Scheduled Task
Subtechnique · ATTACK:enterprise:T1053.005
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1053.005",
"title": "Scheduled Task",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1053/005",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
"external_id": "T1053.005",
"domain": "enterprise",
"created": "2019-11-27T14:58:00.429Z",
"modified": "2026-05-12T15:12:00.618Z",
"version": "1.8",
"aliases": [
],
"tactics": [
"execution",
"persistence",
"privilege-escalation"
],
"source_references": [
{
"source_name": "ProofPoint Serpent",
"url": "https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain"
},
{
"source_name": "Defending Against Scheduled Task Attacks in Windows Environments",
"url": "https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments"
},
{
"source_name": "Twitter Leoloobeek Scheduled Task",
"url": "https://x.com/leoloobeek/status/939248813465853953"
},
{
"source_name": "Tarrask scheduled task",
"url": "https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"
},
{
"source_name": "Microsoft Scheduled Task Events Win10",
"url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events"
},
{
"source_name": "TechNet Scheduled Task Events",
"url": "https://technet.microsoft.com/library/dd315590.aspx"
},
{
"source_name": "Red Canary - Atomic Red Team",
"url": "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1053.005/T1053.005.md"
},
{
"source_name": "TechNet Autoruns",
"url": "https://technet.microsoft.com/en-us/sysinternals/bb963902"
},
{
"source_name": "TechNet Forum Scheduled Task Operational Setting",
"url": "https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen"
},
{
"source_name": "SigmaHQ",
"url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml"
},
{
"source_name": "Stack Overflow",
"url": "https://stackoverflow.com/questions/2913816/how-to-find-the-location-of-the-scheduled-tasks-folder"
}
]
}Explicit source assertions (198)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--005b6fd1-be80-424b-b6df-2ff88d390b1b
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00b0b6ec-a9eb-4fdd-b7ea-6e6c8a8ab1fc
TechNet Scheduling PriorityATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02085573-6f4a-495f-b3a7-81ac97ce3377
SophosGnGal_SystemBC_Dec2020 · TrumanKroll_SYSTEMBCServer_Jan2024ATTACK:enterprise:S0648 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0327e5d8-877c-4efe-bedc-9807279d74dc
CrowdStrike Carbon Spider August 2021ATTACK:enterprise:S0414 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--053d1126-0d8d-4048-be96-d1a395a1fe8c
Crowdstrike GTR2020 Mar 2020ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--081a9ee3-3609-4bab-8956-d0bd2b77754a
Volexity SolarWinds · CrowdStrike SUNSPOT Implant January 2021 · FireEye SUNBURST Backdoor December 2020ATTACK:enterprise:S1014 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08c8fe77-b0b9-45e7-a2bf-e09257fa83f7
SecureWorks August 2019ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09266cb7-26b3-4959-bcff-a91e309b5588
ClearSky OilRig Jan 2017ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ca1948b-476c-4ff5-a792-f3790250bdc1
FireEye Operation Double TapATTACK:enterprise:S1015 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0cc48b39-3f2c-4c27-be1a-0fb6cd7bcaaf
Accenture Lyceum Targets November 2021 · ClearSky Siamesekitten August 2021ATTACK:enterprise:S0697 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e35d2ce-3af7-4645-b795-382a75d62fb9
Symantec Ukraine Wipers February 2022ATTACK:enterprise:S1166 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e9c2a2e-0f0b-4133-88a1-d44e0669003d
ESET OilRig Campaigns Sep 2023ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11875739-9167-4e09-8a97-0e5b19d5e795
Microsoft SharePoint Exploit JUL 2025ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17ce446f-1a76-46d5-a276-589713425af8
S2 Grupo TrickBot June 2017 · Trend Micro Totbrick Oct 2016 · Microsoft Totbrick Oct 2017ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--185a72dd-e151-4eba-81f4-c3eeaa67873a
ESET Carbon Mar 2017ATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19153106-5607-4cac-91a5-c2a900bc5343
ESET ComRAT May 2020 · CISA ComRAT Oct 2020ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1aa10371-6473-416a-8b8b-17c36f700233
ESET Sednit Part 1 · ESET Sednit July 2015ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b1027ff-81d2-4ae9-85ac-0d886dea8a04
Group IB Cobalt Aug 2017ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cf0ee67-cf78-419a-acaf-79a49ada0211
ESET HiddenFace 2024 · Trend Micro Earth Kasha NOV 2024ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d7e1954-b020-4578-9a57-b1596a7a25ff
Cyber Forensicator Silence Jan 2019ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ddc8822-55de-4671-8a73-c95d6383016f
Cycraft Chimera April 2020 · NCC Group Chimera January 2021ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1dfccb9f-6a8e-46fb-8a0b-d1b0568da2ed
Palo Alto Lockbit 2.0 JUN 2022ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e666715-f087-44ad-aaa5-d22fbda42fba
TrendMicro Patchwork Dec 2017ATTACK:enterprise:G1034 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ea32af4-a6e3-4ead-9829-35ffc4c91426
ESET EvasivePanda 2024ATTACK:enterprise:S0248 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ebc312e-68a4-4119-94c5-79897a5bf5b4
ASERT Donot March 2018ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f7b17e9-9ad3-42dd-ab92-e3afe752247b
BlackBerry_FIN7_April2024 · FireEye FIN7 April 2017 · FireEye FIN7 Aug 2018 · Morphisec FIN7 June 2017 · Flashpoint FIN 7 March 2019ATTACK:enterprise:S0589 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2496d1c4-cb04-40ab-9f9a-0102da3e6d77
MSTIC NOBELIUM Mar 2021ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--250638f3-ac26-4aec-adf4-9e705822b621
Cyberreason Anchor December 2019ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--256edc9a-e5fa-48fc-b398-eb0873d46e78
Group IB GrimAgent July 2021ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26487c38-877a-4f63-8877-b0fa1624fa71
Proofpoint TA2541 February 2022ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--272c29eb-9f83-4a90-a9b2-e823182204a7
Cybereason Soft Cell June 2019ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2cc7c10f-45a7-4573-b75e-ad15b11fb813
mandiant_apt44_unearthing_sandwormATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d1b98bb-cbc8-492a-9861-f350153291cd
HP SVCReady Jun 2022ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2d478e66-fa0d-4834-8b17-5761369e9867
Picus BlackByte 2022 · FBI BlackByte 2022ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e532de4-b002-4c2d-a37c-6d535ff090fa
ESET Machete July 2019 · Securelist Machete Aug 2014ATTACK:enterprise:G1001 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ed90af5-43e7-4c81-b03d-6d4b54988d75
Kaspersky Lyceum October 2021ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--300fe039-5361-41e2-857f-5a8a311824d9
Anomali MUSTANG PANDA October 2019 · Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · Secureworks BRONZE PRESIDENT December 2019 · McAfee Dianxun March 2021 · Unit42 Chinese VSCode 06 September 2024ATTACK:enterprise:S0546 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31fe18d1-7799-466c-adb3-3be923ed4f3a
Cybereason Molerats Dec 2020ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3258c355-677c-452d-b1fc-27767232437b
Talos Nyetya June 2017ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33390e6e-f262-48fb-a74a-084c310b3aa2
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:C0034 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--34ed3c2a-3e75-4c9c-966c-7fc33b92092e
Mandiant-Sandworm-Ukraine-2022ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35437cd0-280a-407d-9f3a-36dc61deba1a
Bitsight Latrodectus June 2024 · Latrodectus APR 2024 · Elastic Latrodectus May 2024ATTACK:enterprise:S1147 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3781213b-225b-4c18-bfb6-f69d622887f6
Symantec Daggerfly 2024ATTACK:enterprise:S0350 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38419f2f-51d2-47ed-9fd9-bba3712474cc
McAfee Night DragonATTACK:enterprise:S0375 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--387fa1e2-b8c5-4be4-b566-85b0525ed294
Securelist Remexi Jan 2019ATTACK:enterprise:S9052 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3aed2bdf-7d69-46fe-9fea-9fb2b7c626cd
CheckPoint_NimbusManticore_May2026ATTACK:enterprise:S1058 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bf633ad-4648-4610-ae68-9b3bbca7b512
Microsoft Prestige ransomware October 2022ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c331c9b-bd73-422b-a62a-560d92946d5b
Mandiant APT41ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ca53c3c-ec7d-4453-a80f-2f3306358a2f
Mandiant FIN13 Aug 2022ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cfb23f1-ae6c-4ba9-acf0-b5e592ea5597
Talos Frankenstein June 2019ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3d829924-77dc-42cf-897c-a7def75b6be6
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3da68907-c8f3-4a45-b831-bdadb1161921
Red Canary Dridex Threat Report 2021ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3df5e4b3-a26b-4c8f-bf77-8ae3c602f958
CarveyODonnellWelchHuntress_TheGentlemen_May2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ec64efd-1ee8-4bfd-8ff1-3316806d7979
Kaspersky ToddyCat Check Logs October 2023ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f221ccc-1be7-4959-b239-6a3e027da1ae
RedCanary Mockingbird May 2020ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f3d94c1-f6ae-47b4-b156-8ce8961ec4ad
ATTACKIQ MUSTANG PANDA TONESHELL March 2023 · Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023ATTACK:enterprise:G0021 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f898155-f810-4d2c-8e30-34723d845ade
Unit42 Molerat Mar 2020ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40fad687-982e-4cd3-955c-3c458e34e5df
ESET Okrum July 2019ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--417912a3-95a8-4dd4-a586-88cca62f3ebc
Eset Ramsay May 2020ATTACK:enterprise:S0538 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43815eb8-45cf-4032-8958-d3e73f0a229e
ESET Crutch December 2020ATTACK:enterprise:S0671 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43ae357d-d0f8-4cdc-a9d6-0f10f603707c
Kaspersky Tomiris Sep 2021ATTACK:enterprise:C0044 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44426f05-25fc-4b81-956a-a6db04fc1704
ESET OilRig Campaigns Sep 2023ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--455fed31-0d5c-42cb-9a79-03df7600db52
Secure List Bad RabbitATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47a0dce9-2b56-4ebd-9dea-b76132c81753
Cybereason StrifeWater Feb 2022ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47dddbb1-92c0-4a3f-8234-8418966be1ea
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--499d7aed-5889-4f40-a688-660f976dd112
DFIR_Sodinokibi_Ransomware · DFIR_Quantum_Ransomware · Juniper IcedID June 2020ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a0887ab-3ec3-436a-b378-6e28847dfb1e
Mandiant No Easy BreachATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a08a068-209e-40bc-afc2-97cd774a3b89
Netskope XLoader 2022ATTACK:enterprise:S1228 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cb2ba08-aebd-47f2-b1ea-9e28a2f64f77
Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · Lab52 MUSTANG PANDA PUBLOAD MAY 2023 · 2022 November_TrendMicro_Earth Preta_Toneshell_PubloadATTACK:enterprise:S1089 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cd2bbbd-211a-4771-9e9d-a60356c04257
MoustachedBouncer ESET August 2023ATTACK:enterprise:S0527 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--509a79e0-7ee3-4528-b11a-eefee861e384
Cybereason Kimsuky November 2020ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--521278a2-0924-4ff8-b5a6-03f5f69426b6
PaloAlto Patchwork Mar 2018ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54d5380e-07a4-49b0-8ffd-c34428c90bbe
FBI FLASH APT39 September 2020 · FireEye APT39 Jan 2019 · BitDefender Chafer May 2020ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55ea8954-9b81-45e4-89c9-a6b55f5b2541
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:S0024 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57828888-a833-44c7-af2c-e250d799a9bc
Malwarebytes Dyreza November 2015ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57f8c6d0-406d-4e97-b3ff-5b2f0274231b
DHS/CISA Ransomware Targeting Healthcare October 2020 · CrowdStrike Grim Spider May 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020ATTACK:enterprise:S1013 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5859c58f-fc6a-4a08-ac8b-96fd21175814
Cisco Talos Bitter Bangladesh May 2022ATTACK:enterprise:S9032 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c962e5a-d3fc-48e4-b8a4-24e3172a9ce0
ESET_MuddyWater_Dec2025ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ce08d76-1b27-42c7-88f0-5591ee4b33af
FireEye TEMP.Veles 2018ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d972f64-4c81-43ce-ba08-2c791bd78287
Unit 42 Lucifer June 2020