Skip to content

System Service Discovery

Technique · ATTACK:enterprise:T1007

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1007",
  "title": "System Service Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1007",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--322bad5a-1c49-4d23-ab79-76d641794afa",
  "external_id": "T1007",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:21.315Z",
  "modified": "2026-05-12T15:12:00.624Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Aquasec Kinsing 2020",
      "url": "https://www.aquasec.com/blog/threat-alert-kinsing-malware-container-vulnerability/"
    },
    {
      "source_name": "Elastic Security Labs GOSAR 2024",
      "url": "https://www.elastic.co/security-labs/under-the-sadbridge-with-gosar"
    },
    {
      "source_name": "SentinelLabs macOS Malware 2021",
      "url": "https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/"
    },
    {
      "source_name": "Splunk Linux Gormir 2024",
      "url": "https://www.splunk.com/en_us/blog/security/breaking-down-linux-gomir-understanding-this-backdoors-ttps.html"
    }
  ]
}

Explicit source assertions (70)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00490a17-1032-461b-8085-500d56bb80f5

TrendMicro Ursnif Mar 2015

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--069d3677-2694-4385-b5c3-ea6e231d26d9

Trend Micro Tick November 2019

ATTACK:enterprise:S0018 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09c10778-19ad-441a-8a75-a3cf1288f960

AlienVault Sykipot 2011

ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c294d8b-2ee4-47ee-b9d8-8378d9d89ba1

Palo Alto Comnie

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10bb2d06-6158-4cf2-bd35-0840a8e0a129

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d36c3e8-238f-46c6-9b20-9fb4cb5c75ba

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26d1ecff-471e-420d-a1f0-d7b6cf9a07e6

Cisco Talos Intelligence Group

ATTACK:enterprise:S0081 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a7d01e9-9c42-4d17-947a-629ca7a9d515

Lotus Blossom Jun 2015

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--317b8a78-1c04-4cd7-a249-619bacfc7a44

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--342a3da9-79e7-4fdc-8a08-bd7f54caa2ac

Symantec WastedLocker June 2020

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--348ac89f-1a85-4ab2-887f-4e58dfc14853

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34939c90-9f24-4141-9fe2-f9b150f813d8

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Broadcom Medusa Ransomware Medusa Group March 2025 · Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36f0915e-66aa-4062-b909-35414c639ae1

Symantec Orangeworm April 2018

ATTACK:enterprise:S0057 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40c5a024-37db-478b-b90f-27f184bf8f60

Microsoft Tasklist

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40da5ea7-b4d1-45a4-944e-c1c74e408086

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0241 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43886571-4415-484f-931b-3b30b9aefaa7

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4923be5e-dd24-4289-adca-e9dbf545b9c2

Palo Alto OilRig May 2016

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52c18ed1-91a5-4394-a4d0-f700c75bf3d9

Kaspersky Turla

ATTACK:enterprise:S0127 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54e99ba2-143f-43be-8d7f-79de5551d1ac

Palo Alto Networks BBSRAT

ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56b8f3d1-c08e-42a1-8d14-b961391eaaa7

Bitdefender Naikon April 2021

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6017ff5f-e522-45fe-857a-e4fef38a6349

Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0180 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6139509a-709b-4ef4-81fb-25b9a35e2c60

US-CERT Volgmer Nov 2017

ATTACK:enterprise:S0582 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--651334a7-9d6c-444e-a935-1e7847abfcb1

Proofpoint LookBack Malware Aug 2019

ATTACK:enterprise:S1027 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b68eccb-bb48-40fd-bf3e-4bc60a51a8e1

SentinelOne Aoqin Dragon June 2022

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ba11730-a404-4252-aefe-acbf71877b0c

CrowdStrike AQUATIC PANDA December 2021

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7120230b-c8b3-4e70-a9a9-9edd2214ef09

HC3 Qilin Threat Profile JUN 2024 · Trend Micro Agenda Ransomware AUG 2022 · SentinelOne Qilin NOV 2022 · Cisco Talos Qilin Ransomware OCT 2025

ATTACK:enterprise:G0033 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--720be590-5ea0-43b6-8360-fa75dd4d1a67

Kaspersky Poseidon Group

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73d7126b-3e7a-441c-93e0-9803aec12ca5

Talos Kimsuky Nov 2021

ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7542421c-f673-4f85-85ae-b4283173c48d

ClearSky Lebanese Cedar Jan 2021

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7944bf15-8e56-4624-8776-bc9fc5aee249

NCC Group Chimera January 2021

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b529102-f95c-4ca1-a5c4-5a3497ab3674

Mandiant Operation Ke3chang November 2014

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7be0437f-1d0d-4df0-9e66-70e581cc5f1a

ESET InvisiMole June 2018

ATTACK:enterprise:S0342 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c58aab0-77cf-469e-836e-2b8c031afd1e

ESET GreyEnergy Oct 2018

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e2ceab5-e5ae-4c79-aceb-424d42703e5f

FireEye SUNBURST Backdoor December 2020

ATTACK:enterprise:S0398 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e42e286-af96-4178-a30f-785ed3699659

Unit42 Emissary Panda May 2019

ATTACK:enterprise:S1070 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b02a707-94ba-4c61-8292-d9dce02606b3

Cyble Black Basta May 2022

ATTACK:enterprise:S1247 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--930be2c9-08a1-453f-8149-4677cdcb6c3b

Cyble Embargo Ransomware May 2024

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--935f8b6e-cd74-46c4-9a74-f763b4f13955

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--948f8c8b-18e1-4652-86af-bad1dc0ec090

Talos GravityRAT

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--965cdcbc-f139-4065-a8cd-ab09674ae20b

Intel 471 REvil March 2020

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--974cd5a0-3519-4488-a935-06a0ef498f46

McAfee Cuba April 2021

ATTACK:enterprise:S0242 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97a083ff-40ef-4e4c-9837-4ab1537a063c

SecureList SynAck Doppelgänging May 2018 · Kaspersky Lab SynAck May 2018

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a79d18de-bfcc-4b15-b50e-2dc9d707ec58

JPCERT MirrorFace JUL 2024

ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a86529ff-e584-4566-afb9-6ffc366fd154

Bitdefender Sardonic Aug 2021

ATTACK:enterprise:S0431 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a88e956c-6c71-47e1-b02c-d4c105542690

Carbon Black HotCroissant April 2020

ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aae6444e-c9e5-4965-9499-8aa6d546b58e

TrendMicro EarthLusca 2022

ATTACK:enterprise:S0085 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abee00d3-8417-468b-84a4-40c7d0ac4f7d

Cylance Dust Storm

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad6fdc42-3f34-4412-b1a8-3af6728917f7

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:S0049 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae9befd5-d8b7-4492-9b47-422a40d610cc

F-Secure The Dukes

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3492594-4cb7-4c5c-a0b4-5054720e83fe

FoxIT Wocao December 2019

ATTACK:enterprise:S0086 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7601a08-a52d-4daa-acb9-2f5e3392b6c3

Cylance Dust Storm

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba27eb37-39dc-47ee-b87f-95525878582e

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:S0082 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bae7f2fb-99d8-4acf-b61e-f37a215aa82e

Emissary Trojan Feb 2016

ATTACK:enterprise:S0638 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bebaff50-23e0-43d6-ad31-4d84a3b2af73

McAfee Babuk February 2021

ATTACK:enterprise:S0015 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bedf5d77-af37-4a10-b4d7-3555a9ea2938

Trend Micro IXESHE 2012

ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8f99c96-d4f7-49dc-9ee9-0bcae28ab045

BlackBerry CostaRicto November 2020

ATTACK:enterprise:S0219 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd22a7a4-6f9f-481c-9a6d-6e1c665ed6cd

FireEye APT37 Feb 2018

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d012dd66-fef4-4714-bb00-55d9dd2861a1

Kaspersky Turla

ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0162247-12e2-4c0e-8efe-d5c4823e0fcd

Crowdstrike Indrik November 2018

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1f44e84-61cb-4a96-add8-d37a38369e43

S2 Grupo TrickBot June 2017

ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2543f5c-6079-4540-8250-d4b900b64f42

Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d3d8bcd3-9ea1-4bea-bcce-d8c302680c7a

Nov AI Threat Tracker · Cato LAMEHUG JUL 2025

ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de525077-129a-4d14-8419-6a3d219710a8

Microsoft PLATINUM April 2016

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6e324d1-b775-48bb-ac9f-02fcc2428752

FireEye admin@338

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e92fe381-6537-4cd1-9e30-bb8f0724498d

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e9af5cec-1afb-46da-9d2c-1c0c78ea312b

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:S0024 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f79947b2-49bc-4658-b93c-3aa9dbf9cd5e

Malwarebytes Dyreza November 2015

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9c7127d-2a27-4dcf-bef5-9150a6c4334d

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd44d6f1-25c5-4365-8a68-323bfc0b3f22

Talos ZxShell Oct 2014

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd68dcb1-686c-4e48-9b6c-26c98a4f43e5

GitHub SILENTTRINITY Modules July 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.