Skip to content

Non-Application Layer Protocol

Technique · ATTACK:enterprise:T1095

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1095",
  "title": "Non-Application Layer Protocol",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1095",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b",
  "external_id": "T1095",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:10.728Z",
  "modified": "2026-09-03T19:46:48.129Z",
  "version": "2.4",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"
    },
    {
      "source_name": "University of Birmingham C2",
      "url": "https://arxiv.org/pdf/1408.1136"
    },
    {
      "source_name": "Cisco Synful Knock Evolution",
      "url": "https://blogs.cisco.com/security/evolution-of-attacks-on-cisco-ios-devices"
    },
    {
      "source_name": "Microsoft ICMP",
      "url": "http://support.microsoft.com/KB/170292"
    },
    {
      "source_name": "Cisco Blog Legacy Device Attacks",
      "url": "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"
    },
    {
      "source_name": "Wikipedia OSI",
      "url": "http://en.wikipedia.org/wiki/List_of_network_protocols_%28OSI_model%29"
    }
  ]
}

Explicit source assertions (113)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1144 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0267872d-3408-409e-8ad8-d39b85ce6a99

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04610729-6f83-48d4-9f5b-1c1c4a39df3a

Unit42 OceanLotus 2017

ATTACK:enterprise:S0504 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--077ab82e-3847-4dab-80e2-5dc0ea7d8e9e

Cyberreason Anchor December 2019

ATTACK:enterprise:S0076 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--090813dc-b370-42e1-a211-4d9e3247968a

Scarlet Mimic Jan 2016

ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0997f41a-0232-4331-8a11-11a6433d8343

CheckPoint Naikon May 2020

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b932e1a-e0a1-4123-bcfe-6957b9ef2409

Trend Micro DRBControl February 2020

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15025556-2b38-40de-98a0-e231a16a7949

SymantecCarbonBlack_ShuckwormUSB_Apr2025

ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--151da49e-c3ee-4615-b62e-c8a3c93a32a6

ESET DazzleSpy Jan 2022

ATTACK:enterprise:S0155 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1984ba26-2309-49db-8c42-75951d0ef678

FireEye APT32 May 2017

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1aee2c50-660a-42ee-816d-5823ade525f3

ESET Gelsemium June 2021

ATTACK:enterprise:S1204 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b814125-87a8-4860-bf42-b43787216312

Lumen J-Magic JAN 2025 · Hartrell cd00r 2002

ATTACK:enterprise:S0436 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--20c30f4a-ff6f-4861-a88a-77d437374994

JPCert BlackTech Malware September 2019

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2302de7d-8c9a-4a92-93d3-e4b00c40b22d

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S1203 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24a917f3-08c0-4ba1-955d-7e9c65dc26f7

Lumen J-Magic JAN 2025

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b218139-1e96-4e15-9ac3-8d83b4aff072

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2eaea386-ee0f-42c4-bca1-ce2d22062f98

Eset PlugX Korplug Mustang Panda March 2022 · Dell TG-3390

ATTACK:enterprise:S1029 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fe54d3f-0ac2-4579-8e78-81dc11b6386e

MalwareBytes SideCopy Dec 2021

ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--300b191d-6832-48ae-ad82-040f066cac08

NCSC-NL COATHANGER Feb 2024

ATTACK:enterprise:S1121 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32ca8347-dcb9-47c6-a3c3-23e15d03fe68

Mandiant Cutting Edge Part 3 February 2024

ATTACK:enterprise:S1189 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--337835d7-bd03-48ae-bb34-9cf85ffbd4e4

GitHub Neo-reGeorg 2019

ATTACK:enterprise:S0055 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--345c6135-7557-4292-8214-66618ba17edd

Aquino RARSTONE

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3717f0c2-0963-4b6c-9603-bb01c06b9fe6

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:S0502 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37b9ae2f-a386-41aa-90be-497de2d580f5

NSA/FBI Drovorub August 2020

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3957be97-305f-4d42-9978-868cb83918a2

ESET InvisiMole June 2020

ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c6ad797-8dba-4dee-8930-d35e26a782da

Recorded Future RedDelta 2025

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f424011-cde1-4ed5-b067-3cb4d6193d72

SentinelLabs Metador Sept 2022

ATTACK:enterprise:S0430 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40622bce-ea51-4744-9240-4a4c4bf83753

Chronicle Winnti for Linux May 2019

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--418bde38-35eb-44bc-a454-ad7d2918bda5

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--432e82e0-54e5-487b-a538-6fc49d7cfc5c

SekoiaBourhis_DiceLoader_Feb2024

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43edcf0f-1f37-48b6-aa89-aa845611e0f3

Cadet Blizzard emerges as novel threat actor · CISA GRU29155 2024

ATTACK:enterprise:S1114 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44494749-870a-4ca5-beee-85d88f78a693

Mandiant Cutting Edge Part 2 January 2024

ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45754d15-9deb-467f-801d-84c0a8a00238

ESET HiddenFace 2024 · JPCERT MirrorFace JUL 2024 · Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45ef2a23-61b6-4f78-9d86-58a2d50a4ee0

SentinelLabs Metador Sept 2022 · SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:S0630 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b387706-db60-46d2-bba4-148571381e60

Bitdefender Naikon April 2021

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4bd30351-b64b-47cb-897b-951b76ca668b

FireEye Metamorfo Apr 2018

ATTACK:enterprise:S0125 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ee54acd-fc04-43c2-8cf6-2200a802d0b9

Symantec Remsec IOCs · Kaspersky ProjectSauron Full Report

ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fb5c14c-5a08-4116-bbb7-d6822649dfa0

Novetta Winnti April 2015

ATTACK:enterprise:S0149 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51c5e624-d08e-4750-91f9-fdc98ec56552

Palo Alto MoonWind March 2017

ATTACK:enterprise:S0394 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55b8f35b-7ccc-4da7-9ab1-40fe148cd182

Intezer HiddenWasp Map 2019

ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--568964d5-6205-4d46-9d14-2914ba349afd

Mandiant Cutting Edge Part 3 February 2024

ATTACK:enterprise:C0034 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bd757cd-ec5b-46f9-8ddf-05673370e494

Mandiant-Sandworm-Ukraine-2022

ATTACK:enterprise:S0515 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5be3684a-cb63-4328-bba0-22f14298b920

CISA WellMail July 2020

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e168a94-8882-4e6d-bc61-e86588b52242

Mythc Documentation

ATTACK:enterprise:S0083 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e53b45b-ca14-4e8b-8c76-0cf9cb572a92

Cylance Dust Storm

ATTACK:enterprise:S1084 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--647cf3e6-dcb2-4da2-a60d-b3118cb966bc

Mandiant APT29 Eye Spy Email Nov 22

ATTACK:enterprise:S0556 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66200ea6-03b8-4c4f-a1d4-9041ddc70d8a

Check Point Pay2Key November 2020

ATTACK:enterprise:S0172 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67f82f6c-18f1-4f1e-8352-b7ecf8839ea2

Palo Alto Reaver Nov 2017

ATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b9778e3-14f7-4609-8621-d24e2a40c032

BlackBerry CostaRicto November 2020 · FireEye FiveHands April 2021

ATTACK:enterprise:S1099 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c0f270a-cf44-4d71-a398-1d822f1d48ac

Kaspersky ToddyCat June 2022

ATTACK:enterprise:C0021 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6daa0c15-e73b-4b0f-8069-8f89638bf6fd

FireEye APT29 Nov 2018

ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fabc88f-9582-4658-807c-7ec583edbd5e

Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:S0501 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b510a6f-3e11-49b3-bf97-a1ca24bca663

ESET PipeMon May 2020

ATTACK:enterprise:S0234 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7bf27f61-0191-4c20-ae96-96c38322470d

CheckPoint Bandook Nov 2020

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e9168ae-f0dd-4223-bc4b-9f94b08f99ac

CISA AR18-352A Quasar RAT December 2018

ATTACK:enterprise:C0035 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--86576242-a9d1-4fd8-82a2-0e7d09d57513

Lumen KVBotnet 2023

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88640feb-d423-4861-ac34-cb7a8fe4bfac

Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ad2d1c5-aa94-4c32-94c8-8ffb9d11f54a

Google Cloud Threat Intelligence ESXi Hardening 2023

ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f8adede-8b7a-460d-b852-b52328df178a

Gh0stRAT ATT March 2019

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9acd9add-9b08-45dd-8135-98e62eb708e2

Broadcom VMCI Firewall

ATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a726ffe8-d192-4f40-be21-ba2ffe32c670

Kaspersky ShadowPad Aug 2017

ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7cdf456-9ad0-402b-a914-5f1ebcd873a3

Proofpoint TA505 October 2019

ATTACK:enterprise:S1031 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a877e5c0-3fe6-40bb-bd02-ef4a9465aba3

Unit 42 PingPull Jun 2022

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aaea7acb-2ae2-4527-ac83-6a56eb7cc6b3

2022 November_TrendMicro_Earth Preta_Toneshell_Pubload

ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae3c0dc8-de95-40bc-bced-a3c61d7ad605

ESET Carbon Mar 2017

ATTACK:enterprise:S0629 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b23da7b5-0d2d-4cfa-a2ad-ea89d86fecc6

Bitdefender Naikon April 2021

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2a42d95-fc64-4e6f-95d9-7b24334bccd4

ATTACK:enterprise:S0034 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b41abaa3-a21f-4d2c-9c60-c90c4f360b00

ATTACK:enterprise:S0582 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b46d0c20-61f1-4ab4-be3b-fa7dace805f0

Proofpoint LookBack Malware Aug 2019

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b499e6f7-77bc-422b-b7ef-058d223a69e6

Talos Bisonal Mar 2020

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4cec817-37bb-4b1f-b165-26241efdcea0

Kaspersky QakBot September 2021

ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b720dc1e-50b1-44f6-8c3e-2c6f78ef3497

Kandji Cuckoo April 2024

ATTACK:enterprise:S1078 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7f887ee-e0e5-4cab-9898-6dfed9b86f31

netlab360 rotajakiro vs oceanlotus

ATTACK:enterprise:S1219 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b80f4569-d64a-48d4-9ff1-a4e4768e000c

Google Cloud Mandiant UNC3886 2024 · Mandiant Fortinet Zero Day

ATTACK:enterprise:S1142 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b832110a-0610-4489-9729-a89064b8d61b

ESET Turla Lunar toolset May 2024

ATTACK:enterprise:S0043 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b9b0e376-f249-432f-a0d3-dfa259b4757a

FireEye admin@338

ATTACK:enterprise:S1163 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baec7508-d69a-4e06-8bf7-6d85d95830c7

PWC Sea Turtle 2023

ATTACK:enterprise:S1221 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4adb795-a847-47e0-a629-2c430d43974d

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S0221 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4aec6a5-2c11-45a2-8c79-8cccf85179cb

Umbreon Trend Micro

ATTACK:enterprise:S0021 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c52eb151-c8c5-45f1-984b-d99a12ca05cf

ATTACK:enterprise:G1013 → uses → ATTACK:enterprise:T1095

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c65d4006-003c-4aff-a8c7-bd5834678b58

SentinelLabs Metador Sept 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.