Drive-by Target
Subtechnique · ATTACK:enterprise:T1608.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1608.004",
"title": "Drive-by Target",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1608/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--31fe0ba2-62fd-4fd9-9293-4043d84f7fe9",
"external_id": "T1608.004",
"domain": "enterprise",
"created": "2021-03-17T20:33:20.127Z",
"modified": "2025-10-24T17:48:36.634Z",
"version": "1.3",
"aliases": [
],
"tactics": [
"resource-development"
],
"source_references": [
{
"source_name": "ATT ScanBox",
"url": "https://cybersecurity.att.com/blogs/labs-research/scanbox-a-reconnaissance-framework-used-on-watering-hole-attacks"
},
{
"source_name": "Gallagher 2015",
"url": "http://arstechnica.com/security/2015/08/newly-discovered-chinese-hacking-group-hacked-100-websites-to-use-as-watering-holes/"
},
{
"source_name": "FireEye CFR Watering Hole 2012",
"url": "https://web.archive.org/web/20201024230407/https://www.fireeye.com/blog/threat-research/2012/12/council-foreign-relations-water-hole-attack-details.html"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0134 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--087c222c-4108-4fbf-ac8f-983cd71548fa
Proofpoint Operation Transparent Tribe March 2016 · Unit 42 ProjectM March 2016 · Talos Transparent Tribe May 2021ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--28f7e7c9-76ef-48c7-b027-f32256ad2907
Bitdefender LuminousMoth July 2021ATTACK:enterprise:T1608.004 → subtechnique-of → ATTACK:enterprise:T1608
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bdfb695-b617-47ba-bfad-30ccf7f0ee92
ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--461ddc5d-889d-4879-ade3-27ff78d7e442
Gigamon Berserk Bear October 2021ATTACK:enterprise:G1012 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--67b2064e-4e0b-4b56-8381-ed16efc270c2
PWC Yellow Liderc 2023ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6c4a3ef5-8aee-4fe8-b2c6-386f90c057a4
Volexity Ocean Lotus November 2020ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75270994-ea95-4744-a383-056eb96ab50d
Mandiant FIN7 Apr 2022ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7acc1226-d784-448e-8aeb-7f58e343c4da
Gallagher 2015ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c817fbc-5dff-4059-8230-b8040dabde61
ATTACK:enterprise:C0010 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8d172b4c-7732-4315-852a-958a1cd08025
Mandiant UNC3890 Aug 2022ATTACK:enterprise:G1020 → uses → ATTACK:enterprise:T1608.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91d541d9-b396-4499-8ed6-f0c762e1d495
SocGholish-update · SentinelOne SocGholish Infrastructure November 2022 · Red Canary SocGholish March 2024 · Secureworks Gold Prelude Profile