Skip to content

Process Injection

Technique · ATTACK:enterprise:T1055

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1055",
  "title": "Process Injection",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1055",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
  "external_id": "T1055",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:47.843Z",
  "modified": "2026-09-11T20:00:48.048Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "privilege-escalation"
  ],
  "source_references": [

  ]
}

Explicit source assertions (102)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9025 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0200e185-a06e-470c-af16-814f84f1f6d7

Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0321e766-10c1-4215-9fd6-7f712b642dca

Microsoft Axios Compromise APR 2026 · 1 - appv

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0432482e-344c-4be3-9a70-5391cf41a935

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:T1055.013 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07683c47-4572-4579-93e7-ac83f2933ac2

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07c87a67-32d0-4b86-9345-aad1a0241340

BiZone Lizar May 2021

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11f33a6b-f2f5-4c35-a72a-e2197340b425

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:S0581 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14d60e02-4ceb-4972-844c-412e9599144f

Unit 42 IronNetInjector February 2021

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15ccaabe-9b15-4d30-8931-d86d9af9f911

Google Cloud APT41 2024

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17ec5db7-d1cd-4057-9d95-a6da56b06825

Gigamon BADHATCH Jul 2019 · BitDefender BADHATCH Mar 2021

ATTACK:enterprise:T1055.012 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d79747d-3ff5-44ab-ae40-80823347c7d7

ATTACK:enterprise:S0398 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e9c15dc-2ba7-421e-8d67-6b59e0c457c7

Unit42 Emissary Panda May 2019

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--223a75cd-eb8f-4477-b4c3-e2a4e651d875

GitHub Sliver C2 · Cybereason Sliver Undated · Bishop Fox Sliver Framework August 2019 · Microsoft Sliver 2022

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--227624a1-7dda-4691-89b3-49336aa68bfa

Cybereason Bazar July 2020

ATTACK:enterprise:T1055.009 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--287b6305-0592-4843-a12b-57f96741a36e

ATTACK:enterprise:T1055.015 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--289c43cc-3b61-4b33-8af7-3010c94b6467

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28a76700-4834-4a1b-bb56-2005bc044e29

Group IB Silence Sept 2018

ATTACK:enterprise:S0436 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a7a5ee2-e949-4d25-895a-43ba0bc8cc33

JPCert BlackTech Malware September 2019

ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c66270f-e6eb-4f0b-9006-9be7fcc9ba3a

McAfee REvil October 2019

ATTACK:enterprise:S0695 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c6c5572-9b89-40cd-8faa-6317945cf939

ATTACK:enterprise:S0470 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dcfc7b7-ead5-4996-b70d-205d4f9d59f5

Trend Micro Tick November 2019

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f0bcef1-1f30-4585-b158-25d614f5f350

Mandiant Cutting Edge Part 3 February 2024

ATTACK:enterprise:S0561 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30df477a-f775-4349-ba03-07a3f4293db4

Medium Eli Salem GuLoader April 2021

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36af6d80-fef4-40b9-9b32-a2947eadd9e7

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a5b04dd-815c-4f52-be7a-e997625c18e6

Mandiant FIN12 Oct 2021

ATTACK:enterprise:S1074 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bffbeb5-27d2-4fc3-b28b-b9f686572009

Mandiant Suspected Turla Campaign February 2023

ATTACK:enterprise:T1055.014 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f7f515f-25f9-4afb-becf-6247f4d6ecd2

ATTACK:enterprise:T1055.005 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4030c6bb-1f3d-4553-90d7-b984c12c5eb7

ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4293a182-e45b-4043-a5e7-d0ef8ae3a863

NCSC-NL COATHANGER Feb 2024

ATTACK:enterprise:T1055.011 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a73a308-45aa-4dcd-9253-c15a065fac84

ATTACK:enterprise:S0347 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c654359-aefe-4c86-a092-44e99931d340

TrendMicro Lazarus Nov 2018

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5291c077-dc09-4716-ab9a-d65318794839

Gh0stRAT ATT March 2019

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--529ad26d-b31e-41c0-8f19-80e2727eb739

Red Canary NETWIRE January 2020

ATTACK:enterprise:S0093 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--535e3fbe-e6d9-4608-9689-f8f1f8c1ddc9

Symantec Dragonfly · Gigamon Berserk Bear October 2021

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54e70260-cbf3-4c6b-bd30-208329cfef26

Fortinet Remcos Feb 2017

ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56e0b679-1c1b-4c82-9346-bde619c21117

Trend Micro Waterbear December 2019

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bf6d81e-634d-4035-a895-87d2d31341ce

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:T1055.001 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e6cf759-1690-41b3-9e41-d8317f4ef83d

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ebc97a3-54ee-4582-92ce-981f67c26f45

DFIR Conti Bazar Nov 2021 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0040 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60a46293-ec9e-4931-8315-03b4f68c2e74

NCSC Joint Report Public Tools

ATTACK:enterprise:T1055.003 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65cf270c-174f-4733-a755-35e2171a529c

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--666f1286-c25b-49ef-9d86-42a00ea69ab1

Trend Micro DRBControl February 2020

ATTACK:enterprise:S0206 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66f859b2-4bc2-4520-afd4-8f8a7b71a50c

Symantec Wiarp May 2012

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ada1a93-2fc2-4bd7-bec8-5d41b406e181

Proofpoint TA2541 February 2022 · Cisco Operation Layover September 2021

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b083f3f-f8db-403d-b922-308b79d20cc7

Group IB Cobalt Aug 2017

ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--722ffa83-29e2-48bb-a7c1-1cb52fb4aa18

Segurança Informática URSA Sophisticated Loader 2020 · SCILabs Malteiro 2021

ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72810e5a-0394-4acc-8c3d-3360df2679ee

Microsoft PLATINUM April 2016

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78af537b-48cc-411d-a209-3e01c44aa87b

ATTACK:enterprise:S0380 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d7adc46-deab-4b32-9902-ac1beb0e95fa

Kaspersky StoneDrill 2017

ATTACK:enterprise:S0247 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81bace85-005e-4edd-bb71-ca7a57bc8a07

Talos NavRAT May 2018

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8235c444-415e-49ee-8ed9-10c24075be1f

Trend Micro Black Basta October 2022 · Kaspersky QakBot September 2021 · Trend Micro Qakbot May 2020 · Kroll Qakbot June 2020 · Trend Micro Qakbot December 2020

ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--836575fd-ffa1-4531-8c16-c875b7f0c177

Cybereason Bumblebee August 2022

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85dc96ac-ec8e-4e15-ba4b-807c1a7b46cc

Github PowerShell Empire

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86f8bebc-a5fc-43d7-9af0-0024e07ca8d1

ATTACK:enterprise:S0168 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8acca861-11fd-49bd-8dbc-0b326f5303d6

ESET Gazer Aug 2017 · Securelist WhiteBear Aug 2017

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90e6cb2a-55c4-4533-bbdc-b8eed2132344

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90eb6858-e561-4ed0-855b-f9afbe3ac394

ESET InvisiMole June 2020

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9305bc36-68ab-4354-bfa4-6834e028b258

ESET MirrorFace DEC 2022 · Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95d0ca69-0e05-4f68-ba95-99094f01e140

FoxIT Wocao December 2019

ATTACK:enterprise:S0226 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95ed1db5-c388-4b1b-9824-9703b248f798

Talos Smoke Loader July 2018

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95fac0e8-32e3-4854-b542-5eb897d76f2e

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--967ab393-8181-4a66-a406-39459b4a1ac7

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S0469 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97fe312d-7a04-43f9-8076-69fe324517ce

Trend Micro Tick November 2019

ATTACK:enterprise:S0473 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99365890-fc6c-46ec-bf1f-66ccbe5d52e7

Trend Micro Tick November 2019

ATTACK:enterprise:C0013 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e784751-c08e-43d8-957a-7d9a35e1cf05

Threatpost New Op Sharpshooter Data March 2019

ATTACK:enterprise:S0614 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a08454ac-6680-4ea1-ab2a-f272f562fc25

BlackBerry CostaRicto November 2020

ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a24d8975-fa51-4ac1-b928-9af5b5660109

PaloAlto CardinalRat Apr 2017

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a308d350-2b2b-486a-a778-8e80f231dc68

ESET Attor Oct 2019

ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a49898fe-a9a0-4e90-9b9e-235d82f2fea7

Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--afdf9b0e-5539-464a-a403-202eaedb13cd

CrowdStrike Ryuk January 2019

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b27650da-9a26-4bd3-9e9e-2559a0b6dc86

Check Point Warzone Feb 2020

ATTACK:enterprise:T1055.008 → subtechnique-of → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4b4c873-3a4a-4bd1-adc2-631c02ddd91c

ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbe59869-4ae5-4bb5-a300-eba77096846f

JPCERT MirrorFace JUL 2024

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc4ba2dc-e9f4-4047-959d-c18d0bafcf8a

Sygnia VelvetAnt 2024A

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcdd57cf-632f-4fc5-a8e8-d3137cb832e8

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd648f03-7313-4e05-bd6e-b499f76a295c

Securelist Kimsuky Sept 2013

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0d5dbce-41bf-4b6a-ad07-a9c39b8ed6fa

QuorumCyber_Vidar_March2023

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1341f02-e2be-4c70-8d14-28170bee2133

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:C0057 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c376fa52-2641-4c12-bd08-ad020d3f5306

Mandiant 3cx UNC4736 2023

ATTACK:enterprise:G0068 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca429946-3c81-4773-8254-108dbdbb9da9

Microsoft PLATINUM April 2016

ATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1055

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cb02fb3b-8223-476f-90be-ab50e3432d0a

Kaspersky ShadowPad Aug 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.