System Time Discovery
Technique · ATTACK:enterprise:T1124
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1124",
"title": "System Time Discovery",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1124",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--f3c544dc-673c-4ef3-accb-53229f1ae077",
"external_id": "T1124",
"domain": "enterprise",
"created": "2017-05-31T21:31:37.450Z",
"modified": "2026-09-11T19:39:36.116Z",
"version": "1.5",
"aliases": [
],
"tactics": [
"discovery"
],
"source_references": [
{
"source_name": "systemsetup mac time",
"url": "https://support.apple.com/en-gb/guide/remote-desktop/apd95406b8d/mac"
},
{
"source_name": "linux system time",
"url": "https://wiki.archlinux.org/title/System_time"
},
{
"source_name": "MAGNET GOBLIN",
"url": "https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/"
},
{
"source_name": "show_clock_detail_cisco_cmd",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s2.html#wp1896741674"
},
{
"source_name": "Mac Time Sync",
"url": "https://www.macinstruct.com/tutorials/synchronize-your-macs-clock-with-a-time-server/"
},
{
"source_name": "ESET DazzleSpy Jan 2022",
"url": "https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"
},
{
"source_name": "AnyRun TimeBomb",
"url": "https://any.run/cybersecurity-blog/time-bombs-malware-with-delayed-execution/"
},
{
"source_name": "Technet Windows Time Service",
"url": "https://technet.microsoft.com/windows-server-docs/identity/ad-ds/get-started/windows-time-service/windows-time-service-tools-and-settings"
},
{
"source_name": "MSDN System Time",
"url": "https://msdn.microsoft.com/ms724961.aspx"
},
{
"source_name": "RSA EU12 They're Inside",
"url": "https://www.rsaconference.com/writable/presentations/file_upload/ht-209_rivner_schwartz.pdf"
},
{
"source_name": "System Information Discovery Technique",
"url": "https://www.picussecurity.com/resource/the-system-information-discovery-technique-explained-mitre-attack-t1082"
},
{
"source_name": "Virtualization/Sandbox Evasion",
"url": "https://www.picussecurity.com/resource/virtualization/sandbox-evasion-how-attackers-avoid-malware-analysis"
}
]
}Explicit source assertions (104)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0024d82d-97ea-4dc5-81a1-8738862e1f3b
Palo Alto Shamoon Nov 2016 · Unit 42 Shamoon3 2018ATTACK:enterprise:S1178 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01091a22-80ad-490b-bcc6-5bb5c8b1c9c5
Splunk ShrinkLocker 2024ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--04d60222-e8da-4de5-bc58-dcfae65986f5
Cofense Astaroth Sept 2018ATTACK:enterprise:S0251 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07eea18c-048c-4187-a6f1-ca97e9bfc846
ESET Zebrocy Nov 2018 · CISA Zebrocy Oct 2020ATTACK:enterprise:S0596 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--088c3553-db7f-4e97-9f32-75e483d59cba
Kaspersky ShadowPad Aug 2017ATTACK:enterprise:S0011 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--08d7395b-b3e6-4ae2-be46-31347d1d5eaa
CISA MAR-10292089-1.v2 TAIDOOR August 2021ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c3f8b3b-a6a3-472c-b792-6f5c7ccfbb24
Cyphort EvilBunny Dec 2014ATTACK:enterprise:S0098 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d2a66c5-fb8e-4cbb-9526-579b5c9c881c
Palo Alto T9000 Feb 2016ATTACK:enterprise:S1051 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f38f2dd-e2cf-4571-bb6c-065e50412bac
Mandiant APT41ATTACK:enterprise:G0121 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--10cf6efc-6415-4a80-834a-565057e76474
ATT Sidewinder January 2021ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12455fe5-42dd-420e-839e-8a96886488f7
TechNet Net TimeATTACK:enterprise:S0615 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14e836d1-af9e-423e-8a8d-ad2ab169667f
BlackBerry CostaRicto November 2020 · CISA AR21-126A FIVEHANDS May 2021ATTACK:enterprise:S0091 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16f64842-8ba8-4827-a47f-e7d665f942ae
Kaspersky TurlaATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17efbe51-6bd0-458f-98f3-f841b105d7bf
TrumanKroll_SYSTEMBCServer_Jan2024ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18787e29-05a1-49c5-9b8b-0376ba020bd7
ESET MirrorFace 2025ATTACK:enterprise:S0678 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a192f9a-d515-4d5c-9c52-e904bac96f61
McAfee Lazarus Nov 2020ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b6ef810-3d1b-400e-88ea-171618266f54
Socket GlassWorm January 2026ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23c72a20-1982-4207-9905-d3aa45f94c23
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:S0275 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--242236fe-a0b6-4cf0-b604-beb57ce9925a
FireEye APT10 Sept 2018ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--290c5e81-69e8-4ca1-983e-b24e675e7f89
Aikido CanisterWorm MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:S0588 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ff84270-830f-4de8-b93c-4ee3a9a46781
MSTIC NOBELIUM Mar 2021 · FireEye SUNSHUTTLE Mar 2021ATTACK:enterprise:S0608 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3074f3bd-5a30-4ad2-9a2c-45b1573a454e
SANS Conficker · Trend Micro ConfickerATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30ee835f-64a1-4e14-8c9c-648e24fc9b0b
FoxIT Wocao December 2019ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33e3573b-0f18-417c-be17-727863fc21ec
Talos GravityRATATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38248217-7c11-4ae9-a13e-7296dead0df8
DigiTrust Agent Tesla Jan 2017ATTACK:enterprise:S1043 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3881653b-bd16-4eba-ab35-81da1872c5c8
Bitdefender FunnyDream Campaign November 2020ATTACK:enterprise:S1081 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--39f8de6f-9df3-4e6b-9076-bd3464a2d5d2
BitDefender BADHATCH Mar 2021ATTACK:enterprise:S0417 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ce0fee3-3ad5-49b9-8213-871484674d93
SecureList Griffon May 2019ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e0fc6a8-83df-41da-ac13-0e37e4cfe89f
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--401790f5-abf5-4523-ac98-b200d3b34a7e
Kaspersky QakBot September 2021ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40a2c8e2-df1c-41a8-beec-951214c8e101
GovCERT Carbon May 2016ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4113afe0-e84a-44ba-9180-3033de06d72e
Zscaler Higaisa 2020ATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4467fb1b-60fe-4e13-a32a-8c1f60a66782
JoeSecurity Egregor 2020ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--44de6f93-f752-41cd-9372-0e0280c51ee9
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a5b8515-18ee-45bb-a1e7-48ede93bf56a
Kaspersky Transparent Tribe August 2020ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a990ccb-7004-43b8-9328-37668e1a3b6d
Medium Metamorfo Apr 2020ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c3890f0-378d-4cef-8db7-0258161ff3f7
ESET RTM Feb 2017ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d9b9464-1ade-45e9-9d7b-1c4c967abd81
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--509a61b8-292e-4292-b4e8-c1c9901582ec
ESET Grandoreiro April 2020ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5113edc5-a4ee-4888-89b1-0c3353ea05da
Prevailion DarkWatchman 2021ATTACK:enterprise:S0694 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52516649-550a-4930-8ed1-27391aad0379
ClearSky Lazarus Aug 2020ATTACK:enterprise:S0380 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54399f5a-a8ee-4f77-a363-23dd0033af12
Kaspersky StoneDrill 2017ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--544e4a14-6aae-4950-8fed-d1246a98ed06
FireEye SUNBURST Backdoor December 2020 · Microsoft Analyzing Solorigate Dec 2020ATTACK:enterprise:S0471 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56465210-d279-4982-a9fa-94a69f5b0b80
Trend Micro Tick November 2019ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--576c98f3-5753-4242-a5e3-7c0f769c27a1
Zscaler APT31 Covid-19 October 2020ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5779f61c-d06b-424d-92b9-3690e5d42a42
Sekoia Raccoon2 2022 · S2W Racoon 2022ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c160f0c-1c12-4ab0-bd6e-a30f8d5bc168
Kaspersky TajMahal April 2019ATTACK:enterprise:S1033 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c6dfc28-fa7c-4941-a144-890a428f9951
Checkpoint MosesStaff Nov 2021ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6308284a-ac28-4943-b15f-368da34c01aa
Hunt.io TeamPCP Toolkit MAY 2026 · Phoenix TeamPCP 20 MAY 2026ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6316bedb-6962-4da1-8714-08b414fa7c73
GitHub SILENTTRINITY Modules July 2019ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b38f460-e309-4ab1-bbc9-bd0bb30f4af9
Volexity PowerDuke November 2016ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c053469-7bd4-4b55-90b2-289a09aa53fa
Secureworks BRONZE BUTLER Oct 2017ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6d9f427b-f016-4100-a30a-c13648536e81
Cybereason Bazar July 2020 · NCC Group Team9 June 2020ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e9690c6-f3d0-476a-969e-9d56e12c8b95
ZscalerATTACK:enterprise:S1246 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73fdccb0-fbf6-4d38-b935-65bb00fd193a
ESET Contagious Interview BeaverTail InvisibleFerret February 2025ATTACK:enterprise:S0149 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77c63e89-71fe-47e3-babb-13e7722932ad
Palo Alto MoonWind March 2017ATTACK:enterprise:S0017 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e2d9f42-18be-4b95-9300-db7d6afa50ec
Mandiant APT1ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7f6423c1-9b45-4265-a121-aae7a22b37d9
Microsoft Sapphire Sleet APR 2026ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80d83fb7-2511-43cc-833a-6be1825a41ed
Cyfirma_Vidar_June2024ATTACK:enterprise:S9020 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81b91e10-b98a-4064-995b-b48aa8ccc897
Kaspersky LODEINFO Part II OCT 2022ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83c913fb-b9e4-4468-b3e2-976d59e32e9c
PWC Yellow Liderc 2023ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--856ebcb0-cfec-484a-a741-900bb4d7f38a
Bitdefender FunnyDream Campaign November 2020ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87b74ba7-99c4-464c-86d2-1dd8c8b578b1
Kaspersky TurlaATTACK:enterprise:S0267 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b6dbaf7-d578-4bc6-8f16-07e7c1aeedc8
ESET GreyEnergy Oct 2018ATTACK:enterprise:S1034 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8dc0845d-c807-4e30-ac26-086f086b248f
Cybereason StrifeWater Feb 2022ATTACK:enterprise:S1147 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8fe98ea7-6bdc-4584-8020-f6668a402a70
ESET EvasivePanda 2024ATTACK:enterprise:G0012 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9158696f-fdc6-4869-a395-5d94c7c13d26
Lastline DarkHotel Just In Time Decryption Nov 2015ATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9414386b-adbf-4117-ba5b-81a242714d83
HP SVCReady Jun 2022ATTACK:enterprise:S0330 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9494b0d8-26d9-48ae-8dd1-c9d8966b23a0
GDATA Zeus Panda June 2017ATTACK:enterprise:S0501 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96f5f2ec-28e6-4ed4-853e-9c6cadbe3dda
ESET PipeMon May 2020ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9736ff6e-3b76-47be-a523-3be6076ce5eb
NCC Group Chimera January 2021ATTACK:enterprise:S0344 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d30b96a-6518-449e-a665-3033dfcb44db
Unit42 Azorult Nov 2018 · Proofpoint Azorult July 2018ATTACK:enterprise:S0351 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3d44c1d-2833-4355-b560-2a7a4fcaac14
Unit42 Cannon Nov 2018ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b19ff9ec-1a64-4401-9bbd-e3af5a13ec7f
Ensilo Darkgate 2018 · Trellix Darkgate 2023ATTACK:enterprise:S1134 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b59cba59-e191-4a12-aa82-1a74ec59df48
SentinelOne Agrius 2021ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6f54741-1424-4a3c-b83e-1c94df063186
Trend Micro DRBControl February 2020ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b846a531-6945-45d6-86f1-7964645d2ef7
BlackBerry_FIN7_April2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--be91925a-6d23-4d1d-a2e6-862ff823e010
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:S1159 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bed5ccbe-02dd-4736-ac42-ce0cce7f6dad
Google Cloud APT41 2024ATTACK:enterprise:S0586 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bff9fc96-0b27-4c84-ad42-dcea53b907bf
CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020