Skip to content

Registry Run Keys / Startup Folder

Subtechnique · ATTACK:enterprise:T1547.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1547.001",
  "title": "Registry Run Keys / Startup Folder",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1547/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--9efb1ea7-c37b-4595-9640-b7680cd84279",
  "external_id": "T1547.001",
  "domain": "enterprise",
  "created": "2020-01-23T22:02:48.566Z",
  "modified": "2026-05-12T15:12:00.706Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "persistence",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "Malwarebytes Wow6432Node 2016",
      "url": "https://blog.malwarebytes.com/cybercrime/2013/10/hiding-in-plain-sight/"
    },
    {
      "source_name": "Microsoft Wow6432Node 2018",
      "url": "https://docs.microsoft.com/en-us/windows/win32/sysinfo/32-bit-and-64-bit-application-data-in-the-registry"
    },
    {
      "source_name": "Microsoft Run Key",
      "url": "https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys"
    },
    {
      "source_name": "Oddvar Moe RunOnceEx Mar 2018",
      "url": "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/"
    },
    {
      "source_name": "TechNet Autoruns",
      "url": "https://technet.microsoft.com/en-us/sysinternals/bb963902"
    }
  ]
}

Explicit source assertions (268)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0082 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0040fdbd-ec7e-49b3-b715-c8c91e08666b

Emissary Trojan Feb 2016

ATTACK:enterprise:S0124 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02a629d3-b970-43e8-a11b-79f35107a4c0

Palo Alto DNS Requests

ATTACK:enterprise:S0396 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--030958f2-615b-4c80-a1ec-38ed335da413

Cyphort EvilBunny Dec 2014

ATTACK:enterprise:G0073 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--04558d61-aa04-46b5-a65f-921011ac9621

Unit 42 C0d0so0 Jan 2016

ATTACK:enterprise:G0067 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0500bac5-bc50-4529-ae5f-b4e1a85fa7d7

FireEye APT37 Feb 2018 · Talos Group123

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0574a456-6327-4f07-94b0-58be6ecbf8b8

FireEye APT39 Jan 2019

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06eb051c-74d0-4bbd-8cdf-1018b3c2e748

McAfee Netwire Mar 2015 · Red Canary NETWIRE January 2020 · Unit 42 NETWIRE April 2020 · Proofpoint NETWIRE December 2020

ATTACK:enterprise:G1018 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--07efd7ec-332f-43fd-8ffc-6f50c32c4f55

Proofpoint TA2541 February 2022

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--084fc3bc-5e50-47fb-97d1-75fa00b6ed79

TrendMicro PE_URSNIF.A2 · TrendMicro BKDR_URSNIF.SM

ATTACK:enterprise:S0093 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--087721ee-6643-4453-8a76-8768ced7e506

Symantec Dragonfly · Gigamon Berserk Bear October 2021

ATTACK:enterprise:S0028 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--093215eb-4edb-4c55-bb5f-b8ca2de7962c

ATTACK:enterprise:G0048 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09381138-b93b-4b0d-b82d-c21d452ff514

ESET RTM Feb 2017 · Group IB RTM August 2019

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a507d28-ef6b-417b-a968-e82608e8b6a8

DFIR Phosphorus November 2021 · Unit 42 Magic Hound Feb 2017 · Microsoft Iranian Threat Actor Trends November 2021

ATTACK:enterprise:S1044 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a606064-9f7f-4ca9-a2c5-b80360433ff7

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ecaa94b-3ad8-4de5-9cf2-81069676cfa3

Fortinet Agent Tesla April 2018 · SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S1029 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ef4030f-0af2-4b6e-bfb8-3fedc5af5a7e

MalwareBytes SideCopy Dec 2021

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f1d0255-d27c-40d6-9c01-b2c9e9331f93

rapid7-email-bombing

ATTACK:enterprise:S0090 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f5d3626-1dc2-4ebe-ba37-3f86ab0df9ec

Palo Alto Rover

ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f60b67a-c6a5-4855-991e-00ec6fe5f9ac

Microsoft FinFisher March 2018 · FinFisher Citation

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f90920b-ab2e-4c79-95a5-5438c172a46d

Check Point Warzone Feb 2020

ATTACK:enterprise:S0449 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1075f27d-8675-4819-b23b-50d390092c95

Sophos Maze VM September 2020

ATTACK:enterprise:S0355 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11471266-5136-4cd8-a1ef-d847f33ab6de

Unit 42 Nokki Oct 2018

ATTACK:enterprise:S0337 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11d37d18-3ad6-41ed-a99e-f1cc9d524c6c

Unit 42 BadPatch Oct 2017

ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1215a807-77b4-465e-9c82-c4f023e668da

Kaspersky Cloud Atlas December 2014

ATTACK:enterprise:S1199 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1400cd29-916f-40fe-af7c-ec89ef7b75c8

FBI Lockbit 2.0 FEB 2022

ATTACK:enterprise:C0022 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16713b63-7fe7-41e0-b157-2d26a406881b

McAfee Lazarus Jul 2020

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1829d419-0145-4a47-bb1e-ff00e647b5ff

TrendMicro Pawn Storm Dec 2020

ATTACK:enterprise:S9053 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--18ca258c-d465-44f1-98c6-57bd908577a9

CheckPoint_NimbusManticoreEurope_Sept2025

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19bede58-549b-4e7d-b206-6045370b9995

ATT TeamTNT Chimaera September 2020

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1be18787-844d-4135-9781-e5b6a8e76d14

Fortinet Remcos Feb 2017

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cb54b2e-5f2d-4d1b-9fda-9b17f49de65b

Unit 42 Kazuar May 2017

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1eae2e76-cd0b-496e-b121-fa9fac51e6fc

Aikido TeamPCP Telnyx MAR 2026

ATTACK:enterprise:S0568 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ec23e24-e63e-4c35-ad0d-637880ce7bb6

Prevailion EvilNum May 2020 · ESET EvilNum July 2020

ATTACK:enterprise:S0389 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ffba98c-788b-47e0-a67c-9d3700e86ec5

Carbon Black JCry May 2019

ATTACK:enterprise:S0338 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22260fda-fb95-4cf4-9e23-ba8662157c1f

Zscaler Cobian Aug 2017

ATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22879bfd-c9de-480b-83f3-4b58ef6dd08e

Symantec Darkmoon Aug 2005

ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--23bc50df-16da-4b2d-89b3-1a74c7602aa2

Prevx Carberp March 2011

ATTACK:enterprise:S0532 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25022051-be2f-4cc2-b61a-3de03fc3e8d6

Unit 42 Lucifer June 2020

ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--251b010d-270f-44a3-8546-ce7cde631ab7

Group IB GrimAgent July 2021

ATTACK:enterprise:S0070 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--259b878f-147e-443b-8360-aabc00cf6d73

ZScaler Hacking Team · ThreatStream Evasion Analysis

ATTACK:enterprise:S0665 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25d44b9e-3645-4fe7-96b0-3c2c31b90ac0

Kaspersky ThreatNeedle Feb 2021

ATTACK:enterprise:S1212 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--280b3253-cc47-42e1-9339-dbaa06161b15

Group-IB RansomHub FEB 2025

ATTACK:enterprise:S0045 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--284ffb1b-ad42-468e-9897-94c25024f0d4

Kaspersky Sofacy · ESET Sednit Part 2 · Bitdefender APT28 Dec 2015

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2851e8fa-0622-42db-b7b7-4e051fc5fbeb

Proofpoint Leviathan Oct 2017 · FireEye Periscope March 2018

ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a7cd52f-46e5-4a18-bdf6-4c38edfcb97c

Palo Alto OilRig May 2016

ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a896410-d7cd-4b58-a7d6-4878bc64113b

Bitdefender Naikon April 2021

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b3dc227-2ce1-41fa-8d1c-4c0d3685258d

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cb6835c-e6e6-46d5-b5d2-45846eac3b74

Crowdstrike Qakbot October 2020 · Group IB Ransomware September 2020 · Trend Micro Qakbot May 2020 · Trend Micro Qakbot December 2020

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d49852d-083e-4379-90e3-dcb0748be624

Group IB Silence Sept 2018

ATTACK:enterprise:S0666 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dde8a3e-773e-4a7f-82e4-dbcaa8cb94c8

ESET Gelsemium June 2021

ATTACK:enterprise:S1130 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e443cd2-b77f-4bb9-8bbd-82e11ab389f2

TrendMicro RaspberryRobin 2022

ATTACK:enterprise:S0144 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e44b66a-0f81-4f60-94aa-c450556bc243

PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:S0168 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fb450c6-e236-4b81-b5ac-a9d4be0cf167

ESET Gazer Aug 2017 · Securelist WhiteBear Aug 2017

ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--313082d2-c493-4053-80c1-06300aeea8e0

Unit 42 Gorgon Group Aug 2018

ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3216e004-d8fe-4475-a107-8c3ad92f0fd8

Proofpoint Operation Transparent Tribe March 2016 · Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3236ca50-2342-455a-b258-6a085cae8fc2

Symantec Emotet Jul 2018 · US-CERT Emotet Jul 2018 · Picus Emotet Dec 2018

ATTACK:enterprise:S0046 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--327a64df-b405-453b-83d2-528d17e8df51

F-Secure CozyDuke

ATTACK:enterprise:S0341 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3341ad26-c7a8-4e42-a095-a49e65fde843

Unit42 Xbash Sept 2018

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3434121e-a4d6-43a7-b905-78c52f5a12bd

ESET InvisiMole June 2020

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--343d285a-e910-487b-8e85-dc87cdb63be3

Mandiant No Easy Breach

ATTACK:enterprise:S1236 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3475a2ad-4cb7-4ec0-bb36-6e60355a03c3

IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025 · 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

ATTACK:enterprise:S0546 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3698b20c-408a-4873-9284-19b2106bfaab

Cybereason Molerats Dec 2020

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3777379a-469f-453e-a270-450c8b1eba9b

Trend Micro DRBControl February 2020 · Talent-Jump Clambling February 2020

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37dd9a3c-dd52-4541-be7c-b490d026305c

ESET RTM Feb 2017

ATTACK:enterprise:S0074 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--384c75e4-04e7-4ff8-9da6-0c8a03cb7a61

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d3fa163-626d-41b8-85c1-f815c458ad19

Zscaler APT31 Covid-19 October 2020

ATTACK:enterprise:S0172 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3dcf441c-b987-4c6a-93e7-e24ae1e16475

Palo Alto Reaver Nov 2017

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e3a5bf5-1e90-45d2-b90a-3b919f5425d5

CISA AR18-352A Quasar RAT December 2018 · GitHub QuasarRAT

ATTACK:enterprise:S0036 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ebad12d-fd33-4289-93dc-1f5af5e90b66

ATTACK:enterprise:S0397 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f4700e6-71a4-4995-b173-00974a528905

ESET LoJax Sept 2018

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f954be4-205c-4cec-92f9-36715e204a49

Cymmetria Patchwork · TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--41bec3ae-de2b-470b-b356-dd163bd20445

Sophos Gootloader

ATTACK:enterprise:S1037 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--434296ee-6296-4d0a-a72e-bebb914c9700

DHS CISA AA22-055A MuddyWater February 2022 · Mandiant UNC3313 Feb 2022

ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--442ff7a8-149b-4d26-933a-033ba25b9838

Korean FSI TA505 2020

ATTACK:enterprise:S0147 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44908b0a-993a-4339-b30f-f0f1a64c0753

Palo Alto Gamaredon Feb 2017

ATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45f150d4-a917-4862-bcee-170be75415cd

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:S0167 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4696a49d-caa1-4746-b106-45faf327270b

ClearSky Wilted Tulip July 2017 · CopyKittens Nov 2015

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4739d942-9d7f-4d7b-8aaf-af5464f76d44

Ensilo Darkgate 2018 · Rapid7 BlackBasta 2024

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--475d30ee-999c-470c-b4b3-eed40d1db799

Talos Konni May 2017

ATTACK:enterprise:S0207 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--498c599b-99ed-477d-afe8-2a6714506934

Symantec Vasport May 2012

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.