Skip to content

File and Directory Discovery

Technique · ATTACK:enterprise:T1083

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1083",
  "title": "File and Directory Discovery",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1083",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18",
  "external_id": "T1083",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:04.710Z",
  "modified": "2026-09-11T19:45:35.899Z",
  "version": "1.7",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "Windows Commands JPCERT",
      "url": "https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"
    },
    {
      "source_name": "US-CERT-TA18-106A",
      "url": "https://www.us-cert.gov/ncas/alerts/TA18-106A"
    }
  ]
}

Explicit source assertions (381)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0069 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--007cc21a-685a-4701-99c1-20f258cedc7c

ATTACK:enterprise:S0229 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0188b7af-d060-4715-baf2-ad69333482dc

Proofpoint Leviathan Oct 2017

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01a01a28-19e5-4e32-8a24-a98f2b69ced5

ESET Attor Oct 2019

ATTACK:enterprise:S0136 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03ab3120-4c6e-4de2-982a-fe22d466f748

ESET Sednit USBStealer 2014 · Kaspersky Sofacy

ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03b12a66-789a-4480-8903-deab828d08b6

Proofpoint TA505 October 2019

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0449fd1f-35ee-4c99-ac63-716da2a2276d

Hunt.io TeamPCP Toolkit MAY 2026

ATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05282a2d-21c6-4150-94e0-d57c2f84c887

Aqua Kinsing April 2020

ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--062059e8-21cb-4030-8244-ce7f6643e3c9

Korean FSI TA505 2020

ATTACK:enterprise:S1065 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06ab6825-89f4-4bb7-8c82-ae9a5d4cdf61

MalwareBytes WoodyRAT Aug 2022

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07702379-2d40-48ae-a077-d68e0da5e4be

Eset PlugX Korplug Mustang Panda March 2022 · Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022 · CIRCL PlugX March 2013 · DOJ Affidavit Search and Seizure PlugX December 2024 · Proofpoint TA416 Europe March 2022 · Sophos Mustang Panda PLUGX

ATTACK:enterprise:S1129 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--079b3956-d020-4b9d-a230-e43b391e261f

Kersten Akira 2023 · Cisco Akira Ransomware OCT 2024

ATTACK:enterprise:S0180 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--084ac639-2502-4020-8938-65352349acbb

US-CERT Volgmer Nov 2017

ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08a444cf-9159-4f35-aa4a-691a434940e5

Palo Alto Ashen Lepus DEC 2025

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0925dc87-1a47-4248-ad5b-316f5a1ce22a

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--093bc793-3edd-4096-bd7b-aeb5c855128b

ANSSI Sandworm January 2021

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a2c9965-291c-4724-829b-3cd5e8b26b58

Cybereason Bazar July 2020 · NCC Group Team9 June 2020

ATTACK:enterprise:G1052 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c53d506-c557-43be-99e2-04a907341c8a

ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c75b350-2996-47f8-9e01-38b7cf53481c

Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Google Cloud Threat Intelligence ESXi VIBs 2022

ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d8aa058-426a-45c9-af5b-898746ae5862

Kaspersky Transparent Tribe August 2020 · Proofpoint Operation Transparent Tribe March 2016 · Cisco Talos Transparent Tribe Education Campaign July 2022

ATTACK:enterprise:S0242 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0dba319b-0d1e-4c73-8153-9ce13d27c98c

SecureList SynAck Doppelgänging May 2018 · Kaspersky Lab SynAck May 2018

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e89ca75-b73e-476e-b56d-1cf815fa7868

Cymmetria Patchwork · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:G0054 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0efa0a7a-545d-49e2-b0c4-0e251226404a

Symantec Sowbug Nov 2017

ATTACK:enterprise:S0248 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0efc2bef-9227-4af2-b73b-bfa61a3073aa

ASERT Donot March 2018

ATTACK:enterprise:S0586 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1039ed0e-216f-4eef-9a7e-c4eaa3ca0152

CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020

ATTACK:enterprise:S0064 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10619fa8-c479-4b61-9aac-ee08f00114d1

FireEye EPS Awakens Part 2

ATTACK:enterprise:S1042 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12e62986-c406-4767-9cc5-49d05c5c34b7

Mandiant UNC3890 Aug 2022

ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--135fb6c4-1f42-42ce-b323-22e57ae4fbc6

DFIR Conti Bazar Nov 2021

ATTACK:enterprise:S0410 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13b78b09-00b6-4307-87b7-7cd8c9360b39

Fysbis Dr Web Analysis

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--147e009d-48db-40bc-999c-70aa1e770a0c

Symantec Remsec IOCs · Kaspersky ProjectSauron Full Report · Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0607 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1530b5b9-a559-42ac-a668-8133cb18e944

Trend Micro KillDisk 2

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15cde143-4ede-475f-9b8c-813d6c23083a

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023 · PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024

ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15fd646c-172b-4458-945a-69a07a5648bb

McAfee Honeybee

ATTACK:enterprise:S1247 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--165b726a-1e4c-49ce-af28-92586883dcdf

Cyble Embargo Ransomware May 2024

ATTACK:enterprise:S0059 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1684e405-53bd-4951-a26d-e7c39887b06a

Baumgartner Naikon 2015

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16b915ff-7bf5-4032-b39a-9c8073847d77

ESET Gamaredon June 2020 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025 · Unit 42 Gamaredon February 2022

ATTACK:enterprise:S0647 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17a2eeb2-2221-4292-b584-d39d19a6409f

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:S0216 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17c43eed-f8a2-42cb-8f0a-f31978e9e351

FireEye APT37 Feb 2018

ATTACK:enterprise:S0339 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19f512b8-6869-460d-97d8-7e1f9b3c51cb

Radware Micropsia July 2018

ATTACK:enterprise:S0083 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a4c94a1-6362-42b3-b1d9-41ae3fbf5ea5

Cylance Dust Storm

ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a4f5197-ec9f-4607-984c-4a09978acd8e

Novetta Winnti April 2015

ATTACK:enterprise:S0049 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b3cc0cb-de43-405b-bfa5-f0bececabf8c

F-Secure The Dukes

ATTACK:enterprise:S0651 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c4fd1a5-c3a4-4f71-8310-785962dc65d4

Checkpoint IndigoZebra July 2021

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c9b32f8-f78d-4580-b183-676c7203286d

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:S9039 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ca295b2-6865-4daf-a41f-e9333f0561bc

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1daaea6e-527f-4c3d-9387-72ea68d7140d

Fidelis njRAT June 2013

ATTACK:enterprise:S9063 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f5fcc10-0902-4395-8dff-0353f7ae6189

Mandiant_UNC1549_Nov2025

ATTACK:enterprise:S0048 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fbde0c8-1b00-40bf-8fef-11892d103d63

F-Secure The Dukes

ATTACK:enterprise:S0466 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fe64d85-29ca-4cf0-9b30-8d41ebad37fc

objective-see windtail1 dec 2018 · objective-see windtail2 jan 2019

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--204086ef-c546-47fd-8844-b8af57085f26

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · CISA Medusa Group Medusa Ransomware March 2025 · Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21382ce2-a504-4adf-81d2-dc1306285553

CISA AA20-296A Berserk Bear December 2020 · Gigamon Berserk Bear October 2021 · US-CERT TA18-074A

ATTACK:enterprise:S0347 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--227abd66-91cc-436e-aad8-c1fb82691357

TrendMicro Lazarus Nov 2018

ATTACK:enterprise:S0659 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22a1c738-6d0f-4abd-b00c-ee0b37ba1db6

Fortinet Diavol July 2021

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23149a27-cccf-4fb4-bc35-fc4ebf4c6664

GitHub Sliver File System August 2021

ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24ea53e3-a51f-4c4a-b3de-2e1d09ed69e8

Volexity PowerDuke November 2016

ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2597e12c-c342-4ca0-a235-b05752b2bfa5

Unit 42 BackConfig May 2020

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25d926a0-d2b5-473d-b27b-fb69cf763b77

US-CERT Bankshot Dec 2017

ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--262fe71a-a2d5-4624-ac50-5a76c0dd862e

Unit 42 PingPull Jun 2022

ATTACK:enterprise:S0065 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26968975-5f01-4b4b-9cdc-ef3b76710304

CrowdStrike Putter Panda

ATTACK:enterprise:S0181 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27834043-1004-4a70-9023-a318bd6db7c6

US-CERT FALLCHILL Nov 2017

ATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27c7f9ed-dd66-4bc0-a186-2f05aac6d6df

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--291e908e-1d2e-4b29-a564-5a33149d1dbb

Kaspersky Turla · Kaspersky Turla Aug 2014

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--292fd2a5-45fa-4125-84ea-8b5f341dc579

Trend Micro DRBControl February 2020 · Talent-Jump Clambling February 2020

ATTACK:enterprise:S0472 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29be6a34-6a89-42e8-a6b1-dca821ed7f94

Trend Micro Tick November 2019

ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b196fe7-93e1-4575-8818-578305fc1fae

CrowdStrike Ryuk January 2019

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b4bd264-4c8b-4303-9c54-113284c9e9a0

ATT QakBot April 2021

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2bcaf336-cd02-47e3-b73f-6f0c5cc3592f

Talos PoetRAT April 2020

ATTACK:enterprise:S0689 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2bce15a3-cf65-48a5-8a07-1c85c9c33a1a

Cisco Ukraine Wipers January 2022 · Unit 42 WhisperGate January 2022 · Microsoft WhisperGate January 2022 · Medium S2W WhisperGate January 2022

ATTACK:enterprise:S0106 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c09a27c-2eea-4287-9908-964533234e71

ATTACK:enterprise:S0345 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d76d7b2-ec41-4630-8405-ec7db2c0607c

McAfee Oceansalt Oct 2018

ATTACK:enterprise:S9053 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f142216-22ad-4c34-b787-8bfeb2fcd57b

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f19f736-a547-47c3-ae26-40a0d13cdf41

CISA AA20-239A BeagleBoyz August 2020 · Microsoft Axios Compromise APR 2026 · Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3094a14f-ccd2-4ba4-a3f6-c6d2721f02db

Überwachung APT28 Forfiles June 2015 · DOJ GRU Indictment Jul 2018

ATTACK:enterprise:S0271 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30ab931e-9cc1-4e95-a3f5-364be094b54e

US-CERT KEYMARBLE Aug 2018

ATTACK:enterprise:S0063 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32ee78b3-58de-4de5-bc3d-34ea8dc90ca3

Palo Alto CVE-2015-3113 July 2015

ATTACK:enterprise:S0219 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33327a36-9f05-4a27-ac6a-d36e4cee0b21

FireEye APT37 Feb 2018

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--355c008f-e48a-45f1-8ab8-f04fff3b7915

Microsoft SharePoint Exploit JUL 2025

ATTACK:enterprise:S0348 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3572a770-9151-42d5-82b5-360002725052

PaloAlto CardinalRat Apr 2017

ATTACK:enterprise:S0072 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--358047bf-1dd3-4fc4-bc1a-b7004bd54b8d

ATTACK:enterprise:S0055 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35ec37ba-44aa-49b1-9379-3f6070554c62

ATTACK:enterprise:S9027 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37440d78-4ced-42c2-9a9c-fd71f10e6cd6

Trend Micro Earth Kasha Anel NOV 2024

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.