Skip to content

Local Account

Subtechnique · ATTACK:enterprise:T1087.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1087.001",
  "title": "Local Account",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1087/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--25659dd6-ea12-45c4-97e6-381e3e4b593e",
  "external_id": "T1087.001",
  "domain": "enterprise",
  "created": "2020-02-21T21:07:55.393Z",
  "modified": "2026-05-12T15:12:00.623Z",
  "version": "1.5",
  "aliases": [

  ],
  "tactics": [
    "discovery"
  ],
  "source_references": [
    {
      "source_name": "id man page",
      "url": "https://linux.die.net/man/1/id"
    },
    {
      "source_name": "groups man page",
      "url": "https://linux.die.net/man/1/groups"
    },
    {
      "source_name": "Mandiant APT1",
      "url": "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
    },
    {
      "source_name": "Crowdstrike Hypervisor Jackpotting Pt 2 2021",
      "url": "https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"
    },
    {
      "source_name": "Elastic - Koadiac Detection with EQL",
      "url": "https://www.elastic.co/security-labs/embracing-offensive-tooling-building-detections-against-koadic-using-eql"
    }
  ]
}

Explicit source assertions (68)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bbf5be7-e1de-419e-85ee-afaa431f60be

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d93e75b-e13d-4bd5-97d2-b4f8d05e9efd

DigiTrust Agent Tesla Jan 2017

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11fef36d-e857-4e0e-93e0-f0361df83ced

Symantec Orangeworm April 2018

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13363d50-e3cc-4e6c-906a-47df844b8694

UCF STIG Elevation Account Enumeration

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15cccbec-2d40-4f28-a46e-c985bbb20c87

Mandiant Operation Ke3chang November 2014

ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15f74597-d92d-406f-9941-c0dfef3cb609

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--179cb2c1-5069-479d-ab51-6e1adfd2d983

SophosGnGal_SystemBC_Dec2020

ATTACK:enterprise:G1009 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24892996-c220-4d25-92d8-7db597873090

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:S0196 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b2026c2-eb71-4c78-825d-5c4d0a747741

Morphisec ShellTea June 2019

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b55e889-243f-412b-b5cd-fa1d59f1a999

Symantec Daggerfly 2023

ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d1bee29-c394-48ca-8ded-21fd86e3ff43

FireEye MuddyWater Mar 2018

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2db406cf-667d-4ad6-b768-7645f6663ac9

Symantec W32.Duqu

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dedd50c-be3d-4523-8949-8669314bbc7e

Broadcom Medusa Ransomware Medusa Group March 2025

ATTACK:enterprise:S0049 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e69a835-6443-455e-8ff0-775bb8c823f1

F-Secure The Dukes

ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f2f5731-3c6c-4c08-a39a-2afa45f3bc9c

Trend Micro Agenda Ransomware AUG 2022

ATTACK:enterprise:S0165 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30c5a160-c42d-4bee-bcc6-b85f083136d7

Symantec Buckeye

ATTACK:enterprise:S0063 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33630ee4-24dc-4339-b29f-3d8b39e7daae

Palo Alto CVE-2015-3113 July 2015

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39ce32d3-7721-4008-b74d-3549b7bb8fa7

Palo Alto OilRig May 2016

ATTACK:enterprise:S0378 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--426daf58-7fab-49c8-b5cb-722f3e46a75a

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47959896-6190-43f5-b449-55c67883b389

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:S0244 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47a10b36-7f39-480c-8708-410eb3af46ca

Palo Alto Comnie

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49f2ec3b-a9bf-48c3-b3f0-a80a0d70a2ac

Rostovcev APT41 2021

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fefb2ee-376a-43bf-abd7-9e856653e874

Cisco LotusBlossom 2025

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57bf3d4d-788c-43f9-b35b-a76b68a0b02d

Google Cloud APT41 2024

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b2c1413-9760-4867-8fe4-3b7c55f1e780

Proofpoint RedLine Stealer March 2020 · Splunk RedLine Stealer June 2023

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d45479d-7cc2-49cc-8f10-5ead0a1db033

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--613013e5-922b-40c1-96bd-11bab2bd5447

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:S0521 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63895b27-aeba-4001-8039-b7b1bc41f8fc

CrowdStrike BloodHound April 2018

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--648a19d0-2728-4be8-ac62-4bf08a4265a6

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b2974dc-91ee-4c37-9d2c-a7312a6bc3f6

Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

ATTACK:enterprise:S1145 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d719666-23d9-44a7-afb1-2afb5263cf09

Elastic Pikabot 2024

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71819612-01e7-48cf-89ea-09da4f05c2e8

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76d7d7fa-94a4-4fa6-9fd2-e9af9ab0f356

S2 Grupo TrickBot June 2017 · Trend Micro Trickbot Nov 2018

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--776fa02f-a4f2-43e1-b2f6-d84c4a749045

Mandiant APT42-charms

ATTACK:enterprise:S0241 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d181964-875f-4132-8882-46e9dd18e893

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80b0aa57-f6cc-411c-8c54-65fad30f8143

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85327654-1ce1-43f6-bc8b-eb6c1c83d483

NCC Group Chimera January 2021

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a47e81d-be1f-488c-8136-40e18c70d45f

ESET ComRAT May 2020 · ESET Crutch December 2020

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a4b2f39-183a-40e9-a8af-f3727061c17d

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8e876e40-06b7-4830-a281-85c070b6f854

Kaspersky Turla Aug 2014

ATTACK:enterprise:S0516 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--962d745e-7771-4c8b-a887-04d3a521943c

CISA SoreFang July 2016

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a615c7f-986d-4769-bea6-af9ffe0d575e

Symantec Buckeye

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e587add-08b7-4ecb-a40a-664b9cff1d0f

Kaspersky ProjectSauron Technical Analysis

ATTACK:enterprise:S0084 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a33c172b-9910-4f36-8373-32126201144b

Cylance Dust Storm

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a35c951b-5987-4028-b002-a2078ad9c0a7

McAfee Bankshot

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab3fe31a-051e-4db5-bcf0-20a93b4bae9b

ESET InvisiMole June 2018

ATTACK:enterprise:S1015 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0d9045a-448e-40f6-848a-7d852b1f197b

ClearSky Siamesekitten August 2021

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2dbbb46-9659-4277-8753-c469c4bfe409

SecureWorks BRONZE UNION June 2017

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b65d643e-ff0b-4cf1-8c3f-7d31f39f2efb

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b70e19d8-9602-4795-9d9b-ef18cdbe5d51

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G0033 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b93cfd4f-113c-4769-81c9-e710ed0b5f4e

Kaspersky Poseidon Group

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bce07a45-9955-4466-86ad-35fef741087d

Github PowerShell Empire

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdb0d192-3d82-4e5b-92bc-7ef24fd3e65b

ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4962ae6-91e2-407d-9f42-aa0381574476

FireEye admin@338

ATTACK:enterprise:S0537 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c5fef08a-e2ca-4bd1-880e-80fd90dc3d6a

Accenture HyperStack October 2020

ATTACK:enterprise:S0081 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c987dc63-ef3d-43aa-9344-bd9fd528c55d

Lotus Blossom Jun 2015

ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc81f8f0-111c-4932-bc75-7704eaf17f73

NCC Group Team9 June 2020

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d014d8e1-b12e-4b85-84ee-ff4338c54393

ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0460046-cd33-46b4-948e-1f46139eec6e

Sekoia Raccoon2 2022

ATTACK:enterprise:S0570 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d17ee0b3-4f2b-4d6f-ae10-7934d4e9126d

Crowdstrike Indrik November 2018

ATTACK:enterprise:S0453 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d5ecfa68-2027-4dd5-adf0-1eb82463cfc5

Malwarebytes Pony April 2016

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d670ddce-d32a-4165-a56e-5bb183f4c904

Cybereason Valak May 2020

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da11f44a-5af0-4b71-a049-a9ff85e2ba9b

Unit 42 Kazuar May 2017

ATTACK:enterprise:T1087.001 → subtechnique-of → ATTACK:enterprise:T1087

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6867d44-3d34-4604-b5e8-35e325051f1e

ATTACK:enterprise:S0649 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e91c647e-7076-4290-b7c4-017822fdfd59

FireEye SMOKEDHAM June 2021

ATTACK:enterprise:S0233 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef699184-4191-4fc0-8525-6fa1dcfc61d7

FireEye Periscope March 2018

ATTACK:enterprise:S0598 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f78eb569-6e16-4103-bc17-265f2d1b1bb2

ANSSI Sandworm January 2021

ATTACK:enterprise:S0085 → uses → ATTACK:enterprise:T1087.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb0aef48-57f5-4331-acdd-25fdfdf1babb

Cylance Dust Storm

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.