Skip to content

Process Discovery

Technique · ATTACK:enterprise:T1057

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1057",
  "title": "Process Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1057",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
  "external_id": "T1057",
  "domain": "enterprise",
  "created": "2017-05-31T21:30:48.728Z",
  "modified": "2026-09-11T19:40:13.112Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "show_processes_cisco_cmd",
      "url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/show_monitor_permit_list_through_show_process_memory.html#wp3599497760"
    },
    {
      "source_name": "Crowdstrike Hypervisor Jackpotting Pt 2 2021",
      "url": "https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"
    },
    {
      "source_name": "US-CERT-TA18-106A",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
    },
    {
      "source_name": "Sygnia ESXi Ransomware 2025",
      "url": "https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/"
    }
  ]
}

Explicit source assertions (326)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01f98d14-77b9-439f-8b44-920fcaca2b2b

Kaspersky Turla · Kaspersky Turla Aug 2014

ATTACK:enterprise:S9024 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--029f4f57-f14b-47c3-9c34-afe3c2e465ae

CISA SPAWNCHIMERA RESURGE February 2026 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--057815bb-550c-4e00-bfdb-c7e4bf6461cb

Check Point Warzone Feb 2020

ATTACK:enterprise:S0267 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--058c67f3-9345-42be-a433-a4cea314d26d

ESET GreyEnergy Oct 2018

ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06f0aaf3-c2ff-4d54-8279-2e7f66b5d819

Juniper RedPenguin MAR 2025

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07e77aac-6518-41d9-9330-7df48651933b

Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024

ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08052557-0aa5-49d0-9254-722e4f04804f

Talos Frankenstein June 2019

ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08cdfbc3-eefb-44a2-9ec1-59b2dbc76392

JPCERT MirrorFace JUL 2024

ATTACK:enterprise:G0112 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09237e32-a423-4ce3-bb15-4e47848ee7f7

BlackBerry Bahamut

ATTACK:enterprise:S0562 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09f6307c-819e-4e35-bfc7-5314b0c3ce85

CrowdStrike SUNSPOT Implant January 2021

ATTACK:enterprise:S9012 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a7ee066-d242-437c-976d-a59de4dff90e

Google UNC5221 Ivanti April 2025 · Picus Security UNC5221 Ivanti May 2025

ATTACK:enterprise:S0142 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0cbc1f3f-7a32-4056-bfa6-25186ac5e6a4

Cylance Shell Crew Feb 2017

ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e60931e-34df-4a29-936f-32064ec007c1

Check Point Blind Eagle MAR 2025

ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ed0ef18-126f-4a03-ac2a-f315dfb48b7d

CheckPoint Naikon May 2020

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ffa13fd-ca80-4541-a166-9c297145180d

CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023

ATTACK:enterprise:S0149 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1035fe41-56b9-4966-bf3b-109ae950c908

Palo Alto MoonWind March 2017

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1051f320-91fa-4f89-8abe-a851a56e18a7

Unit42 Cannon Nov 2018 · ESET Zebrocy Nov 2018 · Unit42 Sofacy Dec 2018 · ESET Zebrocy May 2019 · Accenture SNAKEMACKEREL Nov 2018

ATTACK:enterprise:S0581 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10b4ef89-5f69-4809-a410-37256407b5fa

Unit 42 IronNetInjector February 2021

ATTACK:enterprise:S0277 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--112fec98-96be-4843-a56e-90d6b3fc02b2

objsee mac malware 2017

ATTACK:enterprise:S0351 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11870221-f730-4844-a441-ac1e8d21bc4b

Unit42 Cannon Nov 2018 · Unit42 Sofacy Dec 2018

ATTACK:enterprise:S0451 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1232c797-ebf4-4036-9ebb-a65fbe8b1443

ESET LoudMiner June 2019

ATTACK:enterprise:S0059 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13204383-a747-4f7f-a75c-858ddc76beab

Baumgartner Naikon 2015

ATTACK:enterprise:S1013 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13a3b832-a680-4c50-b413-c8137a6a89b5

Cisco Talos Bitter Bangladesh May 2022

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13ab9b58-b18a-437f-898e-fc598e8d0939

ESET Grandoreiro April 2020

ATTACK:enterprise:S0271 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14639d10-6371-4e84-a637-a0e5846cb053

US-CERT KEYMARBLE Aug 2018

ATTACK:enterprise:S0219 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--149a056e-9061-4345-a46a-c1f73653d16a

FireEye APT37 Feb 2018

ATTACK:enterprise:S0034 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16043223-3846-4138-93d0-671339ba3646

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17cafa26-57f1-4efb-9d23-1399cd2de4cd

Unit 42 Tropic Trooper Nov 2016 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18c07e03-0456-4854-bf63-07eb6d6bd868

BlackBerry CostaRicto November 2020 · FireEye FiveHands April 2021 · CISA AR21-126A FIVEHANDS May 2021

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18d29bb2-655b-4e3d-9759-32a74be3eb75

CrowdStrike Ryuk January 2019

ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1923a47b-5a48-44e6-883f-ca23a96fea46

ESET Sednit Part 1 · Unit 42 Sofacy Feb 2018

ATTACK:enterprise:S1107 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19e85b54-a6b4-4141-9284-d405af345372

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a1d72d9-3dd3-410d-99cc-ada6def874ff

Volexity SolarWinds · CrowdStrike StellarParticle January 2022 · Microsoft Deep Dive Solorigate January 2021

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b03ba23-cbf3-4a77-8c8b-233a19e42a0c

Unit 42 Bisonal July 2018 · Kaspersky CactusPete Aug 2020 · Talos Bisonal Mar 2020

ATTACK:enterprise:S1114 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c186ff7-913a-46b3-b796-d3445ba0901c

Mandiant Cutting Edge January 2024

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ca28941-562d-45e4-946c-518a2015c0dd

Cybereason Valak May 2020

ATTACK:enterprise:S0436 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cc625dd-3079-4aa5-99f5-db1897795500

JPCert TSCookie March 2018

ATTACK:enterprise:S1050 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d6eb87c-6ed9-4432-a51c-b0ef70190120

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0015 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e0fdaa6-7a6f-4bd6-a1ef-3ee85d1d89b2

Trend Micro IXESHE 2012

ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e10af38-1695-45ab-8db2-8cd476a58a45

MacKeeper Bundlore Apr 2019

ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e9f6719-24c5-4c8b-a832-506f46bbadb6

ATT Sidewinder January 2021

ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ed17f60-d6ca-4ef7-ae52-7a573c2a7ff3

CISA SoreFang July 2016

ATTACK:enterprise:S0229 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fbd687c-3e02-43b8-a160-4319a7d754ac

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fbf92c8-747b-4c0f-ab33-ce63cbff8197

Alperovitch 2014

ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22926f48-80d0-4ce1-8ee0-41a8930b34ef

Bitsight Latrodectus June 2024 · Latrodectus APR 2024 · Elastic Latrodectus May 2024

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23c028d1-6963-4033-b91f-5953413df43c

Unit 42 Lucifer June 2020

ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23c76193-d7e8-4dca-a9d6-e9b6b0bacfea

Huntress LightSpy macOS 2024

ATTACK:enterprise:S1132 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24936948-7c46-4c12-a64f-4715ccfb6ffb

SentinelOne Agrius 2021

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--268d6aed-3961-42d9-9d34-785a9903d004

ESET Machete July 2019

ATTACK:enterprise:S1133 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2693f023-45bc-4244-acf7-a84c91bb4b0b

SentinelOne Agrius 2021

ATTACK:enterprise:S0201 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2738fdf5-b448-4c28-9918-dec89c31b2fc

Microsoft PLATINUM April 2016

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2863b77b-a029-4c9e-a573-e5e16d979391

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:S1147 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--297166d8-036f-4bec-a3bf-acc416427a7f

ESET EvasivePanda 2024

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29d1fe5a-4ea4-4fb2-8b64-afcceee45d10

Lunghi Iron Tiger Linux

ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a47008b-49af-4ecc-b018-ef92786ead72

Profero APT27 December 2020

ATTACK:enterprise:S0605 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c1758b2-6809-48f5-84f1-e82afa950a9f

Dragos EKANS · FireEye Ransomware Feb 2020 · IBM Ransomware Trends September 2020

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c3934ce-291a-41ab-b389-193170f40e36

Trend Micro Mustang Panda Earth Preta Toneshell February 2025 · 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c586158-d02b-468a-bee8-04e1bde320e1

F-Secure BlackEnergy 2014 · Securelist BlackEnergy Nov 2014 · ESET BlackEnergy Jan 2016

ATTACK:enterprise:S0252 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d1beee9-0b61-4e66-9487-97f1665bbedc

McAfee Gold Dragon

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f5a0454-031c-49e0-979e-c38f4cc4bbcc

Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026

ATTACK:enterprise:S0410 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3029d06e-7a13-4d17-bad5-ce3198bce2ef

Fysbis Dr Web Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3076f49e-0db2-4652-a07d-653027aeef1e

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--307ae6b5-b4ea-4ef2-bc99-544dbb31cb45

NCSC-NL COATHANGER Feb 2024

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31667cdd-1ac5-46f5-8dbd-9ebaf09f00a9

Fortinet Diavol July 2021

ATTACK:enterprise:S0057 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32a470e7-4bbc-43e8-ae8e-09b382dd441f

Microsoft Tasklist

ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--333c5688-edc4-40ba-a382-e98f4473d8c7

ClearSky Lebanese Cedar Jan 2021

ATTACK:enterprise:S0049 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3363ae54-1fe3-4c9f-b074-79dc0d7fbba5

F-Secure The Dukes

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34c63b13-dfd5-4b44-9c74-37068cbe46da

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3556f624-1f62-4b47-bf47-3f967a1f9eeb

AI-Mexico-Govt-Breach

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--366bf114-ddd3-473a-9468-c82811c6ed70

Cybereason Astaroth Feb 2019

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--368510dc-1050-45df-81f2-1fca6118c2b0

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37ece881-96cf-441a-981d-ff3eeac292d7

McAfee Bankshot

ATTACK:enterprise:S9045 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38215713-5226-4adf-899f-a0017fb133ed

AI-Mexico-Govt-Breach

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38416e2a-3590-4827-9a6f-d8f1df6568af

ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--387d5cbe-8862-45c1-9577-c1424b072283

SentinelLabs Metador Sept 2022 · SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:S0330 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39f3e098-ca5d-4dc4-9cbb-bc29148def30

GDATA Zeus Panda June 2017

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b0a7f6a-173f-41e6-8dec-2d1b4a0851d9

Symantec W32.Duqu

ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c210990-7596-4773-a640-adf44490d08d

Palo Alto Comnie

ATTACK:enterprise:S0497 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4001577c-16aa-4edc-ba15-1f0f9ba35c13

TrendMicro macOS Dacls May 2020

ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--408db284-4c7a-4ad4-8399-90a8102b4bfa

FireEye APT34 Dec 2017

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.