14c4d34-5a27-419a-b665-e1207ba55ca7

Microsoft PLATINUM April 2016

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3b4a3e9-2552-43dc-957a-5c7f64fac9f1

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:S0056 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8e6ca7b-5d75-429a-b8f8-de97d5c277b3

Cylance Cleaver

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9c366b6-270d-4884-86dd-7c048460741b

Group IB Silence Sept 2018

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa2cd10c-5062-4abb-a8ec-0e178a5440ec

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab867547-6229-4f9f-9b0d-4ebdbca49d1d

Picus Qilin MAR 2025

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad6451b3-3335-4b60-a57a-b8ac62a9b140

CERT Polska · ESET DynoWiper Update JAN 2026

ATTACK:enterprise:C0025 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1b935ac-1823-48a8-ac16-b9d17e519475

Dragos Crashoverride 2018

ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b408ac97-93d7-4cca-ac96-7a61ab99cb5e

CERT-FR PYSA April 2020

ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6583fd8-89f7-4494-8690-3456391bf193

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7930db8-2cb9-4ecf-b3d3-7425f99140d8

Deply Mimikatz · GitHub Mimikatz lsadump Module · Directory Services Internals DPAPI Backup Keys Oct 2015 · NCSC Joint Report Public Tools

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b96e67e2-7d82-478e-8bf3-2e8acf8a14dd

ESET Telebots Dec 2016 · ESET Telebots June 2017 · Microsoft Prestige ransomware October 2022

ATTACK:enterprise:G1036 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb3bc4fe-6695-454e-9215-7b754c5d33f7

Microsoft Moonstone Sleet 2024

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--beda360a-6477-48b9-b7d1-4643d02bc3c9

Unit 42 MuddyWater Nov 2017 · Symantec MuddyWater Dec 2018 · Trend Micro Muddy Water March 2021

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bfd2f3f1-3a5f-4500-be4e-39e3f8d6cb8e

Mandiant FIN12 Oct 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c417561d-d3fa-4aa7-b272-6769b2ada225

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8db7b65-563d-47ba-9e06-cabdbade47e9

Microsoft NICKEL December 2021 · NCC Group APT15 Alive and Strong · Mandiant Operation Ke3chang November 2014

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c948f964-e26c-4226-9577-7b78b5bf271f

Symantec Buckeye

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbbbc655-e5a7-40e9-be62-7f29727b9f0c

apt41_dcsocytec_dec2022 · FireEye APT41 Aug 2019 · Group IB APT 41 June 2021

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5edf7fa-6d2b-4af8-a1d3-e0f9fe56eb00

Github PowerShell Empire

ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6b4cd9a-a8bd-4c9f-b716-e29710f1e934

Symantec Tick Apr 2016

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de3095b9-2434-48e8-880b-a4b75a1788c4

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0bc7e9b-aec8-4e78-baed-f635ee7bd196

FireEye FIN6 April 2016 · FireEye FIN6 Apr 2019

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e27996c5-9aae-4b5f-b84f-e76a29f51a09

Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e40421c6-cf5e-4e99-8259-07dcc1234365

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e71903c4-a7af-4317-adf0-10f76d3d4e15

ESET Sednit Part 2 · DOJ GRU Indictment Jul 2018 · Cybersecurity Advisory GRU Brute Force Campaign July 2021

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e841a3a3-de1f-4ce2-b218-fe99afaa15fa

Cybereason Sliver Undated

ATTACK:enterprise:S0365 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e998971c-c944-4255-8831-89d49d0e5285

Talos Olympic Destroyer 2018

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb67e50e-84ac-495d-8374-547ef1f34f4f

Netscout Stolen Pencil Dec 2018 · CISA AA20-301A Kimsuky · KISA Operation Muzabi

ATTACK:enterprise:T1003.001 → subtechnique-of → ATTACK:enterprise:T1003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee212490-822c-4851-bf2f-06b8179a9a38

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.