Skip to content

Hidden Files and Directories

Subtechnique · ATTACK:enterprise:T1564.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1564.001",
  "title": "Hidden Files and Directories",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1564/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--ec8fc7e2-b356-455c-8db5-2e37be158e7d",
  "external_id": "T1564.001",
  "domain": "enterprise",
  "created": "2020-02-26T17:46:13.128Z",
  "modified": "2026-05-12T15:12:00.723Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "WireLurker",
      "url": "https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf"
    },
    {
      "source_name": "Sofacy Komplex Trojan",
      "url": "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"
    },
    {
      "source_name": "Antiquated Mac Malware",
      "url": "https://blog.malwarebytes.com/threat-analysis/2017/01/new-mac-backdoor-using-antiquated-code/"
    }
  ]
}

Explicit source assertions (63)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0476f265-c79a-4ff7-a4cd-815d304818c6

Trend Micro Black Basta October 2022

ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05ee3203-83ad-4dd3-8590-b7f3ffcf772a

trendmicro xcsset xcode project 2020

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08fd666f-684f-4e78-876a-48cb92572c3a

Talos Seduploader Oct 2017 · Talos Seduploader Oct 2017

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0b200c14-5808-4cec-a1a4-aadf737fb99e

group-ib_redcurl1 · group-ib_redcurl2

ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f54df67-bfb2-40d1-a427-50558f1b1171

Kandji Cuckoo April 2024 · SentinelOne Cuckoo Stealer May 2024

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11180322-a9e0-4f20-94e1-d47f95db06f8

Trend Micro DRBControl February 2020

ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17bb48d5-7b1b-43be-b18e-07bc0462cad5

Kaspersky LuminousMoth July 2021

ATTACK:enterprise:S0612 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22507af4-0701-4ebe-99b1-153cf803f829

NCC Group WastedLocker June 2020

ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--234205d5-cc99-435c-bbc8-e2c1d3eb0ac5

Eset PlugX Korplug Mustang Panda March 2022 · Proofpoint TA416 Europe March 2022 · Sophos Mustang Panda PLUGX

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2426519f-c915-4c8f-8164-0d93dbbf0be1

McAfee Lazarus Resurfaces Feb 2018 · SentinelOne Lazarus macOS July 2020 · TrendMicro macOS Dacls May 2020 · Lazarus APT January 2022

ATTACK:enterprise:S0369 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3078d200-79f5-41d1-a0db-afe1501d650a

CoinTicker 2019

ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34b96e5d-1b2a-4ca5-89b5-7de398966bea

Eset PlugX Korplug Mustang Panda March 2022 · Avira Mustang Panda January 2020

ATTACK:enterprise:S0428 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3758634e-bb33-4354-98f3-b662e8e7e83f

Talos PoetRAT April 2020

ATTACK:enterprise:S0584 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37960736-9995-4ba6-bc65-a1d0cf6ec000

CISA AppleJeus Feb 2021

ATTACK:enterprise:S1219 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b8049f0-a12e-4037-9820-500b0bebef1d

Google Cloud Mandiant UNC3886 2024

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b967933-da99-40a4-9bd5-e8238e8d46c3

Carbon Black Shlayer Feb 2019

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4269342d-fd7b-4fc6-882f-5099da627c85

TrendMicro Tropic Trooper Mar 2018 · TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42cedca0-2faf-47db-a2da-c81b430ace60

BlackBerry_FIN7_April2024

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4306857b-542d-4a54-8b4d-b835e52c5c15

wardle evilquest parti

ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48141016-3fc6-46af-9f93-b52439ed78ea

Talos Rocke August 2018 · Unit 42 Rocke January 2019

ATTACK:enterprise:S0451 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--533d9f70-6f01-4eed-a198-bf0d29586897

ESET LoudMiner June 2019

ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d96e66b-372a-43de-892d-30086d7ff00e

CISA AR18-352A Quasar RAT December 2018

ATTACK:enterprise:S0352 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60fa966f-bb77-481f-9541-8a14e965718a

TrendMicro MacOS April 2018

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6390419e-ebaa-4556-ae74-c92dc041eb47

ESET InvisiMole June 2020

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6523c653-4f85-425c-a891-6df522e8c841

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:S1236 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6612c397-71c8-401b-a6ae-98f4b8a1ffac

2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e3d5ee1-0d86-45bc-9bef-1055f270a281

Aikido TeamPCP Telnyx MAR 2026

ATTACK:enterprise:S0634 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--735f51e0-f357-45a7-8a80-68eef5d4715b

MSTIC Nobelium Toolset May 2021

ATTACK:enterprise:S0434 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7393547f-0d33-4070-9569-733e15c72e73

QiAnXin APT-C-36 Feb2019

ATTACK:enterprise:S1043 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7888f7bb-92a8-4c5a-abbc-6dcc4ad3e149

Bitdefender FunnyDream Campaign November 2020

ATTACK:enterprise:S0015 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fd0dc68-66b1-482a-b3bd-3037bb0045cb

Trend Micro IXESHE 2012

ATTACK:enterprise:S0282 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87e853bb-a82f-4a8c-a43a-e7da05f43619

alientvault macspy

ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--88f1dfcb-3b2a-494d-bab2-027602c4f78f

Kaspersky Transparent Tribe August 2020

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c77a88d-1390-4736-b7c9-f902b62d7f45

ESET Okrum July 2019

ATTACK:enterprise:S9051 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ce1b4b0-da5d-489b-8e95-8c63d2e4dbc4

CheckPointResearch_TheGentlemen_April2026 · MSTI_GentelmenRansomware_May2026

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98132f22-5312-421a-98f4-e1741abbcd6a

SentinelLabs Agent Tesla Aug 2020

ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b2a5ea0-3199-44ee-a5a5-959e95d3a2e5

Trusteer Carberp October 2010

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a802b910-b023-425a-8c09-c1b2df185812

LogRhythm WannaCry · Checkpoint WannaCry 2017

ATTACK:enterprise:S0198 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aac15fc0-a17b-4295-bf46-b18569bc2c4f

Red Canary NETWIRE January 2020

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab6a59bc-fa67-4d6f-ab55-e5cb35f62839

Rapid7 HAFNIUM Mar 2021

ATTACK:enterprise:S0447 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af1fc367-9987-4076-9ce6-2414cd2d4a1f

Infoblox Lokibot January 2019

ATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0f22510-dda6-4937-8155-383a2924540f

Recorded Future RedDelta 2025

ATTACK:enterprise:S0278 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1d1e98b-e3fe-43d8-8b6d-810d8bc6cfab

objsee mac malware 2017

ATTACK:enterprise:S0663 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b4b6fec9-3f56-4571-9555-344cea28e667

Trend Micro Iron Tiger April 2021

ATTACK:enterprise:S0277 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd7dce44-be74-4d8e-b9e4-efcd77b8a29b

objsee mac malware 2017

ATTACK:enterprise:S0475 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf0fd2a9-0852-4a4e-a806-281c0a7d63e3

Unit 42 BackConfig May 2020

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c47d3636-65dd-4da1-8c90-e3e7aeb7effb

ESET Attor Oct 2019

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7bb75c5-c678-4ea7-b9ed-0c12c5de3077

ESET OceanLotus macOS April 2019

ATTACK:enterprise:T1564.001 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c848d2d3-ded6-45a0-b942-3763bbd10d5c

ATTACK:enterprise:S1176 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc602d8f-9abf-4617-b33d-34bf91130f0c

gbhackers Darkgate Malware 2024 · Unit42 ComboJack 2018 · LogRhythm WannaCry · Checkpoint WannaCry 2017 · Microsoft attrib 2023

ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cce441ef-ca18-461b-878c-496da97ccc06

NCSC-NL COATHANGER Feb 2024

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf17f2d1-c9f3-4087-9a9e-3a5268e6f5e8

Logpoint_StealerMalwareFamilies_2024

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2010d54-21e6-4312-b197-bca1a4c07b86

Ensilo Darkgate 2018 · gbhackers Darkgate Malware 2024

ATTACK:enterprise:S1230 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d44f695f-081c-4ccd-8134-237fcc9332fe

2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA · Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024

ATTACK:enterprise:S0274 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4784901-968c-4fb1-b0d3-0268d4c40582

Securelist Calisto July 2018 · Symantec Calisto July 2018

ATTACK:enterprise:S0569 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d80d5ba4-22ea-4ef4-94e6-f9fbaa3ca641

CheckPoint Volatile Cedar March 2015

ATTACK:enterprise:S0339 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8c933d5-f44d-4e3b-ae15-f94518320995

Radware Micropsia July 2018

ATTACK:enterprise:S0497 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dff93811-e9f1-430e-95d3-344a067b2e23

SentinelOne Lazarus macOS July 2020 · TrendMicro macOS Dacls May 2020

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e74766a5-c049-455b-8500-77a71438c120

Wiz TeamPCP KICS MAR 2026

ATTACK:enterprise:S0448 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1992fc5-5013-4fad-9a43-74a7f2b9e3ec

McAfee Sharpshooter December 2018

ATTACK:enterprise:S0162 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5acb12e-6d83-4628-9b1d-61f277a699b2

Sofacy Komplex Trojan

ATTACK:enterprise:S0533 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f71229d4-5499-4eb1-ad83-b18a1063b5b7

CISA MAR SLOTHFULMEDIA October 2020

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f8f50914-3b71-40a2-b661-5e11571222a6

ESET Machete July 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.