Asynchronous Procedure Call
Subtechnique · ATTACK:enterprise:T1055.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1055.004",
"title": "Asynchronous Procedure Call",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1055/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--7c0f17c9-1af6-4628-9cbd-9e45482dd605",
"external_id": "T1055.004",
"domain": "enterprise",
"created": "2020-01-14T01:29:43.786Z",
"modified": "2026-05-12T15:12:00.644Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth",
"privilege-escalation"
],
"source_references": [
{
"source_name": "CyberBit Early Bird Apr 2018",
"url": "https://www.cyberbit.com/blog/endpoint-security/new-early-bird-code-injection-technique-discovered/"
},
{
"source_name": "ENSIL AtomBombing Oct 2016",
"url": "https://blog.ensilo.com/atombombing-brand-new-code-injection-for-windows"
},
{
"source_name": "Microsoft Atom Table",
"url": "https://msdn.microsoft.com/library/windows/desktop/ms649053.aspx"
},
{
"source_name": "Microsoft APC",
"url": "https://msdn.microsoft.com/library/windows/desktop/ms681951.aspx"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0199 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02e3008d-1b2b-4824-b715-d6d8335cc4b2
CyberBit Early Bird Apr 2018ATTACK:enterprise:S9018 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06ba4a6e-c3aa-4c02-b21d-b1523759ec2b
Palo Alto HeartCrypt DEC 2024ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1016e15c-64ed-4338-9ca9-83ffae3beb82
ATTACK:enterprise:S0517 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2dfd662a-231a-4b4c-b7e6-b61058fc4494
Trustwave Pillowmint June 2020ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37da9e7e-f366-4211-84bd-34fd9c43d681
ESET InvisiMole June 2020ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5bc09eae-6b6c-4dd3-9e27-a2f26f0a6468
Proofpoint Bumblebee April 2022ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--619d3ad7-82f3-40c0-bce6-92fe36181425
Malwarebytes Saint Bot April 2021ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63a09269-0546-4613-b746-0e1f8dac7d5b
Prevx Carberp March 2011ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6fe230f-9e76-46a5-a235-2990009d8c4a
IBM IcedID November 2017ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c1d664e1-bfe1-412a-939d-65b276e9d07e
Zscaler XLoader 2025ATTACK:enterprise:T1055.004 → subtechnique-of → ATTACK:enterprise:T1055
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf36992b-49c7-4a4c-8fd0-30e23cd8d7b8
ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dcdf4518-1248-4549-b536-193ab1848d31
Gigamon BADHATCH Jul 2019 · BitDefender BADHATCH Mar 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eda4c39d-9615-4c5f-8086-64150137df7f
Bitdefender FIN8 July 2021ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5e7233b-6419-4c09-b95b-c43f3004f246
ESET Attor Oct 2019ATTACK:enterprise:S1085 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f80615a0-f092-44f5-91be-8b287428d3e3
Symantec FIN8 Jul 2023