aol.pm

Local Data Staging

Subtechnique · ATTACK:enterprise:T1074.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1074.001",
  "title": "Local Data Staging",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1074/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--1c34f7aa-9341-4a48-bfab-af22e51aca6c",
  "external_id": "T1074.001",
  "domain": "enterprise",
  "created": "2020-03-13T21:13:10.467Z",
  "modified": "2026-09-11T19:49:27.665Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "Prevailion DarkWatchman 2021",
      "url": "https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"
    }
  ]
}

Explicit source assertions (145)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05669b75-65ea-4b30-8f97-f2c806a0703d

rapid7-email-bombing

ATTACK:enterprise:S0264 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0634c754-9660-414f-8304-d9d92e37a0ce

Unit 42 OopsIE! Feb 2018

ATTACK:enterprise:S1029 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--066425f1-79cb-4cbc-b570-0280ac503c55

MalwareBytes SideCopy Dec 2021

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0764c8ee-8577-4124-9658-7cc90f74726f

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ce76eff-085b-47c7-bce4-144d4b4252fc

CISA Leviathan 2024

ATTACK:enterprise:S1110 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f578b99-3d14-4416-8936-51e11d71a47b

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--118d9413-0b34-47e6-b333-b712e78dc404

Securelist Dtrack · CyberBit Dtrack

ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11fdff9c-078b-48f6-ac6c-4a2c89dafc4f

S2W Troll Stealer 2024

ATTACK:enterprise:S1015 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13e52bdf-aa82-4220-8a02-02c735c4fccf

ClearSky Siamesekitten August 2021

ATTACK:enterprise:S0247 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1784577e-9d82-497b-aba1-bc4d5a23d8f8

Talos NavRAT May 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b45f3b5-b7a4-4424-a8ff-1b1f1c1a55d9

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1bf421b0-1faf-403d-a8c6-3f5eb90d7c9d

ATT Sidewinder January 2021

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e46f5cf-dfaf-4cc6-a685-ee876f371b7e

TrendMicro Ursnif Mar 2015

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20b14e6f-685d-4b88-9ab7-40f7beb99ec4

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23a9b432-2d25-45a7-b75f-7496b26702f8

ESET MirrorFace DEC 2022

ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2545e3a8-751e-443b-ad4e-da1843014f6b

FireEye TRITON 2019

ATTACK:enterprise:G0053 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2af3c673-c0c6-4246-aacc-984eb370e7b9

Mandiant FIN5 GrrCON Oct 2016

ATTACK:enterprise:S0024 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d82c7df-baa0-4268-855d-03df92fa35ab

Malwarebytes Dyreza November 2015

ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--330e86f3-f4ff-4fe0-af64-cd3c86849239

Unit 42 BadPatch Oct 2017

ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--343c6e94-fda1-41d6-865e-6a30570afb98

Prevailion DarkWatchman 2021

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c3646c8-56a5-443a-a71f-a32ea6269750

McAfee Honeybee

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f564288-8695-4cbc-a8b9-813cb67e0f1e

FoxIT Wocao December 2019

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40082714-cb19-482f-9b6d-22031ef39926

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4126e124-fb28-4274-a687-dc5344b34859

SentinelLabs Metador Sept 2022 · SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:T1074.001 → subtechnique-of → ATTACK:enterprise:T1074

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4180422b-a478-4ceb-ac8c-6fe86c85399c

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--421fd048-a5c3-46b0-b1ff-a7510c107879

SentinelLabs Metador Sept 2022

ATTACK:enterprise:S9036 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42ca6477-eae6-4423-8153-a1e0662f3fe5

ESET_MuddyWater_Dec2025

ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44a77efc-9215-4e5a-a246-ac9669dc52a4

Objective-See MacMa Nov 2021

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4618019f-219d-4a50-be6b-434568bd97d0

Microsoft Sapphire Sleet APR 2026 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--487cc105-dd80-4b43-94ae-da23517aab6f

ESET Carbon Mar 2017

ATTACK:enterprise:G0090 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--492ee8f7-6f00-43a9-ae9b-fbf57879c49e

Palo Alto Ashen Lepus DEC 2025

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b03f718-f89a-4652-b3be-5cbe4e0e044f

Eset Ramsay May 2020 · Antiy CERT Ramsay April 2020

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b6c887c-5fae-49d2-acf2-5922bab839dc

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dcb70d9-017b-44b8-a13c-fab275c5bc56

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4df03f98-3c25-4772-8be5-cc1aaeff1cc9

Mandiant Pulse Secure Update May 2021

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e956278-89d6-45b5-a7e3-2ad13ae07e01

Cisco LotusBlossom 2025

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52ae918a-8afe-4e67-801f-d4fabbecef77

Cisco Talos Intelligence Group

ATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--585bbf8f-b2d3-4186-8e15-f57ea1961d8c

Anthropic AI Orchestrated Campaign NOV 2025

ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58643a55-d526-4536-935c-5c1b5c1d9b20

Kandji Cuckoo April 2024

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59193fff-6bea-41c6-b744-36850e6cc39a

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5926c79d-b8a7-419a-b789-7e2ff1ee32b9

Symantec WastedLocker June 2020

ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a3333ef-b106-42db-b0bb-46b2ac7c21b2

Unit42 Agrius 2023

ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b4d7467-8418-42c8-bb6f-ad275fc7fb40

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d397a8d-2195-440d-a0f5-bbf6c3e8f6e4

ESET Sednit Part 2

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f055076-79d1-44e8-95cb-43fc515df2f6

Novetta Blockbuster Loaders · Novetta Blockbuster

ATTACK:enterprise:S0667 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fd8740a-6197-4099-a4d9-af0c9421cfc2

ESET Gelsemium June 2021

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--611cb6eb-efdb-4d74-b354-5064ab52bd34

Symantec W32.Duqu

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6376c6be-5ec7-4775-8984-13a1474dc92d

ESET Attor Oct 2019

ATTACK:enterprise:S9013 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--648c423a-ac35-411d-8ace-59b511e10fb3

Google UNC5221 Ivanti January 2025 · Picus Security UNC5221 Ivanti May 2025

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66773d13-7e97-493f-a1b6-9484c52cc6a1

Koi Glassworm New Tricks December 2025 · Socket GlassWorm January 2026

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68953f34-79e2-482a-bc9a-dbe11c2839ae

NCC Group Chimera January 2021

ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b9d6a84-b73e-4fb3-ad86-64b5832056d4

Bitdefender Naikon April 2021

ATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d657d75-9718-43a8-985e-44d47d1b1d15

Socket BeaverTail XORIndex HexEval Contagious Interview July 2025

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ecbd739-f0c0-4aff-858f-255e3afeee8f

Talos MuddyWater Jan 2022

ATTACK:enterprise:C0017 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7014e092-7f05-4f0a-9c6d-f264bf76de7b

Mandiant APT41

ATTACK:enterprise:S0249 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74edb7f4-4c3b-4573-abb0-c4842032b6c3

McAfee Gold Dragon

ATTACK:enterprise:C0051 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--757936cb-468c-4b60-a996-8089c77cea62

Nearest Neighbor Volexity

ATTACK:enterprise:S9053 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--766eaed1-a26a-4065-8793-17df813e9996

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79333543-6031-4aa4-91be-35d80fae8ed2

ESET Machete July 2019 · Cylance Machete Mar 2017

ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cf7d162-a34f-4951-a643-5bf959283f6b

Symantec Dragonfly · Secureworks Karagany July 2019

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d8e5c4d-afdb-43f9-bfcf-7ed674a516e3

Symantec Darkmoon Aug 2005

ATTACK:enterprise:S0062 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e7c0aa8-a17e-4079-b1fd-188977cf1a6e

Kaspersky MoleRATs April 2019

ATTACK:enterprise:S1104 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--830b0685-3b30-4c7b-9b37-2fca346e6fc8

Mandiant Pulse Secure Zero-Day April 2021

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83ea392a-3959-4b29-b7b8-517a20ec836d

DOJ Affidavit Search and Seizure PlugX December 2024

ATTACK:enterprise:S0395 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87999cb2-7565-465a-ad10-b585be2e3e3f

ESET LightNeuron May 2019

ATTACK:enterprise:S1012 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87aaf244-2ecb-453e-87c0-836f9a26cc59

Cybereason PowerLess February 2022

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87ddc052-0933-4722-9fb2-4653c4a3663c

aptsim

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c9728bd-f58c-4a78-8b4d-63e8fe8cce31

TrendMicro LummaStealer 2025

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--910d0f07-383b-480b-9637-d5b747353bdc

Kroll Qakbot June 2020

ATTACK:enterprise:S0503 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--935d1918-a1ea-4c46-b3b0-5c1d0f44a346

FireEye FIN6 April 2016

ATTACK:enterprise:S1101 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--959bda8e-6c64-4048-9c34-f8ccd64066e8

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S9022 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95ebe979-ec88-489d-ba9d-b4ac2f1f22db

ESET MirrorFace DEC 2022

ATTACK:enterprise:S1043 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--966ce7a3-4306-4003-89d8-9d6af89a0c2e

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97a62430-6a83-4ead-b8c7-ce47f5d0cac0

Mandiant FIN12 Oct 2021

ATTACK:enterprise:S0340 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97ffb5c1-05da-42b4-90eb-60c1eedc1292

Securelist Octopus Oct 2018 · ESET Nomadic Octopus 2018

ATTACK:enterprise:S0196 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--992d6f04-7454-4211-9a44-a5c87fdb7657

Morphisec ShellTea June 2019

ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--996ad086-aad7-40f2-b711-559ea97295c9

Google Cloud APT41 2024

ATTACK:enterprise:C0044 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9bb68fb7-931e-4d24-a042-c6545fb8167f

ESET OilRig Campaigns Sep 2023

ATTACK:enterprise:S0149 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c4a8336-5f5f-4e58-b00d-b6bf1c59ec03

Palo Alto MoonWind March 2017

ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c7ecbf4-88fe-4144-8dc4-f5bca2c3156d

Palo Alto OilRig May 2016

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.