aol.pm

Screen Capture

Technique · ATTACK:enterprise:T1113

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1113",
  "title": "Screen Capture",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1113",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--0259baeb-9f63-4c69-bf10-eb038c390688",
  "external_id": "T1113",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:25.060Z",
  "modified": "2026-05-12T15:12:00.619Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "CopyFromScreen .NET",
      "url": "https://docs.microsoft.com/en-us/dotnet/api/system.drawing.graphics.copyfromscreen?view=netframework-4.8"
    },
    {
      "source_name": "Antiquated Mac Malware",
      "url": "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/"
    }
  ]
}

Explicit source assertions (172)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00cd22e3-0291-45e8-9d05-e3243f5d9eee

Palo Alto Ashen Lepus DEC 2025

ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0471088d-7b45-4fec-8946-ae5bf463286b

Palo Alto Gamaredon Feb 2017 · Unit 42 Gamaredon February 2022

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05119f3a-ad4c-41a8-b4af-10813f657437

FBI IC3 Flash VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:S0417 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06b747a6-a3d2-441e-9a24-b79491be3647

SecureList Griffon May 2019

ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--073215cd-bc1e-48e8-8f3a-7d24f18b32c6

Talos Seduploader Oct 2017 · Unit 42 Playbook Dec 2017

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08109d9e-3258-4b9b-8e1d-ea90d05c18b9

Talos Agent Tesla Oct 2018 · DigiTrust Agent Tesla Jan 2017 · Fortinet Agent Tesla April 2018 · Fortinet Agent Tesla June 2017 · Bitdefender Agent Tesla April 2020

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08b30f76-ca12-4d2c-9345-ee51bfd54e9f

US-CERT TA18-074A · Symantec Dragonfly Sept 2017 · Gigamon Berserk Bear October 2021

ATTACK:enterprise:S0192 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09869965-8dcd-4c20-a997-c075b6ed0434

GitHub Pupy

ATTACK:enterprise:S0199 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09c63f56-1c5b-4195-9d1a-73b77865ffb8

FireEye APT33 Sept 2017

ATTACK:enterprise:S0094 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bd9fd2b-e2f7-48f1-8988-31c041691585

Symantec Dragonfly · Secureworks Karagany July 2019

ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c1f6d5f-3094-4834-94a9-5a615e7c319c

Microsoft FinFisher March 2018 · FinFisher Citation

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0eda9c73-fcf0-4796-8000-8dfea88887f4

Netskope XLoader 2022 · Google XLoader 2017

ATTACK:enterprise:S0338 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f64f141-1f0f-4374-879d-b08f0fda8979

Zscaler Cobian Aug 2017

ATTACK:enterprise:S0128 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11010986-1b4d-4158-b47d-bbff34306c98

Forcepoint Monsoon · PaloAlto Patchwork Mar 2018

ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--145d2112-b679-4d72-b484-7524f944e128

Antiy CERT Ramsay April 2020

ATTACK:enterprise:S0089 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--147d2e66-25de-42ea-8592-eb51333f595c

Securelist BlackEnergy Nov 2014

ATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1557ceea-6626-41ab-935f-ae0f96723184

S2W Troll Stealer 2024 · Symantec Troll Stealer 2024

ATTACK:enterprise:S0030 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16d5d573-60bb-402c-88c3-2bc0af8388eb

FireEye CARBANAK June 2017

ATTACK:enterprise:S1239 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--177772b9-329e-4c43-95ed-f9ce99ae250c

Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023

ATTACK:enterprise:S0644 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18ed716d-2865-4a7a-98f8-915f07c183dc

Talos Oblique RAT March 2021

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1957974e-1995-4d35-a32b-e355ae219ff8

Trend Micro DRBControl February 2020

ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e86ff72-2edc-4924-9f05-7e559b54ac82

Cybereason LumaStealer Undated

ATTACK:enterprise:S1050 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f7e10b8-f8ea-4731-af67-7201452d32be

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21c130df-4123-4f57-9ea2-9ceac05af597

Github PowerShell Empire

ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2723c701-96d8-44e9-96ce-34c57e50a68e

ESET Security Mispadu Facebook Ads 2019 · Metabase Q Mispadu Trojan 2023 · SCILabs Malteiro 2021 · SCILabs URSA/Mispadu Evolution 2023

ATTACK:enterprise:S0235 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28d4a66d-2b1f-4662-9e8e-4ba8ff4bcaf0

Lookout Dark Caracal Jan 2018

ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--290c4e3b-00be-411f-b0c8-919e85e08a49

ESET Operation Groundbait

ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d840d1b-28d7-4387-86fd-6d3df8650171

Secureworks BRONZE BUTLER Oct 2017 · Trend Micro Tick November 2019

ATTACK:enterprise:S0017 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d920718-61fc-4e10-ad09-df0a00d69cd4

Mandiant APT1 Appendix

ATTACK:enterprise:S1016 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fb2a011-a35a-403a-a86b-d5489b1fa5c6

ESET DazzleSpy Jan 2022 · Objective-See MacMa Nov 2021

ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33fb5b08-700d-4c29-a971-c7493b904d1a

BitDefender BADHATCH Mar 2021

ATTACK:enterprise:S1185 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--357dc150-9787-4b39-b18a-a0a38778a44f

Huntress LightSpy macOS 2024

ATTACK:enterprise:S0385 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36cdeef3-a216-44cd-ad79-dd8085e86fc3

Kaspersky BlindEagle AUG 2024 · Trend Micro njRAT 2018

ATTACK:enterprise:S0647 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3982f2f1-8fdd-4ccd-84e6-6a13c919c4c9

ESET BackdoorDiplomacy Jun 2021

ATTACK:enterprise:S1229 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a0a1c4d-2b99-4c72-9aa1-d002c403ee63

Immersive Labs Havoc C2 APR 2024 · Zscaler Havoc FEB 2023 · Havoc Framework Documentation

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a9117f6-9244-4d09-a69b-43afbb4d2998

ESET Gamaredon June 2020 · ESET Gamaredon Sept2024 · SymantecCarbonBlack_ShuckwormUSB_Apr2025

ATTACK:enterprise:S0351 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d1fe308-5bef-4e7a-9daa-333680a11d7b

Unit42 Cannon Nov 2018

ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e2d4ce8-0006-4571-b8ea-dbfc4bf7302f

Unit42 Cannon Nov 2018 · ESET Zebrocy Nov 2018 · Unit42 Sofacy Dec 2018 · ESET Zebrocy May 2019 · Accenture SNAKEMACKEREL Nov 2018 · CISA Zebrocy Oct 2020

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3edc3698-c8a9-4212-b34e-1f3a44fbd00d

Kaspersky TajMahal April 2019

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4183341a-f5ed-4914-9dc5-0eb7c1d6c4e6

cobaltstrike manual · Amnesty Intl. Ocean Lotus February 2021 · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:S0546 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45060bf9-f01b-48a2-8a03-082ad7e7945f

Cybereason Molerats Dec 2020 · BleepingComputer Molerats Dec 2020

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45a1721f-67a3-479a-befe-d136ed0fdad3

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45cd89d8-68fd-42a2-94ba-7796a696bc47

FireEye APT34 Webinar Dec 2017

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48f662fe-1ba2-4c19-b782-dd06d9fb67fa

ESET Sednit Part 2 · DOJ GRU Indictment Jul 2018 · XAgentOSX 2017 · Secureworks IRON TWILIGHT Active Measures March 2017

ATTACK:enterprise:S0153 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48fb8267-5d68-467b-a2c0-8302cc15ebed

Accenture Hogfish April 2018 · FireEye APT10 April 2017

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--494a0c44-2822-4f53-977e-f36a949d8258

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49d50fde-cfbc-4007-befc-f4b22b9bc9f5

Unit42 RDAT July 2020

ATTACK:enterprise:S0330 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ab6eb52-821c-45da-b7d9-63840fe657cf

GDATA Zeus Panda June 2017

ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b3274fe-1960-4d1e-91d1-2091e467c45b

FireEye APT41 Aug 2019

ATTACK:enterprise:G1019 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4deeafce-daf7-4dc8-a949-80eaf086ca0e

MoustachedBouncer ESET August 2023

ATTACK:enterprise:S0216 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e2f4bbd-ea3b-4996-bc2a-3d670d9f5cf5

FireEye APT37 Feb 2018

ATTACK:enterprise:S0662 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4ea07638-aca6-400b-9979-26b9002e990c

Profero APT27 December 2020

ATTACK:enterprise:S0275 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f2fb45a-8359-4c75-93ae-095fcf9f856e

ESET MirrorFace 2025 · Trend Micro Earth Kasha Anel NOV 2024 · Trend Micro Earth Kasha Updates APR 2025 · FireEye APT10 Sept 2018

ATTACK:enterprise:S1063 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f8e76b5-603e-4557-8635-465d988a4072

Palo Alto Brute Ratel July 2022

ATTACK:enterprise:G0115 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--513f6b4c-c9b1-4339-910e-376b2a908689

Tetra Defense Sodinokibi March 2020

ATTACK:enterprise:S0680 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--516fd2f8-a709-43f4-86e1-c753e28113e1

Kaspersky WIRTE November 2021

ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5249b0e7-878e-44db-9d59-f162067f1852

Unit 42 BadPatch Oct 2017

ATTACK:enterprise:S0456 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--535b87bb-31fd-4e14-8279-c64c301e912d

CheckPoint Naikon May 2020

ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--536cdc1b-65c7-4236-8e2a-b0093495c9d9

McAfee RedLine Stealer April 2024 · Splunk RedLine Stealer June 2023

ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57733df2-7d2d-470a-afbb-8f48b7c53821

Kandji Cuckoo April 2024

ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5797b454-e7cc-45a3-9bf1-7708d7286531

Cybereason Valak May 2020

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58d20f74-b41a-45c3-b6de-41a3d6cf86e0

Mandiant APT42-charms

ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b6293d5-f49c-4dbe-bef3-73bb346c3fe4

Google Cloud APT41 2024

ATTACK:enterprise:S0090 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6184b127-47cf-43fc-880b-890554d9cc9a

Palo Alto Rover

ATTACK:enterprise:S0681 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--638b21af-b5d5-44dd-9d14-ea3c2be3eb4e

BiZone Lizar May 2021 · Threatpost Lizar May 2021

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65f7704a-358a-464d-b09b-fee5dd96adf3

Unit 42 Magic Hound Feb 2017

ATTACK:enterprise:S1209 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67731257-6a0a-46cf-8f7e-cc6793d5fdb9

Microsoft Quick Assist 2024

ATTACK:enterprise:S0643 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c10bd99-6932-451d-b739-13adf1276a22

Proofpoint Operation Transparent Tribe March 2016

ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6db82410-1fcf-483a-be5b-cf09c361b4eb

Trend Micro Daserf Nov 2017 · Secureworks BRONZE BUTLER Oct 2017

ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6dbdaa06-8c0c-4b74-8274-1adbd80d0940

ESET MirrorFace DEC 2022 · Kaspersky LODEINFO Part II OCT 2022 · ITOCHU LODEINFO JAN 2024

ATTACK:enterprise:S0004 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f01abdc-bd94-4645-afed-8d3bd365bba4

Cylance Cleaver

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f6b8a04-916e-4f33-8837-ff48e00e771b

Securelist MuddyWater Oct 2018

ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--717d87d5-df97-48a9-8766-c9a947541e1d

Kaspersky Transparent Tribe August 2020 · Proofpoint Operation Transparent Tribe March 2016 · Cisco Talos Transparent Tribe Education Campaign July 2022

ATTACK:enterprise:G1035 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71cd5162-6352-4e19-9a02-2d8510333f6a

CERT-UA WinterVivern 2023

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7201204c-d21f-4560-a3d1-c75fabacb4c4

DOJ GRU Indictment Jul 2018

ATTACK:enterprise:S0086 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7296e1e2-514d-4a6c-a1fe-18558a5e3b0f

Cylance Dust Storm

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7331b11d-1d5e-4275-ba7e-a83ec4a59259

F-Secure Cosmicduke

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75a82c43-c3f2-4cec-a9cb-3407b03f27b7

ESET Attor Oct 2019

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--778765e1-7eb6-46b1-a370-6dfe09081ee3

SecureList Silence Nov 2017 · Group IB Silence Sept 2018

ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--77c31f47-883a-4381-a70e-96bd5f1371d3

SentinelLabs Metador Sept 2022 · SentinelLabs Metador Technical Appendix Sept 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.