Rundll32
Subtechnique · ATTACK:enterprise:T1218.011
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1218.011",
"title": "Rundll32",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1218/011",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--045d0922-2310-4e60-b5e4-3302302cb3c5",
"external_id": "T1218.011",
"domain": "enterprise",
"created": "2020-01-23T18:03:46.248Z",
"modified": "2026-05-12T15:12:00.620Z",
"version": "3.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "rundll32.exe defense evasion",
"url": "https://www.cynet.com/attack-techniques-hands-on/defense-evasion-techniques/"
},
{
"source_name": "Attackify Rundll32.exe Obscurity",
"url": "https://www.attackify.com/blog/rundll32_execution_order/"
},
{
"source_name": "This is Security Command Line Confusion",
"url": "https://www.stormshield.com/news/poweliks-command-line-confusion/"
},
{
"source_name": "Github NoRunDll",
"url": "https://github.com/gtworek/PSBits/tree/master/NoRunDll"
},
{
"source_name": "lolbas project Ieframe.dll",
"url": "https://lolbas-project.github.io/lolbas/Libraries/Ieframe/"
},
{
"source_name": "lolbas project Zipfldr.dll",
"url": "https://lolbas-project.github.io/lolbas/Libraries/Zipfldr/"
},
{
"source_name": "Trend Micro CPL",
"url": "https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp-cpl-malware.pdf"
}
]
}Explicit source assertions (105)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--078fe5f7-91b4-4864-960a-24c64b14996e
ESET Lazarus Jun 2020 · McAfee Lazarus Jul 2020 · ClearSky Lazarus Aug 2020ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ab3b4aa-55d9-44bb-8563-d7e614641d5a
ESET InvisiMole June 2020ATTACK:enterprise:C0021 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0e8a4965-f609-4cf1-bded-2b4a1ef5c5f3
FireEye APT29 Nov 2018ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f2bab58-fd7c-486a-b2b7-48eeb39bf212
Bleeping Computer Latrodectus April 2024 · Elastic Latrodectus May 2024ATTACK:enterprise:S0196 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--107267dc-0620-42b3-8287-f49ce2ea4f8f
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:S0635 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--11abcf3d-3fe2-4b5e-8590-9509a881d877
MSTIC Nobelium Toolset May 2021ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12904c83-67ad-430f-96ae-20e9081c2b5d
Bitdefender APT28 Dec 2015ATTACK:enterprise:S0204 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--138da0bb-befa-45cd-9ca4-c74b86ac61ff
Symantec Briba May 2012ATTACK:enterprise:S0576 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--190c819e-d4c9-4fa6-b809-9c7d76c0810a
IBM MegaCortexATTACK:enterprise:S1064 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--19a6f8fb-22c6-476c-9343-93956d9c1b77
HP SVCReady Jun 2022ATTACK:enterprise:S0342 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ad1048f-05ce-4bde-a570-6b4be5fbeb4c
ESET GreyEnergy Oct 2018ATTACK:enterprise:S0142 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b4ee147-dc39-43d2-b468-fcd308e6cbae
Cylance Shell Crew Feb 2017ATTACK:enterprise:S0082 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c6f35f0-1169-4218-9881-7291e1765cd8
Emissary Trojan Feb 2016ATTACK:enterprise:S0139 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cbf5583-626a-4a24-bc59-f3b973752cee
Volexity PowerDuke November 2016ATTACK:enterprise:S1190 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f31e793-d168-4dc9-a42e-c74da58d3365
Microsoft KnuckleTouch 2024 · WithSecure Kapeka 2024ATTACK:enterprise:S0256 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1fadec32-a069-4103-bac1-1f61cf2e90e0
ESET Turla Mosquito Jan 2018ATTACK:enterprise:S0113 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--216ab163-818b-4303-beb6-a743b90c98bf
ESET Operation GroundbaitATTACK:enterprise:S0554 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--218617ce-6474-4fd4-920e-88207c5aa219
Cybereason Egregor Nov 2020ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29e9bfd8-e2d3-4e25-8683-6605d99538de
ESET Gamaredon June 2020ATTACK:enterprise:S0518 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f25c2ba-ee4b-41e7-9cf9-7a0960f3e77c
ESET Dukes October 2019ATTACK:enterprise:S0081 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37ab6b56-033c-4cb6-8d1b-e7ff5dcf668d
Lotus Blossom Jun 2015ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3832d04e-41aa-456d-8104-b0a1fa2c12bb
Mandiant FIN7 Apr 2022ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bcfc38f-5fe8-4c66-8352-d3ba71c4f3ec
FireEye APT19ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3c58b596-6a79-4c28-be76-40e7ae9afd8a
ESET Attor Oct 2019ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--439e52b5-9aa1-4afb-b759-2b99b9fc5049
Bitdefender FunnyDream Campaign November 2020ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49b4d1e6-1f0c-4e66-a9f1-51dc32615e69
Talos Kimsuky Nov 2021 · Aryaka Kimsuky July 2025ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--49ef7dce-c472-4a9e-a0a7-1a9c35991ef4
Google Cloud Threat Intelligence ESXi VIBs 2022ATTACK:enterprise:S0634 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b1cb3cd-5315-487b-8e4b-554b4679d00d
MSTIC Nobelium Toolset May 2021ATTACK:enterprise:S0483 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4eaced08-4f7d-4085-be86-05e3304792d3
DFIR_Quantum_Ransomware · Trendmicro_IcedIDATTACK:enterprise:S1183 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--502058a1-d9ea-42ec-af45-3b2bf152092d
PaloAlto StrelaStealer 2024 · IBM StrelaStealer 2024ATTACK:enterprise:S0093 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--504b9a6b-bb70-4055-876b-12aafb342f69
Gigamon Berserk Bear October 2021ATTACK:enterprise:C0015 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--511ed53b-8445-4da7-8890-49d1b4e98077
DFIR Conti Bazar Nov 2021ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--539f8bc3-3fb4-43af-8918-9a65239cdff6
Kaspersky CarbanakATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--555e47f2-54bb-4c97-8804-536aa354126c
FireEye Clandestine FoxATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57597bcb-9cbc-49d4-adfb-fb4c0fe6090e
DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:G0127 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58565141-69f5-45c4-a7a9-f3eec03f403b
Unit 42 TA551 Jan 2021ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5859ee5b-c54b-4f2b-a6c7-6551046eb929
ESET Security Mispadu Facebook Ads 2019ATTACK:enterprise:S0255 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--592324b4-064a-430c-8ffc-7f7acd537778
Rancor Unit42 June 2018ATTACK:enterprise:S0032 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a771636-9b4d-423c-b7ba-1f274cbfb5b7
Arbor Musical Chairs Feb 2018ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e617da4-3359-4e40-b29d-679e05ef2e31
Korean FSI TA505 2020ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66513679-0866-4091-a346-2679db5e3cca
RedCanary Mockingbird May 2020ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6924c49b-0f86-4712-9600-f91b21fa5691
Mandiant FIN12 Oct 2021ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b11697f-be6c-4cd7-b445-4d277a8d7346
Microsoft Winnti Jan 2017 · Novetta Winnti April 2015ATTACK:enterprise:S0046 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e24d8d1-7376-493f-a85c-75448c80efed
F-Secure CozyDukeATTACK:enterprise:S1052 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fd94786-4ffe-4053-851b-ee62fa558652
Mandiant APT41ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--749fb1ed-d73c-4317-8c0f-6c059cff094f
Cybereason Cobalt Kitty 2017ATTACK:enterprise:S1027 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--768dd2dd-8840-45e3-ad15-c30512a35c05
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:T1218.011 → subtechnique-of → ATTACK:enterprise:T1218
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--769b2668-2e16-4300-89f4-f45124896fb8
ATTACK:enterprise:S1026 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7920e13a-6c7f-4609-9a6a-729c053242eb
SentinelOne Aoqin Dragon June 2022ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--797a925e-7fe8-4d88-a372-88160f24b111
Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:S1039 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7af072a8-2a24-42c4-9cdc-7e060693849e
Symantec Bumblebee June 2022 · Proofpoint Bumblebee April 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7cd04afd-b216-468b-a4af-71700c9fbefd
ESET Twitter Ida Pro Nov 2021ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--841acdc1-42c3-4f7d-9840-c9e4057bc2ab
Cybereason TA505 April 2019 · Deep Instinct TA505 Apr 2019ATTACK:enterprise:S0606 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--849e3f46-81a5-4865-9a14-fbbf67bfd00a
Secure List Bad RabbitATTACK:enterprise:S1050 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8925d506-5fa7-4d8d-82bd-09c650029469
Bitdefender FunnyDream Campaign November 2020ATTACK:enterprise:G0052 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--896cd1de-ffa7-4f69-a981-2859cc756601
ClearSky Wilted Tulip July 2017ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--898211c4-915c-469f-be47-321d2d44af90
Crowdstrike GTR2020 Mar 2020ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b587fdb-cae2-4c5f-b434-86ad325077d2
Korean FSI TA505 2020ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8c720d3f-ad94-4668-a7f4-75104109df53
Kaspersky ToddyCat Check Logs October 2023ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8cba1710-1963-4d83-99dd-88a1d6b2580f
Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks · Microsoft Deep Dive Solorigate January 2021ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8e6cbb16-a5cb-4957-8654-dfde2471c3de
ESET Telebots July 2017ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f269f6c-9e8b-4296-ab47-2f60c9156b58
Crowdstrike DNC June 2016 · Bitdefender APT28 Dec 2015 · ESET Zebrocy May 2019 · Palo Alto Sofacy 06-2018 · Cybersecurity Advisory GRU Brute Force Campaign July 2021 · Unit 42 Playbook Dec 2017ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9088b52e-8e07-4fd4-ac80-66df7f877adf
Unit 42 Bisonal July 2018ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94a67c86-e7f6-4874-b41f-83a3bfc35be3
Volexity Exchange Marauder March 2021ATTACK:enterprise:S0452 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95f2f687-4a70-4611-a420-2b8b53e2ee26
TrendMicro Tropic Trooper May 2020ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ad1d50a-31b2-4fc6-ac22-f83f68e97a15
RedCanary RaspberryRobin 2022ATTACK:enterprise:M1050 → mitigates → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c7faf9b-c0ee-419f-b816-777edebd3a2a
ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a20b8e4c-330f-4e91-b4f6-e58e5800d690
Palo Alto Gamaredon Feb 2017ATTACK:enterprise:C0028 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2d91513-68d5-4df2-ab2f-05a25b72f419
Booz Allen HamiltonATTACK:enterprise:S0637 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6e374d3-1de7-4f5e-8fce-42cc326886bc
SentinelOne NobleBaron June 2021ATTACK:enterprise:S0074 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a79ff150-e765-4303-9668-ff553d6000cd
Dell SakulaATTACK:enterprise:S1196 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8efb427-fa68-4d39-9de3-a0be8c7b8884
ASEC Troll Stealer 2024 · S2W Troll Stealer 2024ATTACK:enterprise:S0412 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abc5f1e1-82b7-4d5d-b623-ce0f3e91b9d3
Talos ZxShell Oct 2014ATTACK:enterprise:S0382 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac43f0bd-db6c-4000-8efe-7f33520780d9
Deep Instinct TA505 Apr 2019ATTACK:enterprise:S0353 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1d2f617-f0ca-43b8-921c-687fad920f39
Unit 42 NOKKI Sept 2018ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b244899c-bb0a-46c0-8f38-23d867a8a8b2
ESET Dukes October 2019ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b258b8da-ddd2-4f0e-b5da-83a89f018d54
ESET RTM Feb 2017 · Unit42 Redaman January 2019ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3877b02-98e4-4c4a-8034-5af9f1e65c2c
Symantec Orangeworm April 2018ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5c85267-6a3e-4254-a851-3529f4f80b55
Medium KONNI Jan 2020 · Malwarebytes Konni Aug 2021ATTACK:enterprise:S0267 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b697e1d0-b537-4be0-bd16-fd3f7ade80e8
ESET GreyEnergy Oct 2018 · FireEye FELIXROOT July 2018