Skip to content

Query Registry

Technique · ATTACK:enterprise:T1012

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1012",
  "title": "Query Registry",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1012",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c32f7008-9fea-41f7-8366-5eb9b74bd896",
  "external_id": "T1012",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:25.584Z",
  "modified": "2026-05-12T15:12:00.714Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Wikipedia Windows Registry",
      "url": "https://en.wikipedia.org/wiki/Windows_Registry"
    }
  ]
}

Explicit source assertions (120)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0032f447-1ab7-427d-b7ae-baa436dc2411

FoxIT Wocao December 2019

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--014010a2-7bb8-4b11-bef9-c85609b2d94b

Kaspersky Turla

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--018a5e33-ef18-4a6b-8389-c950053d4a75

Google Cloud APT41 2024

ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03070395-3b76-4351-a3bd-0d9eaaa6652c

MSTIC NOBELIUM Mar 2021

ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--052c54bf-b92b-4a7e-bca4-bc884437a327

ESET Dukes October 2019

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0825b101-deff-45cf-867c-af3ccb233744

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010

ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10514be7-2dcb-4e70-a579-e1e1e6c2d900

HP SVCReady Jun 2022

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1558f550-390d-4c40-a2f7-c9aa1fcf9f1b

Zscaler APT31 Covid-19 October 2020

ATTACK:enterprise:S0560 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--184739bd-f45e-4f2b-8caf-19e2cb30ae92

FireEye SUNBURST Backdoor December 2020 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:S0376 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c548d89-557e-4c48-9b71-8a761d94e77b

US-CERT HOPLIGHT Apr 2019

ATTACK:enterprise:S1019 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d7661c8-82cf-481c-89e4-927eedaffc22

Accenture Lyceum Targets November 2021

ATTACK:enterprise:S1180 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2133b98d-891c-4602-8c01-4fc93b807980

Trustwave BlackByte 2021

ATTACK:enterprise:S0344 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26fcd59e-5758-47ec-8a5e-68150d1ff805

Unit42 Azorult Nov 2018

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27f4a7f3-7086-471d-8826-7bc544069c44

Talent-Jump Clambling February 2020 · Trend Micro DRBControl February 2020

ATTACK:enterprise:S0180 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a945fce-862b-46ff-8ee5-b78b220803f3

US-CERT Volgmer 2 Nov 2017

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2bc482f0-f5ee-433c-81bd-566ef8a8d7a6

Trend Micro njRAT 2018

ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2de4d7df-18fc-4202-93ee-2fcfe6f2e501

ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dfbcf5d-8563-440c-bd9c-0cfc15059bd5

Palo Alto Shamoon Nov 2016

ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f28f6e0-795f-4e0d-8459-514a42a96ce9

Unit42 BabyShark Feb 2019

ATTACK:enterprise:S0354 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31028cf4-870e-490e-871e-ec55814dcef8

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--312c929a-abf6-44c1-95d6-6dde60c7a3fe

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0517 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3454bb10-fad3-48b6-b20a-81cb45e7bbc1

Trustwave Pillowmint June 2020

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3559da63-5706-4e5a-b130-89858c2c0f44

Nccgroup Emissary Panda May 2018

ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3598d32e-306d-421d-af3c-8c9f5d1628a2

ESET Carbon Mar 2017

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39b63ba5-41dc-4b47-9858-97abdda827cd

McAfee RedLine Stealer April 2024

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39b735d3-c659-4d1a-8e7e-082c0f049c2d

Novetta Blockbuster Loaders · Novetta Blockbuster · McAfee Lazarus Resurfaces Feb 2018

ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a217a5a-b6c4-47c5-822a-5b278385c811

FireEye CARBANAK June 2017

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a50e0b3-fe35-4cfe-bdd6-306946b15abc

Secureworks REvil September 2019

ATTACK:enterprise:S0680 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b035642-31cc-498e-9dff-9e145b35b968

Kaspersky WIRTE November 2021

ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c786b4b-b146-4511-b3ca-65fe7c3521e8

Microsoft PLATINUM April 2016

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46144407-0f14-4358-8d4e-23b3ef13cb4e

ESET OceanLotus Mar 2019

ATTACK:enterprise:S0155 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47f611f4-b9f0-42ef-9629-ee4a56e737ed

FireEye APT32 May 2017

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4cb1a0d0-6276-4c2c-b299-c26c982e9e1e

Eset PlugX Korplug Mustang Panda March 2022 · CIRCL PlugX March 2013 · Lastline PlugX Analysis

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d5240d1-508f-4cf0-bf38-9f9276894cbf

US-CERT TA18-074A

ATTACK:enterprise:S1013 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e5de254-8dd4-46cd-a8af-8cdfd335e5f1

Cisco Talos Bitter Bangladesh May 2022

ATTACK:enterprise:S0267 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f5c53df-7076-4580-bd45-c4c9201269ae

ESET GreyEnergy Oct 2018 · FireEye FELIXROOT July 2018

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--519c4c7f-8495-4b8a-b58e-551a78e469cc

Kaspersky Turla · ESET Turla PowerShell May 2019

ATTACK:enterprise:S0186 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--521146dd-185d-4a8c-a3b4-b3caedbc7a14

ClearSky Charming Kitten Dec 2017

ATTACK:enterprise:S0075 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5365d764-76fa-49ce-b76b-d0344322b037

ATTACK:enterprise:S0031 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--564de5da-7ecc-45c7-bbd5-619a8f316f70

ATTACK:enterprise:S0513 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59c92aeb-1e62-4e60-8ead-63100e068c0d

ESET Dukes October 2019

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5acaf47e-4608-4548-81e8-368a2687844e

Talos ZxShell Oct 2014

ATTACK:enterprise:S0011 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ccac771-a984-4f06-b109-21ea7cd60b02

CISA MAR-10292089-1.v2 TAIDOOR August 2021

ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5da42f91-d58e-48bd-b8b2-3d35db7edcf2

Malwarebytes Saint Bot April 2021

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5dc5e7d5-8d4d-450c-826d-7719de39ab28

MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:S0165 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60198640-1e5a-4b8e-9a69-5f275f7e0e68

Symantec Buckeye

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62784c03-0ee3-4a53-ba0e-876db5ede08a

Talos Kimsuky Nov 2021

ATTACK:enterprise:S0242 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69c3aaaf-0922-4662-a8b3-026dc5ea0aae

SecureList SynAck Doppelgänging May 2018

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ae983c6-b332-42d9-b489-87f475b6b9d6

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b55412a-760f-4ff8-b48a-6ff3bed8b0e9

CyberBit Dtrack

ATTACK:enterprise:S1015 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--732a3283-d7ae-4d09-8446-edbd28c38ec0

Accenture Lyceum Targets November 2021

ATTACK:enterprise:G0038 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--746b0def-62c8-438d-b5ec-aa6b7dbfb860

Citizen Lab Stealth Falcon May 2016

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--749a620d-a87e-45b7-a9f6-8fa926320c59

SymantecCarbonBlack_ShuckwormUSB_Apr2025

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75a3cfad-a9e7-453f-88b8-787304575a33

Cybereason Bazar July 2020 · NCC Group Team9 June 2020

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75a89128-fcdd-4bcf-98a7-9f0ea162a794

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77d079b6-2df9-4ae9-bc7c-1ebe99708660

US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--794caee4-34cd-493f-a047-1f4a8b4c8de8

Prevailion DarkWatchman 2021

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--798d8217-a605-450c-9634-2297adcd227e

Trend Micro Agenda Ransomware AUG 2022

ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79cebb53-3154-4512-9343-2942b1f72ff5

Microsoft FinFisher March 2018 · FinFisher Citation

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ad999fd-9d57-40d3-b942-d8749a6f46cc

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d71658b-2b9f-4639-9fe7-7c7924b52ff7

Crowdstrike Indrik November 2018

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80d8e746-f0a0-4781-824a-0147dbbee072

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8875e27f-9f8d-418b-8937-a2c4d1858607

PaloAlto CardinalRat Apr 2017

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8db65d27-ddf4-4edd-9ccb-8112a78e9f47

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8de816a1-c89b-47ea-9456-c3bc139e6885

Prevx Carberp March 2011

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e12d3f8-6c2b-4622-889e-63c9abcff04b

Talos Cobalt Strike September 2020 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93741cce-12ce-4cc0-9fa6-5db7d8a1309a

Trend Micro Waterbear December 2019

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9677d051-2bac-4686-8611-2d089d3d4b58

NCC Group WastedLocker June 2020

ATTACK:enterprise:S0574 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9753bc87-1ed3-4a28-a9d3-80e004d83e62

Unit42 BendyBear Feb 2021

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a1da7be-9aaf-495a-bd56-f196f26b6240

Picus BlackByte 2022

ATTACK:enterprise:S1047 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9bab0784-d593-4fbc-8f03-0f2340184beb

DHS CISA AA22-055A MuddyWater February 2022

ATTACK:enterprise:S0145 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c79076c-341f-4eb3-bed7-300723747b18

Cisco DNSMessenger March 2017

ATTACK:enterprise:S1190 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d12ae29-b183-49c1-8171-52322f7971df

WithSecure Kapeka 2024

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f496c45-eac5-464f-858b-ef481f2f37ff

ESET Sednit Part 2 · Bitdefender APT28 Dec 2015

ATTACK:enterprise:S1050 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fedbd2e-93d1-4693-8365-f25ae4374e6a

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a16da3e1-c81e-4565-a78f-607cb937010b

TrendMicro Ursnif Mar 2015 · TrendMicro BKDR_URSNIF.SM

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a455cf4b-2402-4b72-a5e8-e5f5ed6d2bfc

Talos Bisonal Mar 2020

ATTACK:enterprise:S0252 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab08048c-4d1f-4214-9f53-1e87f6a20988

McAfee Gold Dragon

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--acbf0f3f-5dd4-42ad-9399-047b8ff5dc0a

Medium Ali Salem Bumblebee April 2022

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1012

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0d3ef27-8854-486f-942b-f0cd42c8a85c

Unit 42 Valak July 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.