System Location Discovery
Technique · ATTACK:enterprise:T1614
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1614",
"title": "System Location Discovery",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1614",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--c877e33f-1df6-40d6-b1e7-ce70f16f4979",
"external_id": "T1614",
"domain": "enterprise",
"created": "2021-04-01T16:42:08.735Z",
"modified": "2026-09-11T19:39:19.101Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"discovery"
],
"source_references": [
{
"source_name": "Bleepingcomputer RAT malware 2020",
"url": "https://www.bleepingcomputer.com/news/security/new-rat-malware-gets-commands-via-discord-has-ransomware-feature/"
},
{
"source_name": "AWS Instance Identity Documents",
"url": "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html"
},
{
"source_name": "Securelist Trasparent Tribe 2020",
"url": "https://securelist.com/transparent-tribe-part-1/98127/"
},
{
"source_name": "FBI Ragnar Locker 2020",
"url": "https://s3.documentcloud.org/documents/20413525/fbi-flash-indicators-of-compromise-ragnar-locker-ransomware-11192020-bc.pdf"
},
{
"source_name": "Microsoft Azure Instance Metadata 2021",
"url": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service?tabs=windows"
},
{
"source_name": "Sophos Geolocation 2016",
"url": "https://news.sophos.com/en-us/2016/05/03/location-based-ransomware-threat-research/"
}
]
}Explicit source assertions (29)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0673 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00ed8575-5d79-46c3-adea-d0e1bf5dc14a
Prevailion DarkWatchman 2021ATTACK:enterprise:S1138 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02653ee2-6907-4fb5-b946-9cbd4377ad64
SentinelOne Gootloader June 2021ATTACK:enterprise:S0013 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0bb197ea-3530-4cd5-861a-26ef8bb1f6f9
Eset PlugX Korplug Mustang Panda March 2022ATTACK:enterprise:G1008 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--139cce0b-726b-406a-ad38-1fdfc779cf57
MalwareBytes SideCopy Dec 2021ATTACK:enterprise:S1153 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e272852-4033-4e88-8f0a-b957c1a6b74c
Kandji Cuckoo April 2024ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--288697f9-74a7-4b63-a92c-2c0fa13ef138
SecureListUbiedo_Tsundere_Nov2025ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--309c4a23-21dd-41fa-9e0c-ce5c730455fe
Ensilo Darkgate 2018 · Trellix Darkgate 2023ATTACK:enterprise:S1124 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35d76097-4eee-4b37-8b5c-05eec6ab7911
Secureworks Gold Prelude ProfileATTACK:enterprise:S1248 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d4ae685-f7bc-4944-84be-6428f3e757f6
Socket BeaverTail XORIndex HexEval Contagious Interview July 2025ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f4a052a-7e53-451f-8976-7c6f1623102d
CISA AR18-352A Quasar RAT December 2018ATTACK:enterprise:S9030 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5dd07f94-a3bf-48a3-ad5b-888f5b2953b4
Check Point Wirte NOV 2024ATTACK:enterprise:S9019 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69b96d7c-4606-4dfe-99e6-c64a4a51a0cc
Zscaler PureCrypter JUN 2022ATTACK:enterprise:S0461 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--70dc4dfe-c859-4665-88d7-ff724d88380b
Korean FSI TA505 2020ATTACK:enterprise:S1240 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79275d9c-25cb-4792-8ac9-57009b44bd35
ESET RedLine Stealer November 2024 · Kroll RedLine Stealer August 2024 · McAfee RedLine Stealer April 2024 · Proofpoint RedLine Stealer March 2020ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7d2f007d-a013-4637-b7f0-8d73c39361b4
Cyfirma_Vidar_June2024 · Unit42_Vidar_July2026ATTACK:enterprise:T1614.001 → subtechnique-of → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--82909cab-8740-41fd-8ee5-09359d2dd571
ATTACK:enterprise:S0481 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93fdbd36-b577-44bd-b4db-6daadbef9cb2
FBI Ragnar Locker 2020ATTACK:enterprise:S1148 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c74284d-dfb7-49c5-85a1-fa8e63de53ad
S2W Racoon 2022ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d4c9cb8-d5fb-4679-8b38-fab55f237963
Socket GlassWorm January 2026ATTACK:enterprise:S0115 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f918c84-29ac-4769-ba94-6b46c8ccb950
Kaspersky Transparent Tribe August 2020ATTACK:enterprise:S1018 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a49fc7fd-5af0-4a2f-a2bb-f1d153e6b66d
Malwarebytes Saint Bot April 2021 · Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:S0632 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ac7a8c0c-bdbc-4ed5-91f9-b00212fe7189
Group IB GrimAgent July 2021ATTACK:enterprise:S1249 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ae152041-a294-499e-8f7b-4bc2b3722aba
Socket HexEval BeaverTail Contagious Interview June 2025ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--afb2acec-b781-4f8c-8268-d326d4f4f074
ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023ATTACK:enterprise:S9031 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b73877db-8456-4a79-85c0-1a02d74a0300
Palo Alto Ashen Lepus DEC 2025ATTACK:enterprise:S1025 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2c08481-c9ad-4929-b470-afd2df7233ed
BlackBerry Amadey 2020ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5d5ede1-2e34-4a3a-9328-a151bedff462
Fortinet Remcos Campaign NOV 2024ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e91aa008-ba7d-4dc0-96da-c2e60969e4da
CISA AA24-038A PRC Critical Infrastructure February 2024ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec5967b6-9b98-432f-a08d-6b04687a4290
Hunt.io TeamPCP Toolkit MAY 2026