Domain Groups
Subtechnique · ATTACK:enterprise:T1069.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1069.002",
"title": "Domain Groups",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1069/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--2aed01ad-3df3-4410-a8cb-11ea4ded587c",
"external_id": "T1069.002",
"domain": "enterprise",
"created": "2020-02-21T21:15:06.561Z",
"modified": "2026-05-12T15:12:00.623Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"discovery"
],
"source_references": [
]
}Explicit source assertions (40)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--040ff1f7-493d-4762-a9bb-db143a971464
Symantec Orangeworm April 2018ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c472bde-ea1e-48b4-bd55-a32f276b0b13
MSTIC DEV-0537 Mar 2022ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0eb8fe0a-6a6b-4d66-b6ff-e1d7f8f18948
Savill 1999ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1280542b-4574-4567-ad3d-76692271699e
CrowdStrike BloodHound April 2018ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1991b422-2f89-4b90-9cea-7c34919eec05
GitHub SILENTTRINITY Modules July 2019ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19baa7ba-5fdd-405e-996c-13e49299cbfb
CrowdStrike StellarParticle January 2022ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--311c74c3-5eda-4a55-9ac9-a51b518dcb7e
SentinelOne Gootloader June 2021ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--333f527e-15e1-4760-a03b-c1ca4edc351b
Kaspersky ToddyCat Check Logs October 2023ATTACK:enterprise:S0417 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a3efac5-1531-413b-97b7-e210b8880f05
SecureList Griffon May 2019ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e17459a-edb2-471c-87b0-1315f3500ab6
Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--409581f2-270d-43ce-8044-34bc09874548
Palo Alto OilRig May 2016ATTACK:enterprise:S0552 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4358ef19-eef7-48bb-9941-39d70bf235af
Red Canary Hospital Thwarted Ryuk October 2020 · FireEye Ryuk and Trickbot January 2019 · Symantec Bumblebee June 2022 · FireEye FIN6 Apr 2019ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4af77ee9-ee38-4594-81e3-177a2f2d4bfb
Cobalt Strike Manual 4.3 November 2020ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4fb77ea2-93b7-4459-9aa1-570a1abbbbc1
Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--51db2539-ad77-4fa1-8f54-2bb6ccf603df
BlackBerry_FIN7_April2024 · Mandiant FIN7 Apr 2022ATTACK:enterprise:S0184 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--533deac3-2f27-4256-bb11-7d68d8824d47
FireEye APT34 Dec 2017ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6317e636-4766-4968-ac4b-66b1a7199250
DFIR Conti Bazar Nov 2021ATTACK:enterprise:T1069.002 → subtechnique-of → ATTACK:enterprise:T1069
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--644b9639-cb87-4d14-a3af-3a6e8688417b
ATTACK:enterprise:S1068 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7114f449-1436-41ca-ab9e-5704bf3552ef
Microsoft BlackCat Jun 2022ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ac60f16-6b9a-4226-af16-b486f5085f71
Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80cbc348-7246-418a-8b25-e112408a498b
Trend Micro Black Basta October 2022ATTACK:enterprise:S9062 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--851430f2-953a-4d9d-872b-e3608bf1e1ee
CheckPoint_NimbusManticoreEurope_Sept2025ATTACK:enterprise:S9035 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89977608-f01e-4e84-88dc-532145b24943
Cato LAMEHUG JUL 2025ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98737ffe-6b7b-4c2d-a775-7a93e304a9c7
CISA SoreFang July 2016ATTACK:enterprise:S0165 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1fab866-6486-4775-8caf-2b5744971477
Symantec BuckeyeATTACK:enterprise:S0514 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8b6a519-2159-46f0-916d-1f7a3d940eea
CISA WellMess July 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afeb1494-e640-410c-8e81-62970e22f8a7
Intrinsec Egregor Nov 2020ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b02e5116-d609-4e7f-a95e-77bd51f6c4ee
Huntress INC Ransom Group August 2023ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2bd8d90-28ca-4524-85f7-07aaf066b485
BitDefender BADHATCH Mar 2021ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b368c7c2-a593-45cb-b557-aac668a02656
Mandiant Operation Ke3chang November 2014ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcd2cfa1-793c-40a7-9920-614539e651a7
ESET ComRAT May 2020ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bcf90f77-1b2b-46e2-914b-051e51a2d409
Symantec Inception Framework March 2018ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c0a0d653-ff95-4c77-a129-c7f3398a56ca
US-CERT TA18-074AATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c2541365-58bd-474c-82ab-28c7b63e7fb8
Unit 42 Playbook Dec 2017ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4551406-93c4-4d91-8353-b51b57206911
CISA Medusa Group Medusa Ransomware March 2025ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c915bb8a-631a-47b9-9b97-c43939b17661
Bitsight Latrodectus June 2024 · Elastic Latrodectus May 2024ATTACK:enterprise:S0488 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cdcc30ba-b4be-469f-ae09-18913c53205d
CME Github September 2018ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf9c2999-8432-4bcd-b74b-8d5655fcbd7c
CrowdStrike Scattered Spider JUL 2025 · Mandiant VMware vSphere JUL 2025ATTACK:enterprise:S0496 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d57826cf-0fbd-44e5-9d67-9f29a93f1ca6
Kaspersky Sodin July 2019 · McAfee Sodinokibi October 2019 · Secureworks REvil September 2019ATTACK:enterprise:S0105 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f36a8899-940f-4c8f-924d-eef2f056744d
TechNet Dsquery · Mandiant APT41