PowerShell
Subtechnique · ATTACK:enterprise:T1059.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1059.001",
"title": "PowerShell",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1059/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736",
"external_id": "T1059.001",
"domain": "enterprise",
"created": "2020-03-09T13:48:55.078Z",
"modified": "2026-09-18T13:23:14.419Z",
"version": "1.6",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "Microsoft PSfromCsharp APR 2014",
"url": "https://blogs.msdn.microsoft.com/kebab/2014/04/28/executing-powershell-scripts-from-c/"
},
{
"source_name": "SilentBreak Offensive PS Dec 2015",
"url": "https://web.archive.org/web/20190508170150/https://silentbreaksecurity.com/powershell-jobs-without-powershell-exe/"
},
{
"source_name": "Github PSAttack",
"url": "https://github.com/Exploit-install/PSAttack-1"
},
{
"source_name": "Powershell installation",
"url": "https://learn.microsoft.com/en-us/powershell/scripting/install/install-powershell?view=powershell-7.6"
},
{
"source_name": "TechNet PowerShell",
"url": "https://technet.microsoft.com/en-us/scriptcenter/dd742419.aspx"
},
{
"source_name": "Sixdub PowerPick Jan 2016",
"url": "https://web.archive.org/web/20160327101330/http://www.sixdub.net/?p=367"
}
]
}Explicit source assertions (243)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0068ee65-0945-4f69-ba81-163ffbc05e53
Lab52 WIRTE Apr 2019ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00fe415d-9364-4d03-95ee-f1413d996c30
Group-IB RansomHub FEB 2025ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01563b41-e89b-4cd2-b018-ee57bf616396
Mandiant APT42-charmsATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0345ec62-657e-4673-89a1-d17e85f5dab0
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0381e557-6c8d-45c5-b390-f7909f782d3f
Recorded Future RedDelta 2025ATTACK:enterprise:C0025 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04175eba-3f58-42ce-897b-1d483c4c12e0
Dragos Crashoverride 2018ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--06de29d8-365b-4072-a4bb-9d436763ea1e
RedCanary Mockingbird May 2020ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07ef8045-6a01-4764-a351-a8a2ee2170f7
Gigamon BADHATCH Jul 2019 · BitDefender BADHATCH Mar 2021ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--095d2af9-dca4-4a7a-b22e-e37923e7c43c
Github PowerShell Empire · NCSC Joint Report Public ToolsATTACK:enterprise:S0330 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b77fa58-6fd7-4002-955e-e3e1705d54c2
Talos Zeus Panda Nov 2017ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b98618a-fca0-49e4-b611-b93bf8f9cd1e
SophosGnGal_SystemBC_Dec2020ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b9a6189-858f-4f49-952a-21075b860dc6
Logpoint_StealerMalwareFamilies_2024ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f50a4e4-6ceb-4ead-88ed-147592e0b398
BitDefender Chafer May 2020 · Symantec Chafer February 2018ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--110690db-fd9b-425a-9269-ec082f0af3f9
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022 · Unit 42 Magic Hound Feb 2017 · FireEye APT35 2018 · Microsoft Iranian Threat Actor Trends November 2021ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11475791-a127-476d-acaa-905e2397be5f
Group IB Ransomware September 2020ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1219cbd2-26b8-4a2e-bbf1-477afc396203
FireEye APT19ATTACK:enterprise:S0622 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1628f41f-4941-40d7-a11c-1f345925ab6e
Malwarebytes Kimsuky June 2021ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16e90509-5ea2-48ff-8e09-686dcfddbb3b
Palo Alto Sofacy 06-2018 · TrendMicro Pawn Storm Dec 2020 · Cybersecurity Advisory GRU Brute Force Campaign July 2021ATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--181575ee-d601-4681-8568-1904917e2c15
ESET Turla Lunar toolset May 2024ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1aaecef9-d21a-420c-a6c0-53cca7a5e5d8
FireEye APT41 Aug 2019 · FireEye APT41 March 2020ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ad06cf0-26dd-4020-b57b-f26e83ae1875
Joint Cybersecurity Advisory LockBit 3.0 MAR 2023ATTACK:enterprise:S1140 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b6f1db5-a16b-4bfa-aab0-9109abec30c2
Google TAG COLDRIVER January 2024ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d8fedc7-e139-4806-9904-3cc2bf8b9334
Dragos Crashoverride 2018 · US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:S1155 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fe15306-2903-4eaf-bf77-dbf80bd23809
Github CovenantATTACK:enterprise:C0051 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--200c0e0f-f4d6-4271-9963-e8487ea8f065
Nearest Neighbor VolexityATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20139f78-9319-4a34-8b10-8a81dd2b763f
DOJ FBI Handala Hack March 2026 · FBI IC3 Flash VOID MANTICORE Handala Hack March 2026ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23bd8751-1083-4c0b-8ec1-b5f637c5fbc7
Secureworks GandCrab and REvil September 2019 · Talos Sodinokibi April 2019 · Intel 471 REvil March 2020 · Group IB Ransomware May 2020ATTACK:enterprise:G1019 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--277532f0-8f01-4b9d-b59a-3c993f5e528d
MoustachedBouncer ESET August 2023ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2cd5235f-1f0b-4f58-a931-d3b940b62cbf
NCC Group Team9 June 2020 · CrowdStrike Wizard Spider October 2020ATTACK:enterprise:C0034 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ed4e002-fe79-4ea9-94e6-d05d1c5358a9
Mandiant-Sandworm-Ukraine-2022ATTACK:enterprise:G0052 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f68f61d-07e1-4181-a26c-93433f9f0db7
ClearSky Wilted Tulip July 2017ATTACK:enterprise:S1201 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30e5b5fc-192a-4a25-8f9a-9b4f43c18a8f
Zscaler Kimsuky TRANSLATEXTATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31728aa8-de3d-4edd-8c39-3d9d3091341a
MalwareBytes WoodyRAT Aug 2022ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--328636ab-7265-4212-96d4-4ebf2e6a65db
GitHub PupyATTACK:enterprise:S0514 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32be4e3c-fa7f-4ec5-abee-2ed631d0494a
PWC WellMess July 2020 · CISA WellMess July 2020ATTACK:enterprise:G0076 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33bba084-3681-4955-861d-2ff6fe02ad9b
Symantec Thrip June 2018ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37224c2a-26a2-40cd-bcf1-a3f309c0fc63
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024 · Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--375253bd-1832-4177-a1b1-92b42a6a599b
Cisco Ukraine Wipers January 2022 · Unit 42 WhisperGate January 2022 · Medium S2W WhisperGate January 2022ATTACK:enterprise:S0393 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--392ae34f-3fb7-444b-a5cc-3a1ddcaa96a6
ESET Turla PowerShell May 2019ATTACK:enterprise:S0389 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--398a5e5a-b624-4992-b26c-2abb37c9c2db
Carbon Black JCry May 2019ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a26d78f-e0cb-4a58-8d84-6d867b32f279
Bitdefender Trickbot VNC module Whitepaper 2021ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3aee51e9-9dad-44da-ad48-b2ca7afdeefd
rapid7-email-bombingATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b02e08d-f6fe-4d7b-907d-e8c6534f9a98
Mandiant FIN13 Aug 2022ATTACK:enterprise:S9039 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bb5ea0a-5136-462d-a74d-1b7369c7cdb3
CERT PolskaATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ed930d6-ab79-4642-8320-2ed59d899b6d
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:S0553 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f2f8ae7-0690-4987-a00c-6b234b938fef
Cybereason Molerats Dec 2020ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fabf752-3732-4958-9b2c-e9a2e1ebbd0f
Trend Micro Ransomware Spotlight Play July 2023ATTACK:enterprise:S1129 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--424f1b60-9dbb-4022-8789-5338c7e1caa0
CISA Akira Ransomware APR 2024 · Kersten Akira 2023ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--431f7f45-8955-48d3-948a-891ed2a59c3f
ESET Lazarus Jun 2020ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--43ec2047-44fb-49a5-b24a-9edcb5378e5c
Prevailion DarkWatchman 2021ATTACK:enterprise:S1117 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--447f5271-30fc-4d12-8b60-b0af862b9b03
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:S0441 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47747638-0f8d-4735-b16d-b52861dec73f
Unit 42 Inception November 2018ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4856de0a-2635-4081-97a8-3f15593c2aa5
BlackBerry_FIN7_April2024 · Mandiant FIN7 Apr 2022 · FireEye FIN7 April 2017 · Gemini_FIN7_Jan2022 · Morphisec FIN7 June 2017 · FBI Flash FIN7 USBATTACK:enterprise:S0680 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--487f677f-4525-4a02-ac95-2a83e4a4bf7b
Kaspersky WIRTE November 2021ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4bf29716-d465-431c-9c45-f2b7a213cdec
group-ib_redcurl1 · group-ib_redcurl2 · trendmicro_redcurlATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c13f346-bdd9-4759-b1a8-1f3a38c6055b
SentinelLabs Metador Technical Appendix Sept 2022ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d173123-f1ff-45c8-9196-84678e6c5130
S2W Troll Stealer 2024ATTACK:enterprise:C0001 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4dea60e2-5339-4aed-b9a8-5ebf6af2f431
Talos Frankenstein June 2019ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fcdf0b6-23c7-406c-95ba-b335b05642e5
ATT TeamTNT Chimaera September 2020ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fde23ab-b8db-4275-ac37-37e608cb00b0
Trend Micro Earth Simnavaz October 2024 · OilRig New Delivery Oct 2017 · Crowdstrike Helix Kitten Nov 2018 · FireEye APT34 Dec 2017ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--500c36bc-9f08-404c-9aa6-38680c529ced
FireEye NETWIRE March 2019ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52358511-3339-4a85-a389-f336aa43d3fc
Kaspersky ShrinkLocker 2024ATTACK:enterprise:S0685 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5238d74f-8d6c-420f-a521-f68937934842
Microsoft Actinium February 2022ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5420c4d7-41ff-40d0-9225-05ba7dfe48f3
Immersive Labs Havoc C2 APR 2024ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54fad432-5890-4a82-b1c3-83c54ad773ff
SentinelOne Gootloader June 2021 · Sophos GootloaderATTACK:enterprise:S0371 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--570da7ec-2d72-4e1b-9f30-f0e1a10085bf
FireEye APT33 GuardrailATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58a77e0d-8848-47a8-b743-e69aced6b50b
IBM StrelaStealer 2024ATTACK:enterprise:S0256 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58c28a92-b3ed-41de-841d-8b8d1ad142be
ESET Turla Mosquito Jan 2018ATTACK:enterprise:S0499 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a54aabe-e485-4a01-b284-cb080b11582b
FireEye HancitorATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a580cd0-19f1-41d6-865b-786a41081a7e
ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ac99030-a310-4607-bce1-490bf63639a7
CarveyODonnellWelchHuntress_TheGentlemen_May2026 · CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026 · TrendAI_TheGentlemen_Sept2025ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b2457a6-a2b8-4809-a2a0-68d1c74bbb9b
Unit 42 Inception November 2018 · Kaspersky Cloud Atlas December 2014ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b62e906-a48a-4897-82cf-49a947782780
McAfee Cuba April 2021ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b69fc3c-1bf7-4092-be94-755790ccf41f
Palo Alto OilRig May 2016ATTACK:enterprise:S0613 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5cb2c8db-bd76-4a39-be55-6de6864cb129
BlackBerry CostaRicto November 2020ATTACK:enterprise:S0583 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5db4c540-d95b-4a38-9d05-c21d7c85c9b1
CERT-FR PYSA April 2020ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5df525ae-d983-4fde-ac10-b07a820d9046
Google TAG Lazarus Jan 2021ATTACK:enterprise:S0546 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5eabbcb7-3672-4518-9e2e-2a5a8e3120fa
Cybereason Molerats Dec 2020 · BleepingComputer Molerats Dec 2020ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5f00edf9-fcfc-4514-8d06-bc69f91f9260
FireEye APT32 May 2017 · Cybereason Oceanlotus May 2017 · Cybereason Cobalt Kitty 2017ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6337cf38-4b52-4e3d-a63e-670e077ec52f
Cycraft Chimera April 2020 · NCC Group Chimera January 2021