aol.pm

Windows Service

Subtechnique · ATTACK:enterprise:T1543.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1543.003",
  "title": "Windows Service",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1543/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--2959d63f-73fd-46a1-abd2-109d7dcede32",
  "external_id": "T1543.003",
  "domain": "enterprise",
  "created": "2020-01-17T19:13:50.402Z",
  "modified": "2026-05-12T15:12:00.623Z",
  "version": "1.6",
  "aliases": [

  ],
  "tactics": [
    "persistence",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "Microsoft Windows Event Forwarding FEB 2018",
      "url": "https://docs.microsoft.com/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection"
    },
    {
      "source_name": "ESET InvisiMole June 2020",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"
    },
    {
      "source_name": "SANS 1",
      "url": "https://www.sans.org/blog/red-team-tactics-hiding-windows-services/"
    },
    {
      "source_name": "SANS 2",
      "url": "https://www.sans.org/blog/defense-spotlight-finding-hidden-windows-services/"
    },
    {
      "source_name": "TechNet Services",
      "url": "https://technet.microsoft.com/en-us/library/cc772408.aspx"
    },
    {
      "source_name": "Microsoft 4697 APR 2017",
      "url": "https://docs.microsoft.com/windows/security/threat-protection/auditing/event-4697"
    },
    {
      "source_name": "Symantec W.32 Stuxnet Dossier",
      "url": "https://www.wired.com/images_blogs/threatlevel/2010/11/w32_stuxnet_dossier.pdf"
    },
    {
      "source_name": "Unit42 AcidBox June 2020",
      "url": "https://unit42.paloaltonetworks.com/acidbox-rare-malware/"
    },
    {
      "source_name": "TechNet Autoruns",
      "url": "https://technet.microsoft.com/en-us/sysinternals/bb963902"
    },
    {
      "source_name": "Crowdstrike DriveSlayer February 2022",
      "url": "https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"
    }
  ]
}

Explicit source assertions (147)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1090 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--01b95067-ba65-48c2-8d2c-342e13007cc8

MoustachedBouncer ESET August 2023

ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02af155a-ed26-4807-99c5-f88477a6e143

Dragos Crashoverride 2017

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03fcc016-f9a2-491d-8d9f-92aa4b4c4d4a

PWC KeyBoys Feb 2017

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06a238f1-b231-4f90-8576-eaa107ce73a2

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a1b48b9-2063-449d-a316-c6760267720f

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:M1040 → mitigates → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a28651c-ea35-4f05-a483-d9a60b06cbaf

Malicious Driver Reporting Center · Microsoft driver block rules

ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a65c303-52a6-4624-a8fb-fc7448429139

Microsoft Winnti Jan 2017

ATTACK:enterprise:S0625 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a8d1f91-445a-4260-83b2-e13725b0a8d6

McAfee Cuba April 2021

ATTACK:enterprise:S0204 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b4cd78b-e0af-4123-b2aa-02ad66cca419

Symantec Briba May 2012

ATTACK:enterprise:S1033 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0c1acc71-87ca-4dc5-ba28-3d924bc1c93f

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f42474f-27d5-4939-8f18-348b8d09a9b6

NCC Group WastedLocker June 2020

ATTACK:enterprise:S0493 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fee7bbd-8d36-48e2-b800-9d2f02c06123

Trustwave GoldenSpy June 2020

ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--128ecd12-77db-4117-be2f-2bf5476de670

Cybereason OperationCuckooBees May 2022

ATTACK:enterprise:G0105 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12dcf7c0-4f6b-4eb1-9317-3337822ecbe1

Securelist DarkVishnya Dec 2018

ATTACK:enterprise:S0180 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1436e328-e692-4dbc-adfd-cf1024a98b2e

US-CERT Volgmer 2 Nov 2017 · US-CERT Volgmer Nov 2017 · Symantec Volgmer Aug 2014

ATTACK:enterprise:S0149 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--162a051d-a551-4b8c-875a-75264768e541

Palo Alto MoonWind March 2017

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17629f20-194c-48cb-aa1c-b3da2b6f06ba

F-Secure Cosmicduke

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1888d04c-e3ba-47bc-adb3-ab8066678772

Symantec Darkmoon Aug 2005

ATTACK:enterprise:S1037 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1b3e8c1d-65d2-47a6-91f4-d8dcc52ca01c

Mandiant UNC3313 Feb 2022

ATTACK:enterprise:S0230 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d3c31c2-6756-483a-8aee-736bac591c1a

Proofpoint ZeroT Feb 2017

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e345391-ccd8-49c9-9520-496070670e6c

ESET Gelsemium June 2021

ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fbee829-fe84-4a48-a943-5be81abfb43c

Crowdstrike HuntReport 2022

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2012985d-6529-4944-a2d2-892d56751b94

CISA AA20-239A BeagleBoyz August 2020 · MIcrosoft Mastra npm Compromise JUN 2026

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--24566f69-12b6-4703-86e2-bbf966ac5535

NCC Group Black Basta June 2022

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2593bdc1-d284-4269-a959-2741baeb9f04

Cisco LotusBlossom 2025

ATTACK:enterprise:S0608 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25a8672d-3d99-456b-a8c6-2ea5f3a5a688

SANS Conficker

ATTACK:enterprise:S0342 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27dcfdc7-f5d5-49b4-ad4e-afd43974c43c

ESET GreyEnergy Oct 2018

ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29cd1209-5e90-448f-83d3-42c3ecdd1f70

FireEye APT41 Aug 2019 · FireEye APT41 March 2020 · Group IB APT 41 June 2021

ATTACK:enterprise:S0387 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b26c652-7f0e-41f1-810a-7e6c24f2bfdb

Rapid7 KeyBoy Jun 2013

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b5965fe-b178-4c03-91af-942491c79302

CrowdStrike Grim Spider May 2019 · Mandiant FIN12 Oct 2021

ATTACK:enterprise:S0081 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d4d634d-ed13-462a-916b-94798546ec6c

Lotus Blossom Jun 2015

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ef7a9cd-aba5-4360-9a8f-f6b58ff4492d

ESET Okrum July 2019

ATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31653a26-6af1-4f30-8b01-55eebd2b3ca7

sentinelone operationDigitalEye Dec 2024

ATTACK:enterprise:G0108 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--328e9746-4bb6-47e1-8e71-6418ca04c5fa

RedCanary Mockingbird May 2020

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--331da7a8-d1ad-4feb-892a-c440aa5eb810

ATT TeamTNT Chimaera September 2020

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33aebe8f-cc59-4953-9648-ba6bf1654cda

ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3503cf12-e618-44b9-ac48-e1f1d7939767

CISA AppleJeus Feb 2021

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3515a90d-cb4c-4bc0-8d19-de781061487f

Microsoft BlackByte 2023 · Symantec BlackByte 2022

ATTACK:enterprise:S0567 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--372ff318-25a5-476b-9090-7e0fd4534325

CyberBit Dtrack

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--382e04c1-aa23-4e52-a254-06e45ca8edfd

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:S0350 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--38b1ad70-4d24-4f5c-ad62-e03f38b6752f

McAfee Night Dragon

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cce1055-1e6a-47ba-9468-fb1cea1eb0a3

Sentinel Labs LockBit 3.0 JUL 2022

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3efd847d-47ec-4460-ad63-6233b177ee64

GitHub SILENTTRINITY Modules July 2019

ATTACK:enterprise:S0086 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f02c07f-663f-4c54-b7e0-c2b2dbe82335

Cylance Dust Storm

ATTACK:enterprise:S0268 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--408183ae-ffff-4341-8c90-f007226656aa

Talos Bisonal Mar 2020

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40f51fdc-cd3c-4e93-9593-e1ee7cf2211e

ATTACK:enterprise:C0040 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4220bcf3-e225-474c-b2df-1dfa9e370a74

Google Cloud APT41 2024

ATTACK:enterprise:S1244 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43a521e7-f588-4c30-b0df-f3c117d74f65

Security Scorecard Medusa Ransomware January 2024

ATTACK:enterprise:S0029 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43b00ad2-2d54-4ca9-a0a2-a0cb1a5fa7ff

Russinovich Sysinternals

ATTACK:enterprise:S0665 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--451e231b-a523-4ee9-be5e-1e80cef9c8fa

Kaspersky ThreatNeedle Feb 2021

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--46660a8a-7724-4577-b09e-551a1ce61bfc

Symantec W32.Duqu

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4999a323-b025-4a1d-8c80-5ae36b2f5a0d

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4e9c5234-65e9-4b4a-bc13-891e7aed84b2

Palo Alto Shamoon Nov 2016 · Unit 42 Shamoon3 2018

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5235fbdb-5c53-4860-a459-cd4b538817db

Trend Micro Trickbot Nov 2018

ATTACK:enterprise:S0142 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5576c38e-6b03-4ea9-8936-60eeddb749a7

Cylance Shell Crew Feb 2017

ATTACK:enterprise:S0236 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56c41e3f-3d8f-4f36-9885-955952e700db

Symantec Orangeworm April 2018

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5724994d-7213-4a70-8065-1a12280f8f4c

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:S0239 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5782aac5-a4c6-4d17-88c9-e29b795e3ee7

McAfee Bankshot · US-CERT Bankshot Dec 2017

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59cb4ff6-e1fd-4088-905f-2ade864dabb0

Cobalt Strike TTPs Dec 2017

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a0c107f-aaf9-47f7-889e-8d374c5706a1

Unit42 Bookworm Nov2015

ATTACK:enterprise:S1235 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5eec8391-e708-4a90-86c0-259fff53af8d

Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

ATTACK:enterprise:S0664 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60331850-dfc3-4769-9790-1be664aa63c2

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0495 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61ce8307-ddb8-4f29-ab77-6532c2b90266

Unit42 RDAT July 2020

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--676d7d2c-86b6-4a59-8158-d371e5ca4f23

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:S0335 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--677e0d3e-4a61-490d-a49d-f392cc3432d1

ESET Carbon Mar 2017

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68d41471-49c7-4210-8d9b-2958e95feb1a

Lunghi Iron Tiger Linux · Nccgroup Emissary Panda May 2018

ATTACK:enterprise:S0206 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a866320-6bfd-4130-941c-bcd888f2ee92

Symantec Wiarp May 2012

ATTACK:enterprise:S0210 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6aadee2b-d475-4604-bb08-7df5e59eae3a

Symantec Nerex May 2012

ATTACK:enterprise:S0261 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b43b9ca-a916-44da-9ba5-917f03984157

Symantec Catchamas April 2018

ATTACK:enterprise:S1099 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7060f9a3-aeea-41bc-a5bf-549e33334fdd

Kaspersky ToddyCat June 2022

ATTACK:enterprise:S0203 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72e36412-4427-479b-bc8e-e8d53e997587

Symantec Trojan.Hydraq Jan 2010 · Symantec Hydraq Jan 2010 · Symantec Hydraq Persistence Jan 2010

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--754790a1-86b9-4421-b8e9-84d3dee51097

CIRCL PlugX March 2013 · FireEye APT10 April 2017 · Proofpoint ZeroT Feb 2017 · PWC Cloud Hopper Technical Annex April 2017 · Lastline PlugX Analysis

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--754c12f9-58a9-4cf0-af08-b5da6d14a767

Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7b8c29ce-dda2-4608-a28f-40aca495048f

NCC Group APT15 Alive and Strong

ATTACK:enterprise:S0451 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80bead39-b050-48d9-b185-aa31d1681a61

ESET LoudMiner June 2019

ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--875a622a-445e-46fe-8959-8d205c88c728

Bitdefender StrongPity June 2020

ATTACK:enterprise:M1045 → mitigates → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--875ed563-004f-4541-99e4-21a556e5400c

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87c7f912-4093-44f2-9f18-e97e649dd52e

ESET Attor Oct 2019

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88ad4f5a-f127-435c-a8a0-6a6fceddfa47

Unit 42 Kazuar May 2017

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89ed7e05-1f94-4693-b290-96c3a9ecd615

TrendMicro PE_URSNIF.A2

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.