aol.pm

Unix Shell

Subtechnique · ATTACK:enterprise:T1059.004

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1059.004",
  "title": "Unix Shell",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1059/004",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--a9d4b653-6915-42af-98b2-5758c4ceee56",
  "external_id": "T1059.004",
  "domain": "enterprise",
  "created": "2020-03-09T14:15:05.330Z",
  "modified": "2026-05-12T15:12:00.707Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Apple ZShell",
      "url": "https://support.apple.com/HT208050"
    },
    {
      "source_name": "DieNet Bash",
      "url": "https://linux.die.net/man/1/bash"
    }
  ]
}

Explicit source assertions (72)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1184 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--054ee669-c678-4519-9cf6-1bff8d48d1bf

Google Cloud BOLDMOVE 2023

ATTACK:enterprise:S1224 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--072e7d6e-2f40-4a50-a201-00448f2708b0

Mandiant Fortinet Zero Day

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--077bd0e4-5279-4409-89ab-9885bcc0ae85

Crowdstrike HuntReport 2022

ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0929a479-8ece-4c24-a97f-4da7e33d3c2f

ESET Ebury May 2024

ATTACK:enterprise:S1107 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ab3c5b0-1536-4b65-9feb-48dd8a9981a1

NKAbuse SL

ATTACK:enterprise:S1163 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0dccded9-7eba-42e4-8137-5d56e440cefe

PWC Sea Turtle 2023

ATTACK:enterprise:S0647 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f363688-a168-4e9f-94e6-75142875c802

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--14ba8b29-133b-456d-b85d-139de4510bb1

Cisco Talos Intelligence Group · Trend Micro TeamTNT

ATTACK:enterprise:C0048 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--172d44b8-d287-49f3-b5cd-bf95285f3ef2

Palo Alto MidnightEclipse APR 2024 · Volexity UPSTYLE 2024

ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2063f611-1da2-4a62-bbb6-38b37580679f

MacKeeper Bundlore Apr 2019

ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--228c84a6-e6fa-45f3-9f89-36a0c95fb1e7

Leonardo Turla Penquin May 2020

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2390e766-7624-45bf-81c7-2ecd5437b9bf

Sekoia ClickFake 2025

ATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2398e409-24d3-4dd9-9353-8b6cf9eee81d

Aqua Kinsing April 2020

ATTACK:enterprise:S0641 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2df3ee99-0ad3-4da8-b25e-bbb47bb8562c

ESET Kobalos Feb 2021

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31e01486-8827-41cd-a21b-dc420554d1bb

Talos Rocke August 2018

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3268cdc0-7cee-4fe5-92cc-2c3cdc06712b

Fidelis Turbo · FireEye Periscope March 2018

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ba68905-3ef8-4af4-a4e5-c956be4e33c0

Sygnia VelvetAnt 2024A

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43f89952-900a-4f5e-a6c9-345e3654cda4

AI-Mexico-Govt-Breach

ATTACK:enterprise:S1108 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--459c1849-b2c7-4bd3-96a1-578c1f231579

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:S0220 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4847b10f-f9da-4a35-8df8-e235c6244ba2

Chaos Stolen Backdoor

ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--494a36cf-644a-4efe-90c9-eb3b10d549e6

NCSC-NL COATHANGER Feb 2024

ATTACK:enterprise:S0502 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49eef071-24e0-456b-b4e7-618ab601c6f4

NSA/FBI Drovorub August 2020

ATTACK:enterprise:C0053 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d99ce05-a9d1-4359-b0e0-8c3126ca7e29

ORB Mandiant

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f5d7297-9636-42aa-8342-580658abd971

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f9fef8b-1ceb-4a10-b6ea-ff2a9680154f

Trend Micro MacOS Backdoor November 2020 · sentinelone apt32 macOS backdoor 2020

ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51adc4b0-bf1b-4c55-ac6c-72b46560e833

Medium Anchor DNS July 2020

ATTACK:enterprise:S0451 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55aa08a3-d33a-465b-8d48-d25566ce0957

ESET LoudMiner June 2019

ATTACK:enterprise:T1059.004 → subtechnique-of → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a67ece5-7409-4eb5-8c64-4a67e2f52776

ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ab6dc99-d0ca-4b13-8d9e-811773dfa8a7

Socket Shai-Hulud November 2025

ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60da816d-f78b-4566-9587-b572ad579e15

CISA AppleJeus Feb 2021 · ObjectiveSee AppleJeus 2019

ATTACK:enterprise:S0466 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b4a458b-d87a-4dc4-a375-46f4c1e6449a

objective-see windtail1 dec 2018

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ea74151-62ea-462e-988e-7704db70ec87

Carbon Black Shlayer Feb 2019 · objectivesee osx.shlayer apple approved 2020 · sentinelone shlayer to zshlayer · 20 macOS Common Tools and Techniques

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f5aaa40-a294-4b8f-8bd3-0f34ce8a0612

Google Cloud Threat Intelligence ESXi Hardening 2023

ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74520dc9-2793-40a8-a2b6-b38e6d7c37fc

Juniper RedPenguin MAR 2025 · Mandiant UNC3886 Juniper Routers MAR 2025

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79b95cda-7281-4a71-ac67-007615653d1b

Red Canary NETWIRE January 2020 · Proofpoint NETWIRE December 2020

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a9e9275-44c2-40c9-9eb3-cafc54503874

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0600 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c9e8275-a3d5-42cf-9202-5737f98362ee

Intezer Doki July 20

ATTACK:enterprise:S0369 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d20cbaf-a154-4192-9a97-ef2662d07246

CoinTicker 2019

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d6c7fdf-2a63-44ac-b709-ea360c054513

CERT Polska

ATTACK:enterprise:S1198 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80ef6372-2983-48bf-b963-33592cdf8128

Symantec Troll Stealer 2024

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81f6621f-37c2-49ef-81d5-80a9b6a6ae44

Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--841194b6-a8cd-48e6-ba73-b73e54ab44e5

Kandji Cuckoo April 2024

ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--848d4bf7-106b-4075-a541-07f2260cd7a6

Aikido TeamPCP Trivy MAR 2026 · Aikido CanisterWorm MAR 2026

ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--883cf8ae-faba-4dfa-82b9-b9c09282b4e2

Lumen KVBotnet 2023

ATTACK:enterprise:S1114 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c85fcbd-cb56-45be-ba9f-ba67177f2785

Mandiant Cutting Edge January 2024

ATTACK:enterprise:S1123 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e5310df-b8df-49da-9ae0-dc6c3806e706

Mandiant Cutting Edge Part 3 February 2024

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--948e72c7-c744-4a3f-a592-7e0b3786951d

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:S1217 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95fef2c1-2672-4d48-8b06-2d909e1011ee

Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:S1219 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5814aba-ed04-41eb-8b30-28bbb9680eef

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a73b2e1c-fb14-4e1f-bbe2-b216bb38c694

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8b93875-6ad4-492e-afa1-0549ada7d7ca

FireEye APT41 March 2020

ATTACK:enterprise:S1161 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8c03a54-4337-449c-8ef0-d77046eb650f

Sandfly BPFDoor 2022

ATTACK:enterprise:S1109 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aac05114-174d-4c78-88b6-be502128b476

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:S0690 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--abb80a28-3fc0-4e1f-8d39-83567be53835

Objective See Green Lambert for OSX Oct 2021 · Glitch-Cat Green Lambert ATTCK Oct 2021

ATTACK:enterprise:S0468 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3bcdaeb-e4d7-403d-902e-df55aa5b6bb9

Trend Micro Skidmap

ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c08ebacd-b5e4-48c3-8ee6-389c635801da

ESET DazzleSpy Jan 2022 · Objective-See MacMa Nov 2021

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3cef4f4-fab3-4eb7-b4f9-d707d61f9202

Hunt.io TeamPCP Toolkit MAY 2026

ATTACK:enterprise:S0077 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3d3bb7d-65cc-4915-bc28-492d341e6dbd

Scarlet Mimic Jan 2016

ATTACK:enterprise:C0055 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6a76d93-7007-4e1e-81ff-43341ca9932c

Bitsight 7777 Botnet · Microsoft Storm-0940

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2b8fa7f-7bd5-4bf5-b5e0-82ec42f40283

Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2c3385c-2d4c-4ef5-9064-8b33d976353c

Hunt Sea Turtle 2024 · PWC Sea Turtle 2023

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d586b2af-ad13-48f2-b7d6-126172d25f9a

Sysdig TeamPCP MAR 2026 · Palo Alto TeamPCP MAR 2026

ATTACK:enterprise:S0401 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db451851-13b7-4aec-9146-2a770115140a

ESET TeleBots Oct 2018 · ANSSI Sandworm January 2021

ATTACK:enterprise:S0492 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dcbe360b-c7d3-45bd-a1ef-a13bc2a562fe

Unit42 CookieMiner Jan 2019

ATTACK:enterprise:S9063 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd5a1af2-e799-4368-b9ba-4bc60933c30c

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de1f13d3-a6a0-4170-947d-81b59d1262ef

trendmicro xcsset xcode project 2020

ATTACK:enterprise:S1222 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e108870b-ba34-4e53-afcc-67a3ab96f260

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e87efc12-0c0f-47d8-98e1-52b2d0508d3a

Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024

ATTACK:enterprise:S1203 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb1f427d-62ae-4f5d-8561-c7bcfa91d850

Lumen J-Magic JAN 2025

ATTACK:enterprise:S0279 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee998ebb-2960-45db-bced-7c8081dfc030

objsee mac malware 2017

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f90759fc-14cb-4f29-a2b6-221d6fb0e884

Unit 42 Hildegard Malware

ATTACK:enterprise:S0410 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff9e0633-9618-4616-a303-f9bb059f6289

Fysbis Palo Alto Analysis

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.