{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1082","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"e2e6d6a9504fa12b8446413c94d350f58466ed5269eca86ffc43deeb42744c42","description":"An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from [Local Storage Discovery](https://attack.mitre.org/techniques/T1680) which is an adversary's discovery of local drive, disks and/or volumes.\n\nTools such as [Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather detailed system information. If running with privileged access, a breakdown of system data can be gathered through the <code>systemsetup</code> configuration tool on macOS. Adversaries may leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather detailed system information (e.g. <code>show version</code>).(Citation: US-CERT-TA18-106A) On ESXi servers, threat actors may gather system information from various esxcli utilities, such as `system hostname get` and `system version get`.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: Varonis)\n\nInfrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs. Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.(Citation: Amazon Describe Instance)(Citation: Google Instances Resource)(Citation: Microsoft Virutal Machine API)\n\n[System Information Discovery](https://attack.mitre.org/techniques/T1082) combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.(Citation: OSX.FairyTale)(Citation: 20 macOS Common Tools and Techniques) ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1082","external_id":"T1082"},{"source_name":"Amazon Describe Instance","description":"Amazon. (n.d.). describe-instance-information. Retrieved March 3, 2020.","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/describe-instance-information.html"},{"source_name":"Google Instances Resource","description":"Google. (n.d.). Rest Resource: instance. Retrieved March 3, 2020.","url":"https://cloud.google.com/compute/docs/reference/rest/v1/instances"},{"source_name":"Varonis","description":"Jason Hill. (2023, February 8). VMware ESXi in the Line of Ransomware Fire. Retrieved March 26, 2025.","url":"https://www.varonis.com/blog/vmware-esxi-in-the-line-of-ransomware-fire"},{"source_name":"Crowdstrike Hypervisor Jackpotting Pt 2 2021","description":"Michael Dawson. (2021, August 30). Hypervisor Jackpotting, Part 2: eCrime Actors Increase Targeting of ESXi Servers with Ransomware. Retrieved March 26, 2025.","url":"https://www.crowdstrike.com/en-us/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/"},{"source_name":"Microsoft Virutal Machine API","description":"Microsoft. (2019, March 1). Virtual Machines - Get. Retrieved October 8, 2019.","url":"https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/get"},{"source_name":"20 macOS Common Tools and Techniques","description":"Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.","url":"https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"},{"source_name":"OSX.FairyTale","description":"Phile Stokes. (2018, September 20). On the Trail of OSX.FairyTale | Adware Playing at Malware. Retrieved August 24, 2021.","url":"https://www.sentinelone.com/blog/trail-osx-fairytale-adware-playing-malware/"},{"source_name":"US-CERT-TA18-106A","description":"US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.","url":"https://www.us-cert.gov/ncas/alerts/TA18-106A"}],"platforms":["ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0075","name":"Instance Enumeration","page":"telemetry/DC0075/","kind":"attack_component","category":"Cloud control plane","description":"Listing or discovery requests for cloud compute instances.","collection_focus":"Include supported read management APIs and retain caller, scope, query/filter and result; read auditing differs between providers.","providers":[{"name":"AWS CloudTrail","scope":"Management-plane API activity; supported resource/data events require separate selectors.","source_id":"cloudtrail"},{"name":"Azure Monitor Activity Log","scope":"Azure resource control-plane operations; resource data-plane logs are separate.","source_id":"azure"},{"name":"Google Cloud Audit Logs","scope":"Admin Activity and other categories; configure Data Access where required.","source_id":"gcp"}],"configuration":["In the isolated account/project/subscription, route administrative audit logs to a protected destination with retention and access controls.","Select the relevant service, regions and read/write operations. Confirm whether the API below is a management or data event in the provider documentation.","Preserve actor/session, resource, request ID, service, operation, region and error details. Check delivery latency and avoid logging credentials or sensitive request bodies."],"configuration_example":null,"required_fields":["action","region","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0075","collector":"illustrative-lab-collector","observation":{"action":"list_instances","region":"lab-region","actor":"lab-reader","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"AWS, Azure and Google expose different APIs and event schemas. An accepted API request does not prove the final resource state; join asynchronous outcomes and inventory.","sources":[{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"ec2","title":"AWS EC2 API logging with CloudTrail","url":"https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/monitor-with-cloudtrail.html"},{"id":"azure","title":"Azure Monitor Activity Log","url":"https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log"},{"id":"gcp","title":"Google Cloud Audit Logs","url":"https://docs.cloud.google.com/logging/docs/audit"}],"association":"attack_component","anomaly_design":"Per account, role, region and API: rare actions, new role-resource relationships, enumeration bursts and configuration changes. Separate deployment automation and organization-level administrative activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","domain":"enterprise","platforms":["ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1082","technique_page":"techniques/enterprise/T1082/","page":"detections/enterprise/T1082/","status":"rule_source_available","counts":{"sigma":31,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":6,"live_validated":0},"sigma_rules":[{"id":"5259cbf2-0a75-48bf-b57a-c54d6fabaef3","title":"Bitbucket User Details Export Attempt Detected","status":"test","level":"medium","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."},"data_path":"data/detection-rules/5259cbf2-0a75-48bf-b57a-c54d6fabaef3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_user_details_export_attempt_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"87cc6698-3e07-4ba2-9b43-a85a73e151e2","title":"Bitbucket User Permissions Export Attempt","status":"test","level":"medium","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."},"data_path":"data/detection-rules/87cc6698-3e07-4ba2-9b43-a85a73e151e2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"f34047d9-20d3-4e8b-8672-0a35cc50dc71","title":"System Information Discovery - Auditd","status":"test","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/f34047d9-20d3-4e8b-8672-0a35cc50dc71.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/lnx_auditd_system_info_discovery.yml","author":"Pawel Mazur","kind":"sigma"},{"id":"1f358e2e-cb63-43c3-b575-dfb072a6814f","title":"System and Hardware Information Discovery","status":"stable","level":"informational","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/1f358e2e-cb63-43c3-b575-dfb072a6814f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/path/lnx_auditd_system_info_discovery2.yml","author":"Ömer Günal, oscd.community","kind":"sigma"},{"id":"b207d563-a1d9-4275-b349-77d1eb55aa6d","title":"System Info Discovery via Sysinfo Syscall","status":"experimental","level":"low","logsource":{"product":"linux","service":"auditd","definition":"Required auditd configuration:\n-a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall\n-a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall\n"},"data_path":"data/detection-rules/b207d563-a1d9-4275-b349-77d1eb55aa6d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml","author":"Milad Cheraghi","kind":"sigma"},{"id":"d27ab432-2199-483f-a297-03633c05bae6","title":"OS Architecture Discovery Via Grep","status":"test","level":"low","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/d27ab432-2199-483f-a297-03633c05bae6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_grep_os_arch_discovery.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"e34cfa0c-0a50-4210-9cb3-5632d08eb041","title":"Potential GobRAT File Discovery Via Grep","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/e34cfa0c-0a50-4210-9cb3-5632d08eb041.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"746c86fb-ccda-4816-8997-01386263acc4","title":"Container Residence Discovery Via Proc Virtual FS","status":"test","level":"low","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/746c86fb-ccda-4816-8997-01386263acc4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml","author":"Seth Hanford","kind":"sigma"},{"id":"11701de9-d5a5-44aa-8238-84252f131895","title":"Docker Container Discovery Via Dockerenv Listing","status":"test","level":"low","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/11701de9-d5a5-44aa-8238-84252f131895.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_dockerenv_recon.yml","author":"Seth Hanford","kind":"sigma"},{"id":"43e26eb5-cd58-48d1-8ce9-a273f5d298d8","title":"Potential Container Discovery Via Inodes Listing","status":"test","level":"low","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/43e26eb5-cd58-48d1-8ce9-a273f5d298d8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml","author":"Seth Hanford","kind":"sigma"},{"id":"42df45e7-e6e9-43b5-8f26-bec5b39cc239","title":"System Information Discovery","status":"stable","level":"informational","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/42df45e7-e6e9-43b5-8f26-bec5b39cc239.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_system_info_discovery.yml","author":"Ömer Günal, oscd.community","kind":"sigma"},{"id":"2d5e7a8b-f484-4a24-945d-7f0efd52eab0","title":"System Information Discovery Using Ioreg","status":"test","level":"medium","logsource":{"product":"macos","category":"process_creation"},"data_path":"data/detection-rules/2d5e7a8b-f484-4a24-945d-7f0efd52eab0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"5de06a6f-673a-4fc0-8d48-bcfe3837b033","title":"System Information Discovery Using sw_vers","status":"test","level":"medium","logsource":{"product":"macos","category":"process_creation"},"data_path":"data/detection-rules/5de06a6f-673a-4fc0-8d48-bcfe3837b033.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_swvers_discovery.yml","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","kind":"sigma"},{"id":"6ff08e55-ea53-4f27-94a1-eff92e6d9d5c","title":"System Information Discovery Via Sysctl - MacOS","status":"test","level":"medium","logsource":{"product":"macos","category":"process_creation"},"data_path":"data/detection-rules/6ff08e55-ea53-4f27-94a1-eff92e6d9d5c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_sysctl_discovery.yml","author":"Pratinav Chandra","kind":"sigma"},{"id":"4809c683-059b-4935-879d-36835986f8cf","title":"System Information Discovery Using System_Profiler","status":"test","level":"medium","logsource":{"product":"macos","category":"process_creation"},"data_path":"data/detection-rules/4809c683-059b-4935-879d-36835986f8cf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml","author":"Stephen Lincoln `@slincoln_aiq` (AttackIQ)","kind":"sigma"},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","status":"test","level":"low","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/9705a6a1-6db6-4a16-a987-15b7151e299b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_discovery.yml","author":"Austin Clark","kind":"sigma"},{"id":"851fd622-b675-4d26-b803-14bc7baa517a","title":"HackTool - WinPwn Execution - ScriptBlock","status":"test","level":"high","logsource":{"category":"ps_script","product":"windows","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/851fd622-b675-4d26-b803-14bc7baa517a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"0022869c-49f7-4ff2-ba03-85ac42ddac58","title":"System Information Discovery via Registry Queries","status":"experimental","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0022869c-49f7-4ff2-ba03-85ac42ddac58.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml","author":"lazarg","kind":"sigma"},{"id":"7124aebe-4cd7-4ccb-8df0-6d6b93c96795","title":"Suspicious Kernel Dump Using Dtrace","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/7124aebe-4cd7-4ccb-8df0-6d6b93c96795.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"fca949cc-79ca-446e-8064-01aa7e52ece5","title":"HackTool - PCHunter Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fca949cc-79ca-446e-8064-01aa7e52ece5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","kind":"sigma"},{"id":"98b53e78-ebaf-46f8-be06-421aafd176d9","title":"HackTool - winPEAS Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/98b53e78-ebaf-46f8-be06-421aafd176d9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_winpeas.yml","author":"Georg Lauenstein (sure[secure])","kind":"sigma"},{"id":"d557dc06-62e8-4468-a8e8-7984124908ce","title":"HackTool - WinPwn Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/d557dc06-62e8-4468-a8e8-7984124908ce.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_winpwn.yml","author":"Swachchhanda Shrawan Poudel","kind":"sigma"},{"id":"7be5fb68-f9ef-476d-8b51-0256ebece19e","title":"Suspicious Execution of Hostname","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7be5fb68-f9ef-476d-8b51-0256ebece19e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hostname_execution.yml","author":"frack113","kind":"sigma"},{"id":"e6313acd-208c-44fc-a0ff-db85d572e90e","title":"Network Reconnaissance Activity","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e6313acd-208c-44fc-a0ff-db85d572e90e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_nslookup_domain_discovery.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"5722dff1-4bdd-4949-86ab-fbaf707e767a","title":"PUA - System Informer Execution","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5722dff1-4bdd-4949-86ab-fbaf707e767a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_system_informer.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"f5240972-3938-4e56-8e4b-e33893176c1f","title":"Suspicious Query of MachineGUID","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/f5240972-3938-4e56-8e4b-e33893176c1f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_reg_machineguid.yml","author":"frack113","kind":"sigma"},{"id":"c2c76b77-32be-4d1f-82c9-7e544bdfe0eb","title":"Potential Suspicious Activity Using SeCEdit","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c2c76b77-32be-4d1f-82c9-7e544bdfe0eb.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_secedit_execution.yml","author":"Janantha Marasinghe","kind":"sigma"},{"id":"0ef56343-059e-4cb6-adc1-4c3c967c5e46","title":"Suspicious Execution of Systeminfo","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0ef56343-059e-4cb6-adc1-4c3c967c5e46.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_systeminfo_execution.yml","author":"frack113","kind":"sigma"},{"id":"e568650b-5dcd-4658-8f34-ded0b1e13992","title":"Potential Product Class Reconnaissance Via Wmic.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/e568650b-5dcd-4658-8f34-ded0b1e13992.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_recon_product_class.yml","author":"Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"9d5a1274-922a-49d0-87f3-8c653483b909","title":"Uncommon System Information Discovery Via Wmic.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/9d5a1274-922a-49d0-87f3-8c653483b909.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon.yml","author":"TropChaud","kind":"sigma"},{"id":"c79da740-5030-45ec-a2e0-479e824a562c","title":"System Disk And Volume Reconnaissance Via Wmic.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c79da740-5030-45ec-a2e0-479e824a562c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmic_recon_volume.yml","author":"Stephen Lincoln '@slincoln-aiq' (AttackIQ)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0525","name":"System Discovery via Native and Remote Utilities","url":"https://attack.mitre.org/detectionstrategies/DET0525","stix_id":"x-mitre-detection-strategy--75161d5e-2b6d-4112-ab4d-338f70ea97f0","relationship_id":"relationship--baaaccfe-3c16-4d6b-8b67-279d74ee8da4","description":"","analytics":[{"id":"AN1452","name":"Analytic 1452","guidance":"Detection of processes executing system environment inspection operations followed by access to OS configuration APIs or registry locations that expose OS version, architecture, patch level, or hardware characteristics. Defenders observe process execution retrieving system configuration metadata immediately after process startup.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1452","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Detect multiple discovery commands executed in short succession."},{"field":"UserContext","description":"Scope alerts to unusual user accounts or service accounts."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1452","source_url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1452","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0064","component":"Command Execution","name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","platforms":["Windows"],"analytic_id":"AN1452","source_url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1452","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN1452","source_url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1452","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN1452","source_url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1452","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"}]},{"id":"AN1453","name":"Analytic 1453","guidance":"Execution of system enumeration commands such as `uname`, `df`, `uptime`, `hostname`, `lscpu`, and `cat /etc/os-release` through local terminal or scripts.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1453","platforms":["Linux"],"tuning":[{"field":"CommandList","description":"Customize list of commands of interest (e.g., uname, lscpu, etc.)"},{"field":"TerminalSessionID","description":"Correlate sessions for behavior context."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1453","source_url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1453","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1454","name":"Analytic 1454","guidance":"Execution of system info utilities like `systemsetup`, `sw_vers`, `uname`, or `sysctl` by terminal or scripted processes.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1454","platforms":["macOS"],"tuning":[{"field":"ParentProcess","description":"Determine if script or terminal executed the command."},{"field":"FrequencyThreshold","description":"Number of discovery commands in a short window."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"log show --predicate 'process == <utility>'","platforms":["macOS"],"analytic_id":"AN1454","source_url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1454","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1455","name":"Analytic 1455","guidance":"Execution of `esxcli system hostname get`, `esxcli system version get`, or `esxcli hardware` commands through SSH or local shell.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1455","platforms":["ESXi"],"tuning":[{"field":"SessionOrigin","description":"Track SSH or console-based entry points."},{"field":"CommandString","description":"Customize detection for expected CLI queries."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:vmkernel","channel":"/var/log/vmkernel.log","platforms":["ESXi"],"analytic_id":"AN1455","source_url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1455","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]},{"id":"AN1456","name":"Analytic 1456","guidance":"Use of cloud API calls (e.g., AWS EC2 DescribeInstances, Azure VM Inventory) to enumerate system configurations across assets.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1456","platforms":["IaaS"],"tuning":[{"field":"IAMRoleContext","description":"Limit detection to non-standard identities performing these calls."},{"field":"APIFrequency","description":"Identify enumeration sweeps by volume."}],"log_sources":[{"component_id":"DC0075","component":"Instance Enumeration","name":"AWS:CloudTrail","channel":"DescribeInstances, GetConsoleOutput, DescribeImages","platforms":["IaaS"],"analytic_id":"AN1456","source_url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1456","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0075/"}]},{"id":"AN1457","name":"Analytic 1457","guidance":"Execution of `show version`, `show hardware`, or `show system` commands through CLI via SSH or console.","url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1457","platforms":["Network Devices"],"tuning":[{"field":"Username","description":"Highlight unexpected users issuing diagnostic commands."},{"field":"CommandList","description":"Tailor to vendor-specific command syntax."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:syslog","channel":"Privilege-level command execution","platforms":["Network Devices"],"analytic_id":"AN1457","source_url":"https://attack.mitre.org/detectionstrategies/DET0525#AN1457","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0075","name":"Instance Enumeration","tag":"Instance Enumeration","page":"telemetry/DC0075/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0106","name":"cmd","page":"tools/S0106/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1155","name":"Covenant","page":"tools/S1155/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9002","name":"Diskpart","page":"tools/S9002/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0105","name":"dsquery","page":"tools/S0105/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0096","name":"Systeminfo","page":"tools/S0096/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0106","name":"cmd","page":"tools/S0106/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1155","name":"Covenant","page":"tools/S1155/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9002","name":"Diskpart","page":"tools/S9002/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0105","name":"dsquery","page":"tools/S0105/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0262","name":"QuasarRAT","page":"tools/S0262/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0445","name":"ShimRatReporter","page":"tools/S0445/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0096","name":"Systeminfo","page":"tools/S0096/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) has collected system information including OS version, processor information, RAM size, location, host name, IP, and screen size of the infected host.(Citation: Eset PlugX Korplug Mustang Panda March 2022)","relationship_id":"relationship--8282f068-c2d3-4673-b683-7fbd3a59f38e","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}]},{"id":"S0015","name":"Ixeshe","url":"https://attack.mitre.org/software/S0015","kind":"malware","description":"[Ixeshe](https://attack.mitre.org/software/S0015) collects the computer name of the victim's system during the initial infection.(Citation: Trend Micro IXESHE 2012)","relationship_id":"relationship--5eb5ee0e-d186-40d3-a433-9562f85fdf6b","references":[{"source_name":"Trend Micro IXESHE 2012","description":"Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}]},{"id":"S0017","name":"BISCUIT","url":"https://attack.mitre.org/software/S0017","kind":"malware","description":"[BISCUIT](https://attack.mitre.org/software/S0017) has a command to collect the processor type, operation system, computer name, and whether the system is a laptop or PC.(Citation: Mandiant APT1)","relationship_id":"relationship--6a008820-b742-4ec0-ad56-7494ca911da7","references":[{"source_name":"Mandiant APT1","description":"Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"id":"S0021","name":"Derusbi","url":"https://attack.mitre.org/software/S0021","kind":"malware","description":"[Derusbi](https://attack.mitre.org/software/S0021) gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.(Citation: Fidelis Turbo)","relationship_id":"relationship--5d2ca571-9e66-4949-b3a1-978c47398b18","references":[{"source_name":"Fidelis Turbo","description":"Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"}]},{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) has the ability to gather basic system information and run the POSIX API `gethostbyname`.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--a0e4dc2c-1977-4c4c-a5ee-4710fb3ef1a5","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0024","name":"Dyre","url":"https://attack.mitre.org/software/S0024","kind":"malware","description":"[Dyre](https://attack.mitre.org/software/S0024) has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.(Citation: Malwarebytes Dyreza November 2015)","relationship_id":"relationship--c1a4334d-8975-4ca2-8734-d6c26e36702a","references":[{"source_name":"Malwarebytes Dyreza November 2015","description":"hasherezade. (2015, November 4). A Technical Look At Dyreza. Retrieved June 15, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/a-technical-look-at-dyreza/"}]},{"id":"S0031","name":"BACKSPACE","url":"https://attack.mitre.org/software/S0031","kind":"malware","description":"During its initial execution, [BACKSPACE](https://attack.mitre.org/software/S0031) extracts operating system information from the infected host.(Citation: FireEye APT30)","relationship_id":"relationship--16cb7ede-b431-4711-bcb1-91bc925663e5","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0032","name":"gh0st RAT","url":"https://attack.mitre.org/software/S0032","kind":"malware","description":"[gh0st RAT](https://attack.mitre.org/software/S0032) has gathered system architecture, processor, OS configuration, and installed hardware information.(Citation: Gh0stRAT ATT March 2019)","relationship_id":"relationship--aee29ae1-4544-4fc8-b30b-4717888991ca","references":[{"source_name":"Gh0stRAT ATT March 2019","description":"Quinn, J. (2019, March 25). The odd case of a Gh0stRAT variant. Retrieved July 15, 2020.","url":"https://cybersecurity.att.com/blogs/labs-research/the-odd-case-of-a-gh0strat-variant"}]},{"id":"S0043","name":"BUBBLEWRAP","url":"https://attack.mitre.org/software/S0043","kind":"malware","description":"[BUBBLEWRAP](https://attack.mitre.org/software/S0043) collects system information, including the operating system version and hostname.(Citation: FireEye admin@338)","relationship_id":"relationship--ea4c3651-b2a3-418e-8d3b-3c8075b988ef","references":[{"source_name":"FireEye admin@338","description":"FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"id":"S0045","name":"ADVSTORESHELL","url":"https://attack.mitre.org/software/S0045","kind":"malware","description":"[ADVSTORESHELL](https://attack.mitre.org/software/S0045) can run [Systeminfo](https://attack.mitre.org/software/S0096) to gather information about the victim.(Citation: ESET Sednit Part 2)(Citation: Bitdefender APT28 Dec 2015)","relationship_id":"relationship--090a553a-b863-4214-aa3b-cf8ea7ba2d68","references":[{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"},{"source_name":"Bitdefender APT28 Dec 2015","description":"Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"}]},{"id":"S0046","name":"CozyCar","url":"https://attack.mitre.org/software/S0046","kind":"malware","description":"A system info module in [CozyCar](https://attack.mitre.org/software/S0046) gathers information on the victim host’s configuration.(Citation: F-Secure CozyDuke)","relationship_id":"relationship--166c430d-0272-4dca-8d30-318cda0a0a63","references":[{"source_name":"F-Secure CozyDuke","description":"F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015.","url":"https://www.f-secure.com/documents/996508/1030745/CozyDuke"}]},{"id":"S0048","name":"PinchDuke","url":"https://attack.mitre.org/software/S0048","kind":"malware","description":"[PinchDuke](https://attack.mitre.org/software/S0048) gathers system configuration information.(Citation: F-Secure The Dukes)","relationship_id":"relationship--7b29c94f-1834-42ac-933c-ae6cd125e87a","references":[{"source_name":"F-Secure The Dukes","description":"F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}]},{"id":"S0051","name":"MiniDuke","url":"https://attack.mitre.org/software/S0051","kind":"malware","description":"[MiniDuke](https://attack.mitre.org/software/S0051) can gather the hostname on a compromised machine.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--30e6bb1e-7c6a-4fff-8163-f5a065d2d960","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0058","name":"SslMM","url":"https://attack.mitre.org/software/S0058","kind":"malware","description":"[SslMM](https://attack.mitre.org/software/S0058) sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--fbfc610a-5355-40fc-b5a1-059e89a1eb8d","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0059","name":"WinMM","url":"https://attack.mitre.org/software/S0059","kind":"malware","description":"[WinMM](https://attack.mitre.org/software/S0059) collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--2e367a09-1d94-4ea4-984c-a592b769fffa","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0060","name":"Sys10","url":"https://attack.mitre.org/software/S0060","kind":"malware","description":"[Sys10](https://attack.mitre.org/software/S0060) collects the computer name, OS versioning information, and OS install date and sends the information to the C2.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--550bf43e-53da-467e-affd-9f44ad668508","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0062","name":"DustySky","url":"https://attack.mitre.org/software/S0062","kind":"malware","description":"[DustySky](https://attack.mitre.org/software/S0062) extracts basic information about the operating system.(Citation: DustySky)","relationship_id":"relationship--c008b7f3-0507-4987-a7e4-8c4d57cb4ca5","references":[{"source_name":"DustySky","description":"ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"}]},{"id":"S0065","name":"4H RAT","url":"https://attack.mitre.org/software/S0065","kind":"malware","description":"[4H RAT](https://attack.mitre.org/software/S0065) sends an OS version identifier in its beacons.(Citation: CrowdStrike Putter Panda)","relationship_id":"relationship--27375058-3002-4fc2-a964-a1e336a10a2a","references":[{"source_name":"CrowdStrike Putter Panda","description":"Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.","url":"http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"}]},{"id":"S0079","name":"MobileOrder","url":"https://attack.mitre.org/software/S0079","kind":"malware","description":"[MobileOrder](https://attack.mitre.org/software/S0079) has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.(Citation: Scarlet Mimic Jan 2016)","relationship_id":"relationship--a02da835-676d-47df-86c6-547a7d29dbae","references":[{"source_name":"Scarlet Mimic Jan 2016","description":"Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}]},{"id":"S0081","name":"Elise","url":"https://attack.mitre.org/software/S0081","kind":"malware","description":"[Elise](https://attack.mitre.org/software/S0081) executes <code>systeminfo</code> after initial communication is made to the remote server.(Citation: Lotus Blossom Jun 2015)","relationship_id":"relationship--14135aaa-6080-48c1-8a08-d6ee9bb15c3d","references":[{"source_name":"Lotus Blossom Jun 2015","description":"Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.","url":"https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"}]},{"id":"S0082","name":"Emissary","url":"https://attack.mitre.org/software/S0082","kind":"malware","description":"[Emissary](https://attack.mitre.org/software/S0082) has the capability to execute ver and systeminfo commands.(Citation: Emissary Trojan Feb 2016)","relationship_id":"relationship--4a959425-4d43-4969-9a47-768894a3afaa","references":[{"source_name":"Emissary Trojan Feb 2016","description":"Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/"}]},{"id":"S0083","name":"Misdat","url":"https://attack.mitre.org/software/S0083","kind":"malware","description":"The initial beacon packet for [Misdat](https://attack.mitre.org/software/S0083) contains the operating system version of the victim.(Citation: Cylance Dust Storm)","relationship_id":"relationship--87e080cf-b8c0-4679-bcfb-ff77ab7698f3","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0084","name":"Mis-Type","url":"https://attack.mitre.org/software/S0084","kind":"malware","description":"The initial beacon packet for [Mis-Type](https://attack.mitre.org/software/S0084) contains the operating system version and file system of the victim.(Citation: Cylance Dust Storm)","relationship_id":"relationship--aeda6707-50e2-47e2-833a-18e4a5d73e88","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0085","name":"S-Type","url":"https://attack.mitre.org/software/S0085","kind":"malware","description":"The initial beacon packet for [S-Type](https://attack.mitre.org/software/S0085) contains the operating system version and file system of the victim.(Citation: Cylance Dust Storm)","relationship_id":"relationship--7fbb56bf-cadd-4663-8067-f233d4c9c751","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0086","name":"ZLib","url":"https://attack.mitre.org/software/S0086","kind":"malware","description":"[ZLib](https://attack.mitre.org/software/S0086) has the ability to enumerate system information.(Citation: Cylance Dust Storm)","relationship_id":"relationship--3126c7fa-02eb-475f-a474-26d4d6af7a67","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0088","name":"Kasidet","url":"https://attack.mitre.org/software/S0088","kind":"malware","description":"[Kasidet](https://attack.mitre.org/software/S0088) has the ability to obtain a victim's system name and operating system version.(Citation: Zscaler Kasidet)","relationship_id":"relationship--49af09c8-1460-485d-9f09-dacea47fa016","references":[{"source_name":"Zscaler Kasidet","description":"Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.","url":"http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html"}]},{"id":"S0089","name":"BlackEnergy","url":"https://attack.mitre.org/software/S0089","kind":"malware","description":"[BlackEnergy](https://attack.mitre.org/software/S0089) has used [Systeminfo](https://attack.mitre.org/software/S0096) to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.(Citation: F-Secure BlackEnergy 2014)(Citation: Securelist BlackEnergy Nov 2014)","relationship_id":"relationship--efa98949-4b58-4407-8fa2-366c06dc2ed9","references":[{"source_name":"F-Secure BlackEnergy 2014","description":"F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.","url":"https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"},{"source_name":"Securelist BlackEnergy Nov 2014","description":"Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"}]},{"id":"S0091","name":"Epic","url":"https://attack.mitre.org/software/S0091","kind":"malware","description":"[Epic](https://attack.mitre.org/software/S0091) collects the OS version, hardware information, computer name, available system memory status, and system and user language settings.(Citation: Kaspersky Turla Aug 2014)","relationship_id":"relationship--66b026b6-af1e-47a6-9c3d-b853e2130b68","references":[{"source_name":"Kaspersky Turla Aug 2014","description":"Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080105/KL_Epic_Turla_Technical_Appendix_20140806.pdf"}]},{"id":"S0093","name":"Backdoor.Oldrea","url":"https://attack.mitre.org/software/S0093","kind":"malware","description":"[Backdoor.Oldrea](https://attack.mitre.org/software/S0093) collects information about the OS and computer name.(Citation: Symantec Dragonfly)(Citation: Gigamon Berserk Bear October 2021)","relationship_id":"relationship--f19234f6-5b59-4229-aae1-70df380a076a","references":[{"source_name":"Symantec Dragonfly","description":"Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"},{"source_name":"Gigamon Berserk Bear October 2021","description":"Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"id":"S0094","name":"Trojan.Karagany","url":"https://attack.mitre.org/software/S0094","kind":"malware","description":"[Trojan.Karagany](https://attack.mitre.org/software/S0094) can capture information regarding the victim's OS, security, and hardware configuration.(Citation: Secureworks Karagany July 2019)","relationship_id":"relationship--5a415555-1367-47dd-9757-88a86430cf49","references":[{"source_name":"Secureworks Karagany July 2019","description":"Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}]},{"id":"S0096","name":"Systeminfo","url":"https://attack.mitre.org/software/S0096","kind":"tool","description":"[Systeminfo](https://attack.mitre.org/software/S0096) can be used to gather information about the operating system.(Citation: TechNet Systeminfo)","relationship_id":"relationship--c088f23e-b741-453c-a710-01990dead853","references":[{"source_name":"TechNet Systeminfo","description":"Microsoft. (n.d.). Systeminfo. Retrieved April 8, 2016.","url":"https://technet.microsoft.com/en-us/library/bb491007.aspx"}]},{"id":"S0098","name":"T9000","url":"https://attack.mitre.org/software/S0098","kind":"malware","description":"[T9000](https://attack.mitre.org/software/S0098) gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.(Citation: Palo Alto T9000 Feb 2016)","relationship_id":"relationship--487d67d7-b697-4de4-abde-decee8b17c44","references":[{"source_name":"Palo Alto T9000 Feb 2016","description":"Grunzweig, J. and Miller-Osborn, J.. (2016, February 4). T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques. Retrieved April 15, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/"}]},{"id":"S0105","name":"dsquery","url":"https://attack.mitre.org/software/S0105","kind":"tool","description":"[dsquery](https://attack.mitre.org/software/S0105) has the ability to enumerate various information, such as the operating system and host name, for systems within a domain.(Citation: Mandiant APT41)","relationship_id":"relationship--f9c5fdd4-4978-433f-a718-f8f512e13cac","references":[{"source_name":"Mandiant APT41","description":"Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}]},{"id":"S0106","name":"cmd","url":"https://attack.mitre.org/software/S0106","kind":"tool","description":"[cmd](https://attack.mitre.org/software/S0106) can be used to find information about the operating system.(Citation: TechNet Dir)","relationship_id":"relationship--745106bb-3641-488e-ae1c-547cd6ea9b7a","references":[{"source_name":"TechNet Dir","description":"Microsoft. (n.d.). Dir. Retrieved April 18, 2016.","url":"https://technet.microsoft.com/en-us/library/cc755121.aspx"}]},{"id":"S0113","name":"Prikormka","url":"https://attack.mitre.org/software/S0113","kind":"malware","description":"A module in [Prikormka](https://attack.mitre.org/software/S0113) collects information from the victim about Windows OS version, computer name, battery info, and physical memory.(Citation: ESET Operation Groundbait)","relationship_id":"relationship--7adaf2f3-52f2-40aa-b1ae-2fd2f05d9d56","references":[{"source_name":"ESET Operation Groundbait","description":"Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) contains a command to collect the victim PC name and operating system.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)","relationship_id":"relationship--4caf9f0d-dfe9-48ce-9b6e-812577e09711","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","description":"Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","description":"N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}]},{"id":"S0124","name":"Pisloader","url":"https://attack.mitre.org/software/S0124","kind":"malware","description":"[Pisloader](https://attack.mitre.org/software/S0124) has a command to collect victim system information, including the system name and OS version.(Citation: Palo Alto DNS Requests)","relationship_id":"relationship--ed2e17b5-171b-4878-a3ab-2b70e8ca132a","references":[{"source_name":"Palo Alto DNS Requests","description":"Grunzweig, J., et al. (2016, May 24). New Wekby Attacks Use DNS Requests As Command and Control Mechanism. Retrieved August 17, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]},{"id":"S0125","name":"Remsec","url":"https://attack.mitre.org/software/S0125","kind":"malware","description":"[Remsec](https://attack.mitre.org/software/S0125) can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.(Citation: Kaspersky ProjectSauron Technical Analysis)","relationship_id":"relationship--9b36e877-e637-46b8-bdf1-def74c977472","references":[{"source_name":"Kaspersky ProjectSauron Technical Analysis","description":"Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}]},{"id":"S0130","name":"Unknown Logger","url":"https://attack.mitre.org/software/S0130","kind":"malware","description":"[Unknown Logger](https://attack.mitre.org/software/S0130) can obtain information about the victim computer name, physical memory, country, and date.(Citation: Forcepoint Monsoon)","relationship_id":"relationship--02206f22-80e9-4f87-9e4b-5c1df1eb737e","references":[{"source_name":"Forcepoint Monsoon","description":"Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}]},{"id":"S0137","name":"CORESHELL","url":"https://attack.mitre.org/software/S0137","kind":"malware","description":"[CORESHELL](https://attack.mitre.org/software/S0137) collects hostname and OS version data from the victim and sends the information to its C2 server.(Citation: FireEye APT28)","relationship_id":"relationship--5301c007-7c00-4b4d-b355-864db8de052f","references":[{"source_name":"FireEye APT28","description":"FireEye. (2015). APT28: A WINDOW INTO RUSSIA’S CYBER ESPIONAGE OPERATIONS?. Retrieved August 19, 2015.","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}]},{"id":"S0139","name":"PowerDuke","url":"https://attack.mitre.org/software/S0139","kind":"malware","description":"[PowerDuke](https://attack.mitre.org/software/S0139) has commands to get information about the victim's name, build, version, serial number, and memory usage.(Citation: Volexity PowerDuke November 2016)","relationship_id":"relationship--1fda6ff7-a344-4bc3-b545-4083cc15290d","references":[{"source_name":"Volexity PowerDuke November 2016","description":"Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.","url":"https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"}]},{"id":"S0140","name":"Shamoon","url":"https://attack.mitre.org/software/S0140","kind":"malware","description":"[Shamoon](https://attack.mitre.org/software/S0140) obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Unit 42 Shamoon3 2018)","relationship_id":"relationship--272068a3-47e3-42d6-8772-71d39c1976c3","references":[{"source_name":"Palo Alto Shamoon Nov 2016","description":"Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/"},{"source_name":"Unit 42 Shamoon3 2018","description":"Falcone, R. (2018, December 13). Shamoon 3 Targets Oil and Gas Organization. Retrieved March 14, 2019.","url":"https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/"}]},{"id":"S0141","name":"Winnti for Windows","url":"https://attack.mitre.org/software/S0141","kind":"malware","description":"[Winnti for Windows](https://attack.mitre.org/software/S0141) can determine if the OS on a compromised host is newer than Windows XP.(Citation: Novetta Winnti April 2015)","relationship_id":"relationship--905c6670-b81e-40c1-b84d-8359ffc2dcc1","references":[{"source_name":"Novetta Winnti April 2015","description":"Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}]},{"id":"S0142","name":"StreamEx","url":"https://attack.mitre.org/software/S0142","kind":"malware","description":"[StreamEx](https://attack.mitre.org/software/S0142) has the ability to enumerate system information.(Citation: Cylance Shell Crew Feb 2017)","relationship_id":"relationship--788ca56e-1194-4c5f-a12b-72678390f1ef","references":[{"source_name":"Cylance Shell Crew Feb 2017","description":"Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.","url":"https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"}]},{"id":"S0144","name":"ChChes","url":"https://attack.mitre.org/software/S0144","kind":"malware","description":"[ChChes](https://attack.mitre.org/software/S0144) collects the victim hostname, window resolution, and Microsoft Windows version.(Citation: Palo Alto menuPass Feb 2017)(Citation: PWC Cloud Hopper Technical Annex April 2017)","relationship_id":"relationship--a08dadbf-6f68-415f-9daa-f84571af83a2","references":[{"source_name":"Palo Alto menuPass Feb 2017","description":"Miller-Osborn, J. and Grunzweig, J.. (2017, February 16). menuPass Returns with New Malware and New Attacks Against Japanese Academics and Organizations. Retrieved March 1, 2017.","url":"http://researchcenter.paloaltonetworks.com/2017/02/unit42-menupass-returns-new-malware-new-attacks-japanese-academics-organizations/"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","description":"PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) can obtain the computer name, OS version, and default language identifier.(Citation: ESET RTM Feb 2017)","relationship_id":"relationship--c6606ced-4641-451f-ac2a-493b1d15d0aa","references":[{"source_name":"ESET RTM Feb 2017","description":"Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}]},{"id":"S0149","name":"MoonWind","url":"https://attack.mitre.org/software/S0149","kind":"malware","description":"[MoonWind](https://attack.mitre.org/software/S0149) can obtain the victim hostname, Windows version, RAM amount, and screen resolution.(Citation: Palo Alto MoonWind March 2017)","relationship_id":"relationship--72fe5021-bace-41e4-9cc6-73af415225ac","references":[{"source_name":"Palo Alto MoonWind March 2017","description":"Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}]},{"id":"S0151","name":"HALFBAKED","url":"https://attack.mitre.org/software/S0151","kind":"malware","description":"[HALFBAKED](https://attack.mitre.org/software/S0151) can obtain information about the OS, processor, and BIOS.(Citation: FireEye FIN7 April 2017)","relationship_id":"relationship--d6154157-fe69-4da3-8cc3-790eecf33f8c","references":[{"source_name":"FireEye FIN7 April 2017","description":"Carr, N., et al. (2017, April 24). FIN7 Evolution and the Phishing LNK. Retrieved April 24, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"}]},{"id":"S0153","name":"RedLeaves","url":"https://attack.mitre.org/software/S0153","kind":"malware","description":"[RedLeaves](https://attack.mitre.org/software/S0153) can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Accenture Hogfish April 2018)","relationship_id":"relationship--a8f11c39-df96-451e-a93a-417512f82819","references":[{"source_name":"Accenture Hogfish April 2018","description":"Accenture Security. (2018, April 23). Hogfish Redleaves Campaign. Retrieved July 2, 2018.","url":"http://web.archive.org/web/20220810112638/https:/www.accenture.com/t20180423T055005Z_w_/se-en/_acnmedia/PDF-76/Accenture-Hogfish-Threat-Analysis.pdf"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","description":"PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"id":"S0155","name":"WINDSHIELD","url":"https://attack.mitre.org/software/S0155","kind":"malware","description":"[WINDSHIELD](https://attack.mitre.org/software/S0155) can gather the victim computer name.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--73fe447a-8d70-433f-be9a-5af74934a662","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"S0156","name":"KOMPROGO","url":"https://attack.mitre.org/software/S0156","kind":"malware","description":"[KOMPROGO](https://attack.mitre.org/software/S0156) is capable of retrieving information about the infected system.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--42dc03ec-03fb-4bf0-8f5f-e90d1aacd6e7","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"S0157","name":"SOUNDBITE","url":"https://attack.mitre.org/software/S0157","kind":"malware","description":"[SOUNDBITE](https://attack.mitre.org/software/S0157) is capable of gathering system information.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--5c4e0ddb-57a1-440f-82ab-146847c99be8","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"S0161","name":"XAgentOSX","url":"https://attack.mitre.org/software/S0161","kind":"malware","description":"[XAgentOSX](https://attack.mitre.org/software/S0161) contains the getInstalledAPP function to run <code>ls -la /Applications</code> to gather what applications are installed.(Citation: XAgentOSX 2017)","relationship_id":"relationship--ec362b37-1a64-4b28-8d34-7819d0aa5b2a","references":[{"source_name":"XAgentOSX 2017","description":"Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"}]},{"id":"S0165","name":"OSInfo","url":"https://attack.mitre.org/software/S0165","kind":"malware","description":"[OSInfo](https://attack.mitre.org/software/S0165) discovers information about the infected machine.(Citation: Symantec Buckeye)","relationship_id":"relationship--7507eb37-407e-4428-b29f-da0bda3f7970","references":[{"source_name":"Symantec Buckeye","description":"Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"id":"S0171","name":"Felismus","url":"https://attack.mitre.org/software/S0171","kind":"malware","description":"[Felismus](https://attack.mitre.org/software/S0171) collects the system information, including hostname and OS version, and sends it to the C2 server.(Citation: Forcepoint Felismus Mar 2017)","relationship_id":"relationship--9f653750-2ee6-4d00-906b-c71f1d217288","references":[{"source_name":"Forcepoint Felismus Mar 2017","description":"Somerville, L. and Toro, A. (2017, March 30). Playing Cat & Mouse: Introducing the Felismus Malware. Retrieved November 16, 2017.","url":"https://blogs.forcepoint.com/security-labs/playing-cat-mouse-introducing-felismus-malware"}]},{"id":"S0172","name":"Reaver","url":"https://attack.mitre.org/software/S0172","kind":"malware","description":"[Reaver](https://attack.mitre.org/software/S0172) collects system information from the victim, including CPU speed, computer name, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.(Citation: Palo Alto Reaver Nov 2017)","relationship_id":"relationship--edbd751e-29ad-419f-a3ff-9d210453351d","references":[{"source_name":"Palo Alto Reaver Nov 2017","description":"Grunzweig, J. and Miller-Osborn, J. (2017, November 10). New Malware with Ties to SunOrcal Discovered. Retrieved November 16, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-new-malware-with-ties-to-sunorcal-discovered/"}]},{"id":"S0176","name":"Wingbird","url":"https://attack.mitre.org/software/S0176","kind":"malware","description":"[Wingbird](https://attack.mitre.org/software/S0176) checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.(Citation: Microsoft SIR Vol 21)","relationship_id":"relationship--fe786b29-e621-48e2-84b5-aed35e6930fe","references":[{"source_name":"Microsoft SIR Vol 21","description":"Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.","url":"http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"}]},{"id":"S0180","name":"Volgmer","url":"https://attack.mitre.org/software/S0180","kind":"malware","description":"[Volgmer](https://attack.mitre.org/software/S0180) can gather system information, the computer name, OS version, drive and serial information from the victim's machine.(Citation: US-CERT Volgmer Nov 2017)(Citation: US-CERT Volgmer 2 Nov 2017)(Citation: Symantec Volgmer Aug 2014)","relationship_id":"relationship--35697909-4c19-4799-a5ac-3153750619f8","references":[{"source_name":"US-CERT Volgmer 2 Nov 2017","description":"US-CERT. (2017, November 01). Malware Analysis Report (MAR) - 10135536-D. Retrieved July 16, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-D_WHITE_S508C.PDF"},{"source_name":"US-CERT Volgmer Nov 2017","description":"US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017.","url":"https://www.us-cert.gov/ncas/alerts/TA17-318B"},{"source_name":"Symantec Volgmer Aug 2014","description":"Yagi, J. (2014, August 24). Trojan.Volgmer. Retrieved July 16, 2018.","url":"https://web.archive.org/web/20181126143456/https://www.symantec.com/security-center/writeup/2014-081811-3237-99?tabid=2"}]},{"id":"S0181","name":"FALLCHILL","url":"https://attack.mitre.org/software/S0181","kind":"malware","description":"[FALLCHILL](https://attack.mitre.org/software/S0181) can collect operating system (OS) version information, processor information, and system name from the victim.(Citation: US-CERT FALLCHILL Nov 2017)","relationship_id":"relationship--5dd257c0-c2cb-422a-9991-93ff667c5ad6","references":[{"source_name":"US-CERT FALLCHILL Nov 2017","description":"US-CERT. (2017, November 22). Alert (TA17-318A): HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL. Retrieved December 7, 2017.","url":"https://www.us-cert.gov/ncas/alerts/TA17-318A"}]},{"id":"S0182","name":"FinFisher","url":"https://attack.mitre.org/software/S0182","kind":"malware","description":"[FinFisher](https://attack.mitre.org/software/S0182) checks if the victim OS is 32 or 64-bit.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)","relationship_id":"relationship--db46b437-c406-4c36-a0fe-bf1f2c32a6fe","references":[{"source_name":"Microsoft FinFisher March 2018","description":"Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","description":"FinFisher. (n.d.). Retrieved September 12, 2024.","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}]},{"id":"S0184","name":"POWRUNER","url":"https://attack.mitre.org/software/S0184","kind":"malware","description":"[POWRUNER](https://attack.mitre.org/software/S0184) may collect information about the system by running <code>hostname</code> and <code>systeminfo</code> on a victim.(Citation: FireEye APT34 Dec 2017)","relationship_id":"relationship--a88332d2-d03f-4139-b11c-19e82459189b","references":[{"source_name":"FireEye APT34 Dec 2017","description":"Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}]},{"id":"S0186","name":"DownPaper","url":"https://attack.mitre.org/software/S0186","kind":"malware","description":"[DownPaper](https://attack.mitre.org/software/S0186) collects the victim host name and serial number, and then sends the information to the C2 server.(Citation: ClearSky Charming Kitten Dec 2017)","relationship_id":"relationship--396edbf6-41b5-4377-90b6-4967c24de7fb","references":[{"source_name":"ClearSky Charming Kitten Dec 2017","description":"ClearSky Cyber Security. (2017, December). Charming Kitten. Retrieved December 27, 2017.","url":"http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf"}]},{"id":"S0192","name":"Pupy","url":"https://attack.mitre.org/software/S0192","kind":"tool","description":"[Pupy](https://attack.mitre.org/software/S0192) can grab a system’s information including the OS version, architecture, etc.(Citation: GitHub Pupy)","relationship_id":"relationship--7e2a1dfa-1ccd-4700-a4a5-3b98590ae710","references":[{"source_name":"GitHub Pupy","description":"Nicolas Verdier. (n.d.). Retrieved January 29, 2018.","url":"https://github.com/n1nj4sec/pupy"}]},{"id":"S0196","name":"PUNCHBUGGY","url":"https://attack.mitre.org/software/S0196","kind":"malware","description":"[PUNCHBUGGY](https://attack.mitre.org/software/S0196) can gather system information such as computer names.(Citation: Morphisec ShellTea June 2019)\t","relationship_id":"relationship--ec85433f-2635-4e7c-af49-6dbfb269dbbd","references":[{"source_name":"Morphisec ShellTea June 2019","description":"Gorelik, M.. (2019, June 10). SECURITY ALERT: FIN8 IS BACK IN BUSINESS, TARGETING THE HOSPITALITY INDUSTRY. Retrieved June 13, 2019.","url":"http://blog.morphisec.com/security-alert-fin8-is-back"}]},{"id":"S0198","name":"NETWIRE","url":"https://attack.mitre.org/software/S0198","kind":"malware","description":"[NETWIRE](https://attack.mitre.org/software/S0198) can discover and collect victim system information.(Citation: McAfee Netwire Mar 2015)","relationship_id":"relationship--e2e35a7a-3057-4955-9e7e-c3972e0ad423","references":[{"source_name":"McAfee Netwire Mar 2015","description":"McAfee. (2015, March 2). Netwire RAT Behind Recent Targeted Attacks. Retrieved February 15, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/netwire-rat-behind-recent-targeted-attacks/"}]},{"id":"S0199","name":"TURNEDUP","url":"https://attack.mitre.org/software/S0199","kind":"malware","description":"[TURNEDUP](https://attack.mitre.org/software/S0199) is capable of gathering system information.(Citation: FireEye APT33 Sept 2017)","relationship_id":"relationship--9ee2a9f3-9174-4927-8561-56d5c6723b9e","references":[{"source_name":"FireEye APT33 Sept 2017","description":"O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.","url":"https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"}]},{"id":"S0201","name":"JPIN","url":"https://attack.mitre.org/software/S0201","kind":"malware","description":"[JPIN](https://attack.mitre.org/software/S0201) can obtain system information such as OS version and disk space.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--ad39bd23-1dd8-4725-bf00-74c0e564215f","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"S0203","name":"Hydraq","url":"https://attack.mitre.org/software/S0203","kind":"malware","description":"[Hydraq](https://attack.mitre.org/software/S0203) creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.(Citation: Symantec Hydraq Jan 2010)","relationship_id":"relationship--4be87979-faf9-4a7a-998a-d1aa3fbf5a80","references":[{"source_name":"Symantec Hydraq Jan 2010","description":"Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}]},{"id":"S0205","name":"Naid","url":"https://attack.mitre.org/software/S0205","kind":"malware","description":"[Naid](https://attack.mitre.org/software/S0205) collects a unique identifier (UID) from a compromised host.(Citation: Symantec Naid June 2012)","relationship_id":"relationship--70e81cc7-9dd6-4349-b7ab-212a46591cff","references":[{"source_name":"Symantec Naid June 2012","description":"Neville, A. (2012, June 15). Trojan.Naid. Retrieved February 22, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-061518-4639-99"}]},{"id":"S0208","name":"Pasam","url":"https://attack.mitre.org/software/S0208","kind":"malware","description":"[Pasam](https://attack.mitre.org/software/S0208) creates a backdoor through which remote attackers can retrieve information like hostname.(Citation: Symantec Pasam May 2012)","relationship_id":"relationship--c5087d19-7d99-4106-9dc7-407c7de710be","references":[{"source_name":"Symantec Pasam May 2012","description":"Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-050412-4128-99"}]},{"id":"S0211","name":"Linfo","url":"https://attack.mitre.org/software/S0211","kind":"malware","description":"[Linfo](https://attack.mitre.org/software/S0211) creates a backdoor through which remote attackers can retrieve system information.(Citation: Symantec Linfo May 2012)","relationship_id":"relationship--05104256-7e9a-457b-8e9f-86976992f3c7","references":[{"source_name":"Symantec Linfo May 2012","description":"Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051605-2535-99"}]},{"id":"S0214","name":"HAPPYWORK","url":"https://attack.mitre.org/software/S0214","kind":"malware","description":"can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--67ffaecc-e47d-47a1-93fd-82d21018ad8b","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0215","name":"KARAE","url":"https://attack.mitre.org/software/S0215","kind":"malware","description":"[KARAE](https://attack.mitre.org/software/S0215) can collect system information.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--87406432-7190-4606-980b-441819713d1d","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0216","name":"POORAIM","url":"https://attack.mitre.org/software/S0216","kind":"malware","description":"[POORAIM](https://attack.mitre.org/software/S0216) can identify system information, including battery status.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--f14c6ecd-4997-44aa-9d29-232195fd4a82","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0217","name":"SHUTTERSPEED","url":"https://attack.mitre.org/software/S0217","kind":"malware","description":"[SHUTTERSPEED](https://attack.mitre.org/software/S0217) can collect system information.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--42ce3f19-e995-4a9e-b7d6-74a5a28824f9","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0218","name":"SLOWDRIFT","url":"https://attack.mitre.org/software/S0218","kind":"malware","description":"[SLOWDRIFT](https://attack.mitre.org/software/S0218) collects and sends system information to its C2.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--128eb6e8-d1a7-4ff6-85e6-a68cfea3298e","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0219","name":"WINERACK","url":"https://attack.mitre.org/software/S0219","kind":"malware","description":"[WINERACK](https://attack.mitre.org/software/S0219) can gather information about the host.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--ed1aa5fa-7f0e-4d87-b3f5-7b50ab01e34b","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0223","name":"POWERSTATS","url":"https://attack.mitre.org/software/S0223","kind":"malware","description":"[POWERSTATS](https://attack.mitre.org/software/S0223) can retrieve OS name/architecture and computer/domain name information from compromised hosts.(Citation: FireEye MuddyWater Mar 2018)(Citation: TrendMicro POWERSTATS V3 June 2019)","relationship_id":"relationship--4e88ec20-d309-440d-a685-0d2abdc1d7ef","references":[{"source_name":"FireEye MuddyWater Mar 2018","description":"Singh, S. et al.. (2018, March 13). Iranian Threat Group Updates Tactics, Techniques and Procedures in Spear Phishing Campaign. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"},{"source_name":"TrendMicro POWERSTATS V3 June 2019","description":"Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"}]},{"id":"S0228","name":"NanHaiShu","url":"https://attack.mitre.org/software/S0228","kind":"malware","description":"[NanHaiShu](https://attack.mitre.org/software/S0228) can gather the victim computer name and serial number.(Citation: Proofpoint Leviathan Oct 2017)","relationship_id":"relationship--ec3f88b1-ba85-497f-91d0-3eb8dcc5c4f1","references":[{"source_name":"Proofpoint Leviathan Oct 2017","description":"Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"id":"S0229","name":"Orz","url":"https://attack.mitre.org/software/S0229","kind":"malware","description":"[Orz](https://attack.mitre.org/software/S0229) can gather the victim OS version and whether it is 64 or 32 bit.(Citation: Proofpoint Leviathan Oct 2017)","relationship_id":"relationship--23d16034-a2eb-40ef-857b-63708e63bf9a","references":[{"source_name":"Proofpoint Leviathan Oct 2017","description":"Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"id":"S0230","name":"ZeroT","url":"https://attack.mitre.org/software/S0230","kind":"malware","description":"[ZeroT](https://attack.mitre.org/software/S0230) gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.(Citation: Proofpoint ZeroT Feb 2017)","relationship_id":"relationship--7bb2d594-36dc-458d-9f9b-8a3df42fac67","references":[{"source_name":"Proofpoint ZeroT Feb 2017","description":"Huss, D., et al. (2017, February 2). Oops, they did it again: APT Targets Russia and Belarus with ZeroT and PlugX. Retrieved April 5, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx"}]},{"id":"S0233","name":"MURKYTOP","url":"https://attack.mitre.org/software/S0233","kind":"malware","description":"[MURKYTOP](https://attack.mitre.org/software/S0233) has the capability to retrieve information about the OS.(Citation: FireEye Periscope March 2018)","relationship_id":"relationship--231dc643-8b22-4a24-83f2-7327a1c5bd13","references":[{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"S0236","name":"Kwampirs","url":"https://attack.mitre.org/software/S0236","kind":"malware","description":"[Kwampirs](https://attack.mitre.org/software/S0236) collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands <code>systeminfo</code>, <code>net config workstation</code>, <code>hostname</code>, <code>ver</code>, <code>set</code>, and <code>date /t</code>.(Citation: Symantec Orangeworm April 2018)","relationship_id":"relationship--a8dc6cca-3ede-4110-baf1-8ce53fb655a9","references":[{"source_name":"Symantec Orangeworm April 2018","description":"Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}]},{"id":"S0237","name":"GravityRAT","url":"https://attack.mitre.org/software/S0237","kind":"malware","description":"[GravityRAT](https://attack.mitre.org/software/S0237) collects the MAC address, computer name, and CPU information.(Citation: Talos GravityRAT)","relationship_id":"relationship--041e8f9b-6cdb-44b3-aa37-a274a4de9a0b","references":[{"source_name":"Talos GravityRAT","description":"Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.","url":"https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"}]},{"id":"S0238","name":"Proxysvc","url":"https://attack.mitre.org/software/S0238","kind":"malware","description":"[Proxysvc](https://attack.mitre.org/software/S0238) collects the OS version, country name, MAC address, computer name, and physical memory statistics.(Citation: McAfee GhostSecret)","relationship_id":"relationship--960bdedf-dcca-4a9b-aa12-358324565470","references":[{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"S0239","name":"Bankshot","url":"https://attack.mitre.org/software/S0239","kind":"malware","description":"[Bankshot](https://attack.mitre.org/software/S0239) gathers system information, network addresses, and the operation system version.(Citation: McAfee Bankshot)(Citation: US-CERT Bankshot Dec 2017)","relationship_id":"relationship--55de5c21-4cb1-4235-89b5-df77dfc7fa90","references":[{"source_name":"McAfee Bankshot","description":"Sherstobitoff, R. (2018, March 08). Hidden Cobra Targets Turkish Financial Sector With New Bankshot Implant. Retrieved May 18, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"},{"source_name":"US-CERT Bankshot Dec 2017","description":"US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.(Citation: Talos ROKRAT)(Citation: Talos ROKRAT 2)(Citation: Securelist ScarCruft May 2019)(Citation: NCCGroup RokRat Nov 2018)(Citation: Volexity InkySquid RokRAT August 2021)(Citation: Malwarebytes RokRAT VBA January 2021)","relationship_id":"relationship--cfc92bbe-4a8b-47ec-b12d-d08fdcea1fbb","references":[{"source_name":"Talos ROKRAT","description":"Mercer, W., Rascagneres, P. (2017, April 03). Introducing ROKRAT. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2017/04/introducing-rokrat.html"},{"source_name":"Talos ROKRAT 2","description":"Mercer, W., Rascagneres, P. (2017, November 28). ROKRAT Reloaded. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2017/11/ROKRAT-Reloaded.html"},{"source_name":"Securelist ScarCruft May 2019","description":"GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"},{"source_name":"NCCGroup RokRat Nov 2018","description":"Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.","url":"https://research.nccgroup.com/2018/11/08/rokrat-analysis/"},{"source_name":"Volexity InkySquid RokRAT August 2021","description":"Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"},{"source_name":"Malwarebytes RokRAT VBA January 2021","description":"Jazi, Hossein. (2021, January 6). Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRat. Retrieved March 22, 2022.","url":"https://blog.malwarebytes.com/threat-analysis/2021/01/retrohunting-apt37-north-korean-apt-used-vba-self-decode-technique-to-inject-rokrat/"}]},{"id":"S0241","name":"RATANKBA","url":"https://attack.mitre.org/software/S0241","kind":"malware","description":"[RATANKBA](https://attack.mitre.org/software/S0241) gathers information about the OS architecture, OS name, and OS version/Service pack.(Citation: Lazarus RATANKBA)(Citation: RATANKBA)","relationship_id":"relationship--f3e4b47e-cde3-4f27-85b7-464b02325ee6","references":[{"source_name":"Lazarus RATANKBA","description":"Lei, C., et al. (2018, January 24). Lazarus Campaign Targeting Cryptocurrencies Reveals Remote Controller Tool, an Evolved RATANKBA, and More. Retrieved May 22, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-campaign-targeting-cryptocurrencies-reveals-remote-controller-tool-evolved-ratankba/"},{"source_name":"RATANKBA","description":"Trend Micro. (2017, February 27). RATANKBA: Delving into Large-scale Watering Holes against Enterprises. Retrieved May 22, 2018.","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"}]},{"id":"S0242","name":"SynAck","url":"https://attack.mitre.org/software/S0242","kind":"malware","description":"[SynAck](https://attack.mitre.org/software/S0242) gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.(Citation: SecureList SynAck Doppelgänging May 2018)","relationship_id":"relationship--3e58118d-64b9-43ae-bfd8-cb3c8bf19556","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","description":"Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"}]},{"id":"S0244","name":"Comnie","url":"https://attack.mitre.org/software/S0244","kind":"malware","description":"[Comnie](https://attack.mitre.org/software/S0244) collects the hostname of the victim machine.(Citation: Palo Alto Comnie)","relationship_id":"relationship--b22e151c-4919-4160-9f5c-143484948003","references":[{"source_name":"Palo Alto Comnie","description":"Grunzweig, J. (2018, January 31). Comnie Continues to Target Organizations in East Asia. Retrieved June 7, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/"}]},{"id":"S0245","name":"BADCALL","url":"https://attack.mitre.org/software/S0245","kind":"malware","description":"[BADCALL](https://attack.mitre.org/software/S0245) collects the computer name and host name on the compromised system.(Citation: US-CERT BADCALL)","relationship_id":"relationship--8840d33c-de12-45d5-a0e3-cdfddf789794","references":[{"source_name":"US-CERT BADCALL","description":"US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-G.PDF"}]},{"id":"S0247","name":"NavRAT","url":"https://attack.mitre.org/software/S0247","kind":"malware","description":"[NavRAT](https://attack.mitre.org/software/S0247) uses <code>systeminfo</code> on a victim’s machine.(Citation: Talos NavRAT May 2018)","relationship_id":"relationship--8a00aa55-b7b2-4df5-902b-d01bfdf89089","references":[{"source_name":"Talos NavRAT May 2018","description":"Mercer, W., Rascagneres, P. (2018, May 31). NavRAT Uses US-North Korea Summit As Decoy For Attacks In South Korea. Retrieved June 11, 2018.","url":"https://blog.talosintelligence.com/2018/05/navrat.html"}]},{"id":"S0248","name":"yty","url":"https://attack.mitre.org/software/S0248","kind":"malware","description":"[yty](https://attack.mitre.org/software/S0248) gathers the computer name, CPU information, Microsoft Windows version, and runs the command <code>systeminfo</code>.(Citation: ASERT Donot March 2018)","relationship_id":"relationship--abf00a6a-7922-432c-95e0-6c44db2c20e3","references":[{"source_name":"ASERT Donot March 2018","description":"Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}]},{"id":"S0249","name":"Gold Dragon","url":"https://attack.mitre.org/software/S0249","kind":"malware","description":"[Gold Dragon](https://attack.mitre.org/software/S0249) collects endpoint information using the <code>systeminfo</code> command.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--c1544dec-4586-466a-b730-862c06e9e3c7","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0250","name":"Koadic","url":"https://attack.mitre.org/software/S0250","kind":"tool","description":"[Koadic](https://attack.mitre.org/software/S0250) can obtain the OS version and build, computer name, and processor architecture from a compromised host.(Citation: MalwareBytes LazyScripter Feb 2021)","relationship_id":"relationship--055261fd-70cd-49c6-b9e6-2641bae4dda7","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","description":"Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"id":"S0251","name":"Zebrocy","url":"https://attack.mitre.org/software/S0251","kind":"malware","description":"[Zebrocy](https://attack.mitre.org/software/S0251) collects the OS version and computer name. [Zebrocy](https://attack.mitre.org/software/S0251) also runs the <code>systeminfo</code> command to gather system information. (Citation: Palo Alto Sofacy 06-2018)(Citation: Unit42 Cannon Nov 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: Unit42 Sofacy Dec 2018)(Citation: ESET Zebrocy May 2019)(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: CISA Zebrocy Oct 2020)","relationship_id":"relationship--6216dadc-095e-4550-bc01-79c79fe614ba","references":[{"source_name":"Accenture SNAKEMACKEREL Nov 2018","description":"Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source_name":"CISA Zebrocy Oct 2020","description":"CISA. (2020, October 29). Malware Analysis Report (AR20-303B). Retrieved December 9, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"},{"source_name":"ESET Zebrocy May 2019","description":"ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"},{"source_name":"ESET Zebrocy Nov 2018","description":"ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"Unit42 Sofacy Dec 2018","description":"Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"},{"source_name":"Palo Alto Sofacy 06-2018","description":"Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"}]},{"id":"S0252","name":"Brave Prince","url":"https://attack.mitre.org/software/S0252","kind":"malware","description":"[Brave Prince](https://attack.mitre.org/software/S0252) collects hard drive content and system configuration information.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--0f66681a-7daf-4cd7-99af-3005b6586306","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0253","name":"RunningRAT","url":"https://attack.mitre.org/software/S0253","kind":"malware","description":"[RunningRAT](https://attack.mitre.org/software/S0253) gathers the OS version and processor information.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--b1c307de-b924-4332-b8db-3c371e46430e","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0254","name":"PLAINTEE","url":"https://attack.mitre.org/software/S0254","kind":"malware","description":"[PLAINTEE](https://attack.mitre.org/software/S0254) collects general system enumeration data about the infected machine and checks the OS version.(Citation: Rancor Unit42 June 2018)","relationship_id":"relationship--072af62a-85d5-4803-aa05-d7c6efa9ec2a","references":[{"source_name":"Rancor Unit42 June 2018","description":"Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"id":"S0257","name":"VERMIN","url":"https://attack.mitre.org/software/S0257","kind":"malware","description":"[VERMIN](https://attack.mitre.org/software/S0257) collects the OS name, machine name, and architecture information.(Citation: Unit 42 VERMIN Jan 2018)","relationship_id":"relationship--eade28d3-c5ce-453e-8e57-3262167c30be","references":[{"source_name":"Unit 42 VERMIN Jan 2018","description":"Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"}]},{"id":"S0259","name":"InnaputRAT","url":"https://attack.mitre.org/software/S0259","kind":"malware","description":"[InnaputRAT](https://attack.mitre.org/software/S0259) gathers system information.(Citation: ASERT InnaputRAT April 2018)","relationship_id":"relationship--32e93dd8-d0df-40d8-b85f-e10e70fc0b8f","references":[{"source_name":"ASERT InnaputRAT April 2018","description":"ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018.","url":"https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can gather information on the OS version, computer name, DEP policy, and memory size.(Citation: ESET InvisiMole June 2018)(Citation: ESET InvisiMole June 2020)","relationship_id":"relationship--9154afb8-abf6-4d9d-b114-5106d801338f","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"},{"source_name":"ESET InvisiMole June 2020","description":"Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf"}]},{"id":"S0262","name":"QuasarRAT","url":"https://attack.mitre.org/software/S0262","kind":"tool","description":"[QuasarRAT](https://attack.mitre.org/software/S0262) can gather system information from the victim’s machine including the OS type.(Citation: GitHub QuasarRAT)","relationship_id":"relationship--48281b5d-ca6f-401e-bda1-24f6537dcf1d","references":[{"source_name":"GitHub QuasarRAT","description":"MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018.","url":"https://github.com/quasar/QuasarRAT"}]},{"id":"S0264","name":"OopsIE","url":"https://attack.mitre.org/software/S0264","kind":"malware","description":"[OopsIE](https://attack.mitre.org/software/S0264) checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.(Citation: Unit 42 OilRig Sept 2018)","relationship_id":"relationship--6a289837-2455-471b-81e4-b677550ab77b","references":[{"source_name":"Unit 42 OilRig Sept 2018","description":"Falcone, R., et al. (2018, September 04). OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE. Retrieved September 24, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/"}]},{"id":"S0265","name":"Kazuar","url":"https://attack.mitre.org/software/S0265","kind":"malware","description":"[Kazuar](https://attack.mitre.org/software/S0265) gathers information on the system.(Citation: Unit 42 Kazuar May 2017)","relationship_id":"relationship--8bbf259b-029b-48fa-859b-5dbbbcd98b53","references":[{"source_name":"Unit 42 Kazuar May 2017","description":"Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.(Citation: S2 Grupo TrickBot June 2017)(Citation: Fidelis TrickBot Oct 2016)(Citation: Cyberreason Anchor December 2019)(Citation: Eclypsium Trickboot December 2020)","relationship_id":"relationship--01aac35b-55e1-40d6-962f-5b5a6efdb2be","references":[{"source_name":"S2 Grupo TrickBot June 2017","description":"Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.","url":"https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"},{"source_name":"Fidelis TrickBot Oct 2016","description":"Reaves, J. (2016, October 15). TrickBot: We Missed you, Dyre. Retrieved August 2, 2018.","url":"https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre"},{"source_name":"Cyberreason Anchor December 2019","description":"Dahan, A. et al. (2019, December 11). DROPPING ANCHOR: FROM A TRICKBOT INFECTION TO THE DISCOVERY OF THE ANCHOR MALWARE. Retrieved September 10, 2020.","url":"https://www.cybereason.com/blog/dropping-anchor-from-a-trickbot-infection-to-the-discovery-of-the-anchor-malware"},{"source_name":"Eclypsium Trickboot December 2020","description":"Eclypsium, Advanced Intelligence. (2020, December 1). TRICKBOT NOW OFFERS ‘TRICKBOOT’: PERSIST, BRICK, PROFIT. Retrieved March 15, 2021.","url":"https://eclypsium.com/wp-content/uploads/2020/12/TrickBot-Now-Offers-TrickBoot-Persist-Brick-Profit.pdf"}]},{"id":"S0267","name":"FELIXROOT","url":"https://attack.mitre.org/software/S0267","kind":"malware","description":"[FELIXROOT](https://attack.mitre.org/software/S0267) collects the victim’s computer name, processor architecture, OS version, and system type.(Citation: FireEye FELIXROOT July 2018)(Citation: ESET GreyEnergy Oct 2018)","relationship_id":"relationship--4bd74c6c-9e4f-4048-b968-13319d68ff00","references":[{"source_name":"ESET GreyEnergy Oct 2018","description":"Cherepanov, A. (2018, October). GREYENERGY A successor to BlackEnergy. Retrieved November 15, 2018.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/10/ESET_GreyEnergy.pdf"},{"source_name":"FireEye FELIXROOT July 2018","description":"Patil, S. (2018, June 26). Microsoft Office Vulnerabilities Used to Distribute FELIXROOT Backdoor in Recent Campaign. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20200607025424/https://www.fireeye.com/blog/threat-research/2018/07/microsoft-office-vulnerabilities-used-to-distribute-felixroot-backdoor.html"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) has used commands and API calls to gather system information.(Citation: Unit 42 Bisonal July 2018)(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)","relationship_id":"relationship--ced766d2-ca63-43d2-8551-76f37696cc88","references":[{"source_name":"Unit 42 Bisonal July 2018","description":"Hayashi, K., Ray, V. (2018, July 31). Bisonal Malware Used in Attacks Against Russia and South Korea. Retrieved August 7, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/"},{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"},{"source_name":"Kaspersky CactusPete Aug 2020","description":"Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021.","url":"https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"}]},{"id":"S0270","name":"RogueRobin","url":"https://attack.mitre.org/software/S0270","kind":"malware","description":"[RogueRobin](https://attack.mitre.org/software/S0270) gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.(Citation: Unit 42 DarkHydrus July 2018)","relationship_id":"relationship--d8bad886-d65a-4652-811f-f8ff9f6bb6db","references":[{"source_name":"Unit 42 DarkHydrus July 2018","description":"Falcone, R., et al. (2018, July 27). New Threat Actor Group DarkHydrus Targets Middle East Government. Retrieved August 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"}]},{"id":"S0271","name":"KEYMARBLE","url":"https://attack.mitre.org/software/S0271","kind":"malware","description":"[KEYMARBLE](https://attack.mitre.org/software/S0271) has the capability to collect the computer name, language settings, the OS version, CPU information, and time elapsed since system start.(Citation: US-CERT KEYMARBLE Aug 2018)","relationship_id":"relationship--5823e4cd-e6cb-4e62-8ed2-a0f296128d34","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","description":"US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}]},{"id":"S0272","name":"NDiskMonitor","url":"https://attack.mitre.org/software/S0272","kind":"malware","description":"[NDiskMonitor](https://attack.mitre.org/software/S0272) obtains the victim computer name and encrypts the information to send over its C2 channel.(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--7a8a36ee-66f8-42ca-abeb-29e6223b91ee","references":[{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"S0275","name":"UPPERCUT","url":"https://attack.mitre.org/software/S0275","kind":"malware","description":"[UPPERCUT](https://attack.mitre.org/software/S0275) has the capability to gather the system’s hostname and OS version.(Citation: FireEye APT10 Sept 2018)(Citation: Trend Micro Earth Kasha Anel NOV 2024)","relationship_id":"relationship--90355089-e793-4a6a-98b4-c1f20322a98f","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","description":"Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"},{"source_name":"FireEye APT10 Sept 2018","description":"Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}]},{"id":"S0280","name":"MirageFox","url":"https://attack.mitre.org/software/S0280","kind":"malware","description":"[MirageFox](https://attack.mitre.org/software/S0280) can collect CPU and architecture information from the victim’s machine.(Citation: APT15 Intezer June 2018)","relationship_id":"relationship--47b7e027-4208-4ed6-b4ae-46941fed16be","references":[{"source_name":"APT15 Intezer June 2018","description":"Rosenberg, J. (2018, June 14). MirageFox: APT15 Resurfaces With New Tools Based On Old Ones. Retrieved September 21, 2018.","url":"https://web.archive.org/web/20180615122133/https://www.intezer.com/miragefox-apt15-resurfaces-with-new-tools-based-on-old-ones/"}]},{"id":"S0283","name":"jRAT","url":"https://attack.mitre.org/software/S0283","kind":"malware","description":"[jRAT](https://attack.mitre.org/software/S0283) collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.(Citation: Symantec Frutas Feb 2013)","relationship_id":"relationship--4e6c5e8c-96a2-4da8-869a-56fe224e037e","references":[{"source_name":"Symantec Frutas Feb 2013","description":"Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.","url":"https://www.symantec.com/connect/blogs/cross-platform-frutas-rat-builder-and-back-door"}]},{"id":"S0284","name":"More_eggs","url":"https://attack.mitre.org/software/S0284","kind":"malware","description":"[More_eggs](https://attack.mitre.org/software/S0284) has the capability to gather the OS version and computer name.(Citation: Talos Cobalt Group July 2018)(Citation: Security Intelligence More Eggs Aug 2019)","relationship_id":"relationship--100f4917-1702-4707-bd9f-58d471e77018","references":[{"source_name":"Talos Cobalt Group July 2018","description":"Svajcer, V. (2018, July 31). Multiple Cobalt Personality Disorder. Retrieved September 5, 2018.","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source_name":"Security Intelligence More Eggs Aug 2019","description":"Villadsen, O.. (2019, August 29). More_eggs, Anyone? Threat Actor ITG08 Strikes Again. Retrieved September 16, 2019.","url":"https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"}]},{"id":"S0330","name":"Zeus Panda","url":"https://attack.mitre.org/software/S0330","kind":"malware","description":"[Zeus Panda](https://attack.mitre.org/software/S0330) collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.(Citation: Talos Zeus Panda Nov 2017)(Citation: GDATA Zeus Panda June 2017)","relationship_id":"relationship--dac8dcfd-e7e7-4b41-b100-07f95f6b0ba9","references":[{"source_name":"Talos Zeus Panda Nov 2017","description":"Brumaghin, E., et al. (2017, November 02). Poisoning the Well: Banking Trojan Targets Google Search Results. Retrieved November 5, 2018.","url":"https://blog.talosintelligence.com/2017/11/zeus-panda-campaign.html#More"},{"source_name":"GDATA Zeus Panda June 2017","description":"Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":"[Agent Tesla](https://attack.mitre.org/software/S0331) can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.(Citation: Fortinet Agent Tesla April 2018)(Citation: Fortinet Agent Tesla June 2017)(Citation: Malwarebytes Agent Tesla April 2020)","relationship_id":"relationship--b509e591-b086-4631-a9ba-5a5dc80de8d0","references":[{"source_name":"Fortinet Agent Tesla April 2018","description":"Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.","url":"https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"},{"source_name":"Fortinet Agent Tesla June 2017","description":"Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.","url":"https://www.fortinet.com/blog/threat-research/in-depth-analysis-of-net-malware-javaupdtr.html"},{"source_name":"Malwarebytes Agent Tesla April 2020","description":"Jazi, H. (2020, April 16). New AgentTesla variant steals WiFi credentials. Retrieved May 19, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) can collect the OS version and process architecture of compromised hosts.(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--2147037d-4af2-4492-9c86-c85dfc6965af","references":[{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0334","name":"DarkComet","url":"https://attack.mitre.org/software/S0334","kind":"malware","description":"[DarkComet](https://attack.mitre.org/software/S0334) can collect the computer name, RAM used, and operating system version from the victim’s machine.(Citation: TrendMicro DarkComet Sept 2014)(Citation: Malwarebytes DarkComet March 2018)","relationship_id":"relationship--62442f37-7a0e-4945-b498-2d02306e53c7","references":[{"source_name":"TrendMicro DarkComet Sept 2014","description":"TrendMicro. (2014, September 03). DARKCOMET. Retrieved November 6, 2018.","url":"https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET"},{"source_name":"Malwarebytes DarkComet March 2018","description":"Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.","url":"https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"}]},{"id":"S0337","name":"BadPatch","url":"https://attack.mitre.org/software/S0337","kind":"malware","description":"[BadPatch](https://attack.mitre.org/software/S0337) collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.(Citation: Unit 42 BadPatch Oct 2017)","relationship_id":"relationship--520faa7e-f529-4b54-b4dc-55d6ae094717","references":[{"source_name":"Unit 42 BadPatch Oct 2017","description":"Bar, T., Conant, S. (2017, October 20). BadPatch. Retrieved November 13, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"}]},{"id":"S0339","name":"Micropsia","url":"https://attack.mitre.org/software/S0339","kind":"malware","description":"[Micropsia](https://attack.mitre.org/software/S0339) gathers the hostname and OS version from the victim’s machine.(Citation: Talos Micropsia June 2017)(Citation: Radware Micropsia July 2018)","relationship_id":"relationship--002c9202-d7a0-4181-b912-42f7d6d38339","references":[{"source_name":"Talos Micropsia June 2017","description":"Rascagneres, P., Mercer, W. (2017, June 19). Delphi Used To Score Against Palestine. Retrieved November 13, 2018.","url":"https://blog.talosintelligence.com/2017/06/palestine-delphi.html"},{"source_name":"Radware Micropsia July 2018","description":"Tsarfaty, Y. (2018, July 25). Micropsia Malware. Retrieved November 13, 2018.","url":"https://www.radware.com/blog/security/2018/07/micropsia-malware/"}]},{"id":"S0340","name":"Octopus","url":"https://attack.mitre.org/software/S0340","kind":"malware","description":"[Octopus](https://attack.mitre.org/software/S0340) can collect the computer name, OS version, and OS architecture information.(Citation: Securelist Octopus Oct 2018)","relationship_id":"relationship--75a1f636-76d3-4029-ae40-0a7a3b8d7eba","references":[{"source_name":"Securelist Octopus Oct 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"}]},{"id":"S0344","name":"Azorult","url":"https://attack.mitre.org/software/S0344","kind":"malware","description":"[Azorult](https://attack.mitre.org/software/S0344) can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language.(Citation: Unit42 Azorult Nov 2018)(Citation: Proofpoint Azorult July 2018)","relationship_id":"relationship--e391c03a-9ef4-436f-8ab5-2c15168c9551","references":[{"source_name":"Unit42 Azorult Nov 2018","description":"Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"},{"source_name":"Proofpoint Azorult July 2018","description":"Proofpoint. (2018, July 30). New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign. Retrieved November 29, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongside"}]},{"id":"S0346","name":"OceanSalt","url":"https://attack.mitre.org/software/S0346","kind":"malware","description":"[OceanSalt](https://attack.mitre.org/software/S0346) can collect the computer name from the system.(Citation: McAfee Oceansalt Oct 2018)","relationship_id":"relationship--88d53468-4ab8-455e-bd16-dc52ef9a3d96","references":[{"source_name":"McAfee Oceansalt Oct 2018","description":"Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf"}]},{"id":"S0348","name":"Cardinal RAT","url":"https://attack.mitre.org/software/S0348","kind":"malware","description":"[Cardinal RAT](https://attack.mitre.org/software/S0348) can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.(Citation: PaloAlto CardinalRat Apr 2017)","relationship_id":"relationship--c50c585a-b5c4-41c7-91a2-b6bb14b7e1f0","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","description":"Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}]},{"id":"S0350","name":"zwShell","url":"https://attack.mitre.org/software/S0350","kind":"malware","description":"[zwShell](https://attack.mitre.org/software/S0350) can obtain the victim PC name and OS version.(Citation: McAfee Night Dragon)","relationship_id":"relationship--5f179b5c-497f-42da-bc32-360b6113122b","references":[{"source_name":"McAfee Night Dragon","description":"McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}]},{"id":"S0351","name":"Cannon","url":"https://attack.mitre.org/software/S0351","kind":"malware","description":"[Cannon](https://attack.mitre.org/software/S0351) can gather system information from the victim’s machine such as the OS version, and machine name.(Citation: Unit42 Cannon Nov 2018)(Citation: Unit42 Sofacy Dec 2018)","relationship_id":"relationship--f9bf12c3-7512-47fe-86d7-cc89662abad4","references":[{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source_name":"Unit42 Sofacy Dec 2018","description":"Lee, B., Falcone, R. (2018, December 12). Dear Joohn: The Sofacy Group’s Global Campaign. Retrieved April 19, 2019.","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"}]},{"id":"S0352","name":"OSX_OCEANLOTUS.D","url":"https://attack.mitre.org/software/S0352","kind":"malware","description":"[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. [OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) has used the <code>ioreg</code> command to gather some of this information.(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)(Citation: 20 macOS Common Tools and Techniques)","relationship_id":"relationship--588865e4-caec-4150-9c03-df5e28eb9c79","references":[{"source_name":"TrendMicro MacOS April 2018","description":"Horejsi, J. (2018, April 04). New MacOS Backdoor Linked to OceanLotus Found. Retrieved November 13, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/"},{"source_name":"Trend Micro MacOS Backdoor November 2020","description":"Magisa, L. (2020, November 27). New MacOS Backdoor Connected to OceanLotus Surfaces. Retrieved December 2, 2020.","url":"https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html"},{"source_name":"20 macOS Common Tools and Techniques","description":"Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.","url":"https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"}]},{"id":"S0353","name":"NOKKI","url":"https://attack.mitre.org/software/S0353","kind":"malware","description":"[NOKKI](https://attack.mitre.org/software/S0353) can gather information on the operating system on the victim’s machine.(Citation: Unit 42 NOKKI Sept 2018)","relationship_id":"relationship--ef6d08c0-e9dd-45e1-b5ce-42cd5731f2ab","references":[{"source_name":"Unit 42 NOKKI Sept 2018","description":"Grunzweig, J., Lee, B. (2018, September 27). New KONNI Malware attacking Eurasia and Southeast Asia. Retrieved November 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/"}]},{"id":"S0354","name":"Denis","url":"https://attack.mitre.org/software/S0354","kind":"malware","description":"[Denis](https://attack.mitre.org/software/S0354) collects OS information and the computer name from the victim’s machine.(Citation: Securelist Denis April 2017)(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--2910f5f5-38d6-418a-8566-23d31b93b124","references":[{"source_name":"Securelist Denis April 2017","description":"Shulmin, A., Yunakovsky, S. (2017, April 28). Use of DNS Tunneling for C&C Communications. Retrieved November 5, 2018.","url":"https://securelist.com/use-of-dns-tunneling-for-cc-communications/78203/"},{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0355","name":"Final1stspy","url":"https://attack.mitre.org/software/S0355","kind":"malware","description":"[Final1stspy](https://attack.mitre.org/software/S0355) obtains victim Microsoft Windows version information and CPU architecture.(Citation: Unit 42 Nokki Oct 2018)","relationship_id":"relationship--854fd292-dbaf-4112-96b2-824364c82a4c","references":[{"source_name":"Unit 42 Nokki Oct 2018","description":"Grunzweig, J. (2018, October 01). NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT. Retrieved November 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-nokki-almost-ties-the-knot-with-dogcall-reaper-group-uses-new-malware-to-deploy-rat/"}]},{"id":"S0356","name":"KONNI","url":"https://attack.mitre.org/software/S0356","kind":"malware","description":"[KONNI](https://attack.mitre.org/software/S0356) can gather the OS version, architecture information, hostname, and RAM size information from the victim’s machine and has used <code>cmd /c systeminfo</code> command to get a snapshot of the current system state of the target machine.(Citation: Talos Konni May 2017)(Citation: Medium KONNI Jan 2020)(Citation: Malwarebytes Konni Aug 2021)","relationship_id":"relationship--172da5b1-cf68-468a-8208-b15ea5c813dc","references":[{"source_name":"Medium KONNI Jan 2020","description":"Karmi, D. (2020, January 4). A Look Into Konni 2019 Campaign. Retrieved April 28, 2020.","url":"https://medium.com/d-hunter/a-look-into-konni-2019-campaign-b45a0f321e9b"},{"source_name":"Talos Konni May 2017","description":"Rascagneres, P. (2017, May 03). KONNI: A Malware Under The Radar For Years. Retrieved November 5, 2018.","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"},{"source_name":"Malwarebytes Konni Aug 2021","description":"Threat Intelligence Team. (2021, August 23). New variant of Konni malware used in campaign targetting Russia. Retrieved January 5, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) can enumerate host system information like OS, architecture, domain name, applied patches, and more.(Citation: Github PowerShell Empire)(Citation: Talos Frankenstein June 2019)","relationship_id":"relationship--3c766e53-1372-4b94-b7de-b3f70d4d1a91","references":[{"source_name":"Talos Frankenstein June 2019","description":"Adamitis, D. et al. (2019, June 4). It's alive: Threat actors cobble together open-source pieces into monstrous Frankenstein campaign. Retrieved May 11, 2020.","url":"https://blog.talosintelligence.com/2019/06/frankenstein-campaign.html"},{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0373","name":"Astaroth","url":"https://attack.mitre.org/software/S0373","kind":"malware","description":"[Astaroth](https://attack.mitre.org/software/S0373) collects the machine name and keyboard language from the system. (Citation: Cofense Astaroth Sept 2018)(Citation: Cybereason Astaroth Feb 2019)","relationship_id":"relationship--29d3798c-dc27-4950-abc4-30b48608a746","references":[{"source_name":"Cofense Astaroth Sept 2018","description":"Doaty, J., Garrett, P.. (2018, September 10). We’re Seeing a Resurgence of the Demonic Astaroth WMIC Trojan. Retrieved September 25, 2024.","url":"https://web.archive.org/web/20200302071436/https://cofense.com/seeing-resurgence-demonic-astaroth-wmic-trojan/"},{"source_name":"Cybereason Astaroth Feb 2019","description":"Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.","url":"https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"}]},{"id":"S0374","name":"SpeakUp","url":"https://attack.mitre.org/software/S0374","kind":"malware","description":"[SpeakUp](https://attack.mitre.org/software/S0374) uses the <code>cat /proc/cpuinfo | grep -c “cpu family” 2>&1</code> command to gather system information. (Citation: CheckPoint SpeakUp Feb 2019)","relationship_id":"relationship--0a8c04f1-c724-4215-92f0-3863b2a3d96d","references":[{"source_name":"CheckPoint SpeakUp Feb 2019","description":"Check Point Research. (2019, February 4). SpeakUp: A New Undetected Backdoor Linux Trojan. Retrieved April 17, 2019.","url":"https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/"}]},{"id":"S0376","name":"HOPLIGHT","url":"https://attack.mitre.org/software/S0376","kind":"malware","description":"[HOPLIGHT](https://attack.mitre.org/software/S0376) has been observed collecting victim machine information like OS version.(Citation: US-CERT HOPLIGHT Apr 2019)","relationship_id":"relationship--7aeee346-4272-45c4-b351-1cf4ac98a15d","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","description":"US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}]},{"id":"S0378","name":"PoshC2","url":"https://attack.mitre.org/software/S0378","kind":"tool","description":"[PoshC2](https://attack.mitre.org/software/S0378) contains modules, such as <code>Get-ComputerInfo</code>, for enumerating common system information.(Citation: GitHub PoshC2)","relationship_id":"relationship--59fe8c5d-f008-4be7-a187-39d70073914d","references":[{"source_name":"GitHub PoshC2","description":"Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.","url":"https://github.com/nettitude/PoshC2_Python"}]},{"id":"S0379","name":"Revenge RAT","url":"https://attack.mitre.org/software/S0379","kind":"malware","description":"[Revenge RAT](https://attack.mitre.org/software/S0379) collects the CPU information, OS information, and system language.(Citation: Cylance Shaheen Nov 2018)","relationship_id":"relationship--6765828a-168f-4dd7-8c1b-00f7d98daef5","references":[{"source_name":"Cylance Shaheen Nov 2018","description":"Livelli, K, et al. (2018, November 12). Operation Shaheen. Retrieved May 1, 2019.","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]},{"id":"S0380","name":"StoneDrill","url":"https://attack.mitre.org/software/S0380","kind":"malware","description":"[StoneDrill](https://attack.mitre.org/software/S0380) has the capability to discover the system OS, Windows version, architecture and environment.(Citation: Kaspersky StoneDrill 2017)\t","relationship_id":"relationship--9497e927-67da-4845-b7a9-fe7d13524110","references":[{"source_name":"Kaspersky StoneDrill 2017","description":"Kaspersky Lab. (2017, March 7). From Shamoon to StoneDrill: Wipers attacking Saudi organizations and beyond. Retrieved March 14, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf"}]},{"id":"S0381","name":"FlawedAmmyy","url":"https://attack.mitre.org/software/S0381","kind":"malware","description":"[FlawedAmmyy](https://attack.mitre.org/software/S0381) can collect the victim's operating system and computer name during the initial infection.(Citation: Proofpoint TA505 Mar 2018)","relationship_id":"relationship--0d95b411-1192-42d0-96b1-98fe18742a04","references":[{"source_name":"Proofpoint TA505 Mar 2018","description":"Proofpoint Staff. (2018, March 7). Leaked Ammyy Admin Source Code Turned into Malware. Retrieved May 28, 2019.","url":"https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"}]},{"id":"S0382","name":"ServHelper","url":"https://attack.mitre.org/software/S0382","kind":"malware","description":"[ServHelper](https://attack.mitre.org/software/S0382) will attempt to enumerate Windows version and system architecture.(Citation: Proofpoint TA505 Jan 2019)","relationship_id":"relationship--5faa7f83-062b-4821-ad9b-b731a41c06d9","references":[{"source_name":"Proofpoint TA505 Jan 2019","description":"Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019.","url":"https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"}]},{"id":"S0384","name":"Dridex","url":"https://attack.mitre.org/software/S0384","kind":"malware","description":"[Dridex](https://attack.mitre.org/software/S0384) has collected the computer name and OS architecture information from the system.(Citation: Checkpoint Dridex Jan 2021)","relationship_id":"relationship--9dfb9740-1641-4306-8ee8-38318be3ae42","references":[{"source_name":"Checkpoint Dridex Jan 2021","description":"Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.","url":"https://research.checkpoint.com/2021/stopping-serial-killer-catching-the-next-strike/"}]},{"id":"S0385","name":"njRAT","url":"https://attack.mitre.org/software/S0385","kind":"malware","description":"[njRAT](https://attack.mitre.org/software/S0385) enumerates the victim operating system and computer name during the initial infection.(Citation: Fidelis njRAT June 2013)","relationship_id":"relationship--005cbf7d-9d0b-443b-91db-7b148a1eb55b","references":[{"source_name":"Fidelis njRAT June 2013","description":"Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: \"njRAT\" Uncovered. Retrieved June 4, 2019.","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"}]},{"id":"S0386","name":"Ursnif","url":"https://attack.mitre.org/software/S0386","kind":"malware","description":"[Ursnif](https://attack.mitre.org/software/S0386) has used [Systeminfo](https://attack.mitre.org/software/S0096) to gather system information.(Citation: TrendMicro Ursnif Mar 2015)","relationship_id":"relationship--b892d69f-bdfc-48e8-83f5-3081b9bffa4a","references":[{"source_name":"TrendMicro Ursnif Mar 2015","description":"Caragay, R. (2015, March 26). URSNIF: The Multifaceted Malware. Retrieved June 5, 2019.","url":"https://web.archive.org/web/20210719165945/https://www.trendmicro.com/en_us/research/15/c/ursnif-the-multifaceted-malware.html?_ga=2.165628854.808042651.1508120821-744063452.1505819992"}]},{"id":"S0387","name":"KeyBoy","url":"https://attack.mitre.org/software/S0387","kind":"malware","description":"[KeyBoy](https://attack.mitre.org/software/S0387) can gather extended system information, such as information about the operating system and memory.(Citation: PWC KeyBoys Feb 2017)(Citation: Rapid7 KeyBoy Jun 2013)","relationship_id":"relationship--0bc7c262-604c-42af-8829-ce9f579436d4","references":[{"source_name":"Rapid7 KeyBoy Jun 2013","description":"Guarnieri, C., Schloesser M. (2013, June 7). KeyBoy, Targeted Attacks against Vietnam and India. Retrieved June 14, 2019.","url":"https://blog.rapid7.com/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india/"},{"source_name":"PWC KeyBoys Feb 2017","description":"Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.","url":"https://web.archive.org/web/20211129064701/https://www.pwc.co.uk/issues/cyber-security-services/research/the-keyboys-are-back-in-town.html"}]},{"id":"S0388","name":"YAHOYAH","url":"https://attack.mitre.org/software/S0388","kind":"malware","description":"[YAHOYAH](https://attack.mitre.org/software/S0388) checks for the system’s Windows OS version and hostname.(Citation: TrendMicro TropicTrooper 2015)","relationship_id":"relationship--01c60a20-2eff-4b4e-a15a-24e56a487b4e","references":[{"source_name":"TrendMicro TropicTrooper 2015","description":"Alintanahin, K. (2015). Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers. Retrieved June 14, 2019.","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"}]},{"id":"S0391","name":"HAWKBALL","url":"https://attack.mitre.org/software/S0391","kind":"malware","description":"[HAWKBALL](https://attack.mitre.org/software/S0391) can collect the OS version, architecture information, and computer name.(Citation: FireEye HAWKBALL Jun 2019)","relationship_id":"relationship--3dbae391-a354-488a-b0ab-426d1a055413","references":[{"source_name":"FireEye HAWKBALL Jun 2019","description":"Patil, S. and Williams, M.. (2019, June 5). Government Sector in Central Asia Targeted With New HAWKBALL Backdoor Delivered via Microsoft Office Vulnerabilities. Retrieved June 20, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/06/government-in-central-asia-targeted-with-hawkball-backdoor.html"}]},{"id":"S0395","name":"LightNeuron","url":"https://attack.mitre.org/software/S0395","kind":"malware","description":"[LightNeuron](https://attack.mitre.org/software/S0395) gathers the victim computer name using the Win32 API call <code>GetComputerName</code>.(Citation: ESET LightNeuron May 2019)","relationship_id":"relationship--70f5df58-30d0-4866-bfee-64dcf10edca9","references":[{"source_name":"ESET LightNeuron May 2019","description":"Faou, M. (2019, May). Turla LightNeuron: One email away from remote code execution. Retrieved June 24, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf"}]},{"id":"S0402","name":"OSX/Shlayer","url":"https://attack.mitre.org/software/S0402","kind":"malware","description":"[OSX/Shlayer](https://attack.mitre.org/software/S0402) has collected the IOPlatformUUID, session UID, and the OS version using the command <code>sw_vers -productVersion</code>.(Citation: Carbon Black Shlayer Feb 2019)(Citation: sentinelone shlayer to zshlayer)","relationship_id":"relationship--9db842bf-d65d-44a8-93ca-aef62cadafc1","references":[{"source_name":"Carbon Black Shlayer Feb 2019","description":"Carbon Black Threat Analysis Unit. (2019, February 12). New macOS Malware Variant of Shlayer (OSX) Discovered. Retrieved August 8, 2019.","url":"https://blogs.vmware.com/security/2020/02/vmware-carbon-black-tau-threat-analysis-shlayer-macos.html"},{"source_name":"sentinelone shlayer to zshlayer","description":"Phil Stokes. (2020, September 8). Coming Out of Your Shell: From Shlayer to ZShlayer. Retrieved September 13, 2021.","url":"https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/"}]},{"id":"S0409","name":"Machete","url":"https://attack.mitre.org/software/S0409","kind":"malware","description":"[Machete](https://attack.mitre.org/software/S0409) collects the hostname of the target computer.(Citation: ESET Machete July 2019) ","relationship_id":"relationship--d843c014-0814-4945-b75a-09db4ad6e81b","references":[{"source_name":"ESET Machete July 2019","description":"ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}]},{"id":"S0410","name":"Fysbis","url":"https://attack.mitre.org/software/S0410","kind":"malware","description":"[Fysbis](https://attack.mitre.org/software/S0410) has used the command <code>ls /etc | egrep -e\"fedora\\*|debian\\*|gentoo\\*|mandriva\\*|mandrake\\*|meego\\*|redhat\\*|lsb-\\*|sun-\\*|SUSE\\*|release\"</code> to determine which Linux OS version is running.(Citation: Fysbis Palo Alto Analysis)","relationship_id":"relationship--834bbbc7-33b7-41e4-9bc8-98401a5a0e36","references":[{"source_name":"Fysbis Palo Alto Analysis","description":"Bryan Lee and Rob Downs. (2016, February 12). A Look Into Fysbis: Sofacy’s Linux Backdoor. Retrieved September 10, 2017.","url":"https://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) can collect the local hostname, operating system details, CPU speed, and total physical memory.(Citation: Talos ZxShell Oct 2014) ","relationship_id":"relationship--20f422e8-6244-46e3-8842-f5dc3e37568c","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}]},{"id":"S0414","name":"BabyShark","url":"https://attack.mitre.org/software/S0414","kind":"malware","description":"[BabyShark](https://attack.mitre.org/software/S0414) has executed the <code>ver</code> command.(Citation: Unit42 BabyShark Feb 2019)\t","relationship_id":"relationship--906699ff-a10f-4527-9173-326965cc51a2","references":[{"source_name":"Unit42 BabyShark Feb 2019","description":"Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.","url":"https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"}]},{"id":"S0417","name":"GRIFFON","url":"https://attack.mitre.org/software/S0417","kind":"malware","description":"[GRIFFON](https://attack.mitre.org/software/S0417) has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation .(Citation: SecureList Griffon May 2019)","relationship_id":"relationship--66bd7bd5-b53f-4791-a130-7278541f3fa7","references":[{"source_name":"SecureList Griffon May 2019","description":"Namestnikov, Y. and Aime, F. (2019, May 8). FIN7.5: the infamous cybercrime rig “FIN7” continues its activities. Retrieved October 11, 2019.","url":"https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/"}]},{"id":"S0428","name":"PoetRAT","url":"https://attack.mitre.org/software/S0428","kind":"malware","description":"[PoetRAT](https://attack.mitre.org/software/S0428) has the ability to gather information about the compromised host.(Citation: Talos PoetRAT April 2020)","relationship_id":"relationship--77d954c5-de84-4f4b-98b6-5ad35603ae7a","references":[{"source_name":"Talos PoetRAT April 2020","description":"Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}]},{"id":"S0431","name":"HotCroissant","url":"https://attack.mitre.org/software/S0431","kind":"malware","description":"[HotCroissant](https://attack.mitre.org/software/S0431) has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.(Citation: US-CERT HOTCROISSANT February 2020)","relationship_id":"relationship--e3542e4e-6c4d-468a-b11e-462e35dc33f6","references":[{"source_name":"US-CERT HOTCROISSANT February 2020","description":"US-CERT. (2020, February 20). MAR-10271944-1.v1 – North Korean Trojan: HOTCROISSANT. Retrieved May 1, 2020.","url":"https://www.us-cert.gov/ncas/analysis-reports/ar20-045d"}]},{"id":"S0433","name":"Rifdoor","url":"https://attack.mitre.org/software/S0433","kind":"malware","description":"[Rifdoor](https://attack.mitre.org/software/S0433) has the ability to identify the Windows version on the compromised host.(Citation: Carbon Black HotCroissant April 2020)","relationship_id":"relationship--0d557837-8936-43e7-95fd-2c30938d34d3","references":[{"source_name":"Carbon Black HotCroissant April 2020","description":"Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}]},{"id":"S0439","name":"Okrum","url":"https://attack.mitre.org/software/S0439","kind":"malware","description":"[Okrum](https://attack.mitre.org/software/S0439) can collect computer name, locale information, and information about the OS and architecture.(Citation: ESET Okrum July 2019)","relationship_id":"relationship--702ed555-03e2-4660-82d8-e85d46cbec02","references":[{"source_name":"ESET Okrum July 2019","description":"Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}]},{"id":"S0441","name":"PowerShower","url":"https://attack.mitre.org/software/S0441","kind":"malware","description":"[PowerShower](https://attack.mitre.org/software/S0441) has collected system information on the infected host.(Citation: Unit 42 Inception November 2018)","relationship_id":"relationship--175199ba-b8b8-467b-9010-a2f549abd957","references":[{"source_name":"Unit 42 Inception November 2018","description":"Lancaster, T. (2018, November 5). Inception Attackers Target Europe with Year-old Office Vulnerability. Retrieved May 8, 2020.","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"}]},{"id":"S0445","name":"ShimRatReporter","url":"https://attack.mitre.org/software/S0445","kind":"tool","description":"[ShimRatReporter](https://attack.mitre.org/software/S0445) gathered the operating system name and specific Windows version of an infected machine.(Citation: FOX-IT May 2016 Mofang)","relationship_id":"relationship--c62b3e99-4ab2-4474-b3f7-2779652210f7","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0447","name":"Lokibot","url":"https://attack.mitre.org/software/S0447","kind":"malware","description":"[Lokibot](https://attack.mitre.org/software/S0447) has the ability to discover the computer name and Windows product name/version.(Citation: FSecure Lokibot November 2019)","relationship_id":"relationship--a9e6a51e-69b1-4b21-9db1-5aabdded2f0a","references":[{"source_name":"FSecure Lokibot November 2019","description":"Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020.","url":"https://www.f-secure.com/v-descs/trojan_w32_lokibot.shtml"}]},{"id":"S0448","name":"Rising Sun","url":"https://attack.mitre.org/software/S0448","kind":"malware","description":"[Rising Sun](https://attack.mitre.org/software/S0448) can detect the computer name and operating system.(Citation: McAfee Sharpshooter December 2018)\t","relationship_id":"relationship--5bd827b4-cdaf-4d50-acb8-493f32d51acb","references":[{"source_name":"McAfee Sharpshooter December 2018","description":"Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}]},{"id":"S0449","name":"Maze","url":"https://attack.mitre.org/software/S0449","kind":"malware","description":"[Maze](https://attack.mitre.org/software/S0449) has checked the language of the infected system using the \"GetUSerDefaultUILanguage\" function.(Citation: McAfee Maze March 2020)","relationship_id":"relationship--0d3f773c-ed0e-4db4-8457-204a7a33eb58","references":[{"source_name":"McAfee Maze March 2020","description":"Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"}]},{"id":"S0450","name":"SHARPSTATS","url":"https://attack.mitre.org/software/S0450","kind":"malware","description":"[SHARPSTATS](https://attack.mitre.org/software/S0450) has the ability to identify the IP address, machine name, and OS of the compromised host.(Citation: TrendMicro POWERSTATS V3 June 2019)","relationship_id":"relationship--de70abfa-848f-4993-bdb8-7235d4a3d720","references":[{"source_name":"TrendMicro POWERSTATS V3 June 2019","description":"Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/"}]},{"id":"S0451","name":"LoudMiner","url":"https://attack.mitre.org/software/S0451","kind":"malware","description":"[LoudMiner](https://attack.mitre.org/software/S0451) has monitored CPU usage.(Citation: ESET LoudMiner June 2019)\t","relationship_id":"relationship--9e339696-4e81-496f-808e-82d63b62c331","references":[{"source_name":"ESET LoudMiner June 2019","description":"Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.","url":"https://www.welivesecurity.com/2019/06/20/loudminer-mining-cracked-vst-software/"}]},{"id":"S0453","name":"Pony","url":"https://attack.mitre.org/software/S0453","kind":"malware","description":"[Pony](https://attack.mitre.org/software/S0453) has collected the Service Pack, language, and region information to send to the C2.(Citation: Malwarebytes Pony April 2016)\t","relationship_id":"relationship--8dd83463-b0cb-46e9-a01a-b22c6780066f","references":[{"source_name":"Malwarebytes Pony April 2016","description":"hasherezade. (2016, April 11). No money, but Pony! From a mail to a trojan horse. Retrieved May 21, 2020.","url":"https://blog.malwarebytes.com/threat-analysis/2015/11/no-money-but-pony-from-a-mail-to-a-trojan-horse/"}]},{"id":"S0454","name":"Cadelspy","url":"https://attack.mitre.org/software/S0454","kind":"malware","description":"[Cadelspy](https://attack.mitre.org/software/S0454) has the ability to discover information about the compromised host.(Citation: Symantec Chafer Dec 2015)","relationship_id":"relationship--d826904c-7853-4f85-a5e4-948b21ae374c","references":[{"source_name":"Symantec Chafer Dec 2015","description":"Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.","url":"https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) has collected the hostname and operating system version from the compromised host.(Citation: FireEye Metamorfo Apr 2018)(Citation: Fortinet Metamorfo Feb 2020)(Citation: ESET Casbaneiro Oct 2019)","relationship_id":"relationship--8a8afe63-a754-40e3-98af-cfc3f0aa6ef5","references":[{"source_name":"FireEye Metamorfo Apr 2018","description":"Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"},{"source_name":"Fortinet Metamorfo Feb 2020","description":"Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020.","url":"https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions"},{"source_name":"ESET Casbaneiro Oct 2019","description":"ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021.","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}]},{"id":"S0456","name":"Aria-body","url":"https://attack.mitre.org/software/S0456","kind":"malware","description":"[Aria-body](https://attack.mitre.org/software/S0456) has the ability to identify the hostname, computer name, Windows version, processor speed, and machine GUID on a compromised host.(Citation: CheckPoint Naikon May 2020)","relationship_id":"relationship--5fdd0fba-8d1d-411a-b47b-3e5aae512892","references":[{"source_name":"CheckPoint Naikon May 2020","description":"CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"id":"S0457","name":"Netwalker","url":"https://attack.mitre.org/software/S0457","kind":"malware","description":"[Netwalker](https://attack.mitre.org/software/S0457) can determine the system architecture it is running on to choose which version of the DLL to use.(Citation: TrendMicro Netwalker May 2020)","relationship_id":"relationship--1c3bc7ec-cabe-4c8f-9d6e-99afd877e845","references":[{"source_name":"TrendMicro Netwalker May 2020","description":"Victor, K.. (2020, May 18). Netwalker Fileless Ransomware Injected via Reflective Loading . Retrieved May 26, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/netwalker-fileless-ransomware-injected-via-reflective-loading/"}]},{"id":"S0460","name":"Get2","url":"https://attack.mitre.org/software/S0460","kind":"malware","description":"[Get2](https://attack.mitre.org/software/S0460) has the ability to identify the computer name and Windows version of an infected host.(Citation: Proofpoint TA505 October 2019)","relationship_id":"relationship--9c4281ea-b225-44b4-b460-255e51586598","references":[{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0461","name":"SDBbot","url":"https://attack.mitre.org/software/S0461","kind":"malware","description":"[SDBbot](https://attack.mitre.org/software/S0461) has the ability to identify the OS version, OS bit information and computer name.(Citation: Proofpoint TA505 October 2019)(Citation: Korean FSI TA505 2020)","relationship_id":"relationship--855bcd64-ef37-4197-8d3e-2c147d42d774","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="},{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0462","name":"CARROTBAT","url":"https://attack.mitre.org/software/S0462","kind":"malware","description":"[CARROTBAT](https://attack.mitre.org/software/S0462) has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture.(Citation: Unit 42 CARROTBAT November 2018)(Citation: Unit 42 CARROTBAT January 2020)","relationship_id":"relationship--0b37289c-b118-45f7-98b2-5efe06cbf0b2","references":[{"source_name":"Unit 42 CARROTBAT November 2018","description":"Grunzweig, J. and Wilhoit, K. (2018, November 29). The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia. Retrieved June 2, 2020.","url":"https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/"},{"source_name":"Unit 42 CARROTBAT January 2020","description":"McCabe, A. (2020, January 23). The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks. Retrieved June 2, 2020.","url":"https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"}]},{"id":"S0464","name":"SYSCON","url":"https://attack.mitre.org/software/S0464","kind":"malware","description":"[SYSCON](https://attack.mitre.org/software/S0464) has the ability to use [Systeminfo](https://attack.mitre.org/software/S0096) to identify system information.(Citation: Unit 42 CARROTBAT January 2020)","relationship_id":"relationship--01ebd689-8233-409a-a12d-eafb2546f665","references":[{"source_name":"Unit 42 CARROTBAT January 2020","description":"McCabe, A. (2020, January 23). The Fractured Statue Campaign: U.S. Government Agency Targeted in Spear-Phishing Attacks. Retrieved June 2, 2020.","url":"https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"}]},{"id":"S0467","name":"TajMahal","url":"https://attack.mitre.org/software/S0467","kind":"malware","description":"[TajMahal](https://attack.mitre.org/software/S0467) has the ability to identify hardware information, the computer name, and OS information on an infected host.(Citation: Kaspersky TajMahal April 2019)","relationship_id":"relationship--179538d1-5770-42ef-976f-c0fd65faa1ea","references":[{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"}]},{"id":"S0468","name":"Skidmap","url":"https://attack.mitre.org/software/S0468","kind":"malware","description":"[Skidmap](https://attack.mitre.org/software/S0468) has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.(Citation: Trend Micro Skidmap)","relationship_id":"relationship--709d0737-e2ac-4ce3-9772-0dbc06f9667e","references":[{"source_name":"Trend Micro Skidmap","description":"Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"}]},{"id":"S0473","name":"Avenger","url":"https://attack.mitre.org/software/S0473","kind":"malware","description":"[Avenger](https://attack.mitre.org/software/S0473) has the ability to identify the OS architecture on a compromised host.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--fc4c0c44-2e94-47c1-9174-fcf0fa1a80b4","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0475","name":"BackConfig","url":"https://attack.mitre.org/software/S0475","kind":"malware","description":"[BackConfig](https://attack.mitre.org/software/S0475) has the ability to gather the victim's computer name.(Citation: Unit 42 BackConfig May 2020)","relationship_id":"relationship--8763c8dd-cd68-4402-be43-4dbd96c83c2d","references":[{"source_name":"Unit 42 BackConfig May 2020","description":"Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}]},{"id":"S0476","name":"Valak","url":"https://attack.mitre.org/software/S0476","kind":"malware","description":"[Valak](https://attack.mitre.org/software/S0476) can determine the Windows version and computer name on a compromised host.(Citation: Cybereason Valak May 2020)(Citation: SentinelOne Valak June 2020)","relationship_id":"relationship--7b4e1a93-99ca-444d-bfc4-bc589a9a25a9","references":[{"source_name":"SentinelOne Valak June 2020","description":"Reaves, J. and Platt, J. (2020, June). Valak Malware and the Connection to Gozi Loader ConfCrew. Retrieved August 31, 2020.","url":"https://assets.sentinelone.com/labs/sentinel-one-valak-i"},{"source_name":"Cybereason Valak May 2020","description":"Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.","url":"https://www.cybereason.com/blog/valak-more-than-meets-the-eye"}]},{"id":"S0482","name":"Bundlore","url":"https://attack.mitre.org/software/S0482","kind":"malware","description":"[Bundlore](https://attack.mitre.org/software/S0482) will enumerate the macOS version to determine which follow-on behaviors to execute using <code>/usr/bin/sw_vers -productVersion</code>.(Citation: MacKeeper Bundlore Apr 2019)(Citation: 20 macOS Common Tools and Techniques)","relationship_id":"relationship--132c7780-3fa4-478b-b037-f2c1ad99d98f","references":[{"source_name":"MacKeeper Bundlore Apr 2019","description":"Sushko, O. (2019, April 17). macOS Bundlore: Mac Virus Bypassing macOS Security Features. Retrieved June 30, 2020.","url":"https://mackeeper.com/blog/post/610-macos-bundlore-adware-analysis/"},{"source_name":"20 macOS Common Tools and Techniques","description":"Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.","url":"https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"}]},{"id":"S0483","name":"IcedID","url":"https://attack.mitre.org/software/S0483","kind":"malware","description":"[IcedID](https://attack.mitre.org/software/S0483) has the ability to identify the computer name and OS version on a compromised host.(Citation: IBM IcedID November 2017)(Citation: DFIR_Quantum_Ransomware)","relationship_id":"relationship--f36f0a5d-a2a6-440f-8d6f-3fbdafb07af0","references":[{"source_name":"DFIR_Quantum_Ransomware","description":"DFIR. (2022, April 25). Quantum Ransomware. Retrieved July 26, 2024.","url":"https://thedfirreport.com/2022/04/25/quantum-ransomware/"},{"source_name":"IBM IcedID November 2017","description":"Kessem, L., et al. (2017, November 13). New Banking Trojan IcedID Discovered by IBM X-Force Research. Retrieved July 14, 2020.","url":"https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/"}]},{"id":"S0484","name":"Carberp","url":"https://attack.mitre.org/software/S0484","kind":"malware","description":"[Carberp](https://attack.mitre.org/software/S0484) has collected the operating system version from the infected system.(Citation: Prevx Carberp March 2011)","relationship_id":"relationship--dacff5f4-a7ed-424b-847b-377ed2b91679","references":[{"source_name":"Prevx Carberp March 2011","description":"Giuliani, M., Allievi, A. (2011, February 28). Carberp - a modular information stealing trojan. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"}]},{"id":"S0486","name":"Bonadan","url":"https://attack.mitre.org/software/S0486","kind":"malware","description":"[Bonadan](https://attack.mitre.org/software/S0486) has discovered the OS version, CPU model, and RAM size of the system it has been installed on.(Citation: ESET ForSSHe December 2018)","relationship_id":"relationship--34775b6e-f7dd-4b0f-bbb4-c696bfbda1c2","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"S0487","name":"Kessel","url":"https://attack.mitre.org/software/S0487","kind":"malware","description":"[Kessel](https://attack.mitre.org/software/S0487) has collected the system architecture, OS version, and MAC address information.(Citation: ESET ForSSHe December 2018)","relationship_id":"relationship--6e9c79b0-9b63-4785-be48-033ab5f55a18","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"S0493","name":"GoldenSpy","url":"https://attack.mitre.org/software/S0493","kind":"malware","description":"[GoldenSpy](https://attack.mitre.org/software/S0493) has gathered operating system information.(Citation: Trustwave GoldenSpy June 2020)\t","relationship_id":"relationship--1489f01c-fe49-4332-99e2-d72c487403b6","references":[{"source_name":"Trustwave GoldenSpy June 2020","description":"Trustwave SpiderLabs. (2020, June 25). The Golden Tax Department and Emergence of GoldenSpy Malware. Retrieved July 23, 2020.","url":"https://www.trustwave.com/en-us/resources/library/documents/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) can identify the username, machine name, system language, keyboard layout, and OS version on a compromised host.(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Group IB Ransomware May 2020)(Citation: Secureworks REvil September 2019)","relationship_id":"relationship--598d55da-c5f9-447c-acad-0c611f1deda0","references":[{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"},{"source_name":"Cylance Sodinokibi July 2019","description":"Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"},{"source_name":"Group IB Ransomware May 2020","description":"Group IB. (2020, May). Ransomware Uncovered: Attackers’ Latest Methods. Retrieved August 5, 2020.","url":"https://www.group-ib.com/whitepapers/ransomware-uncovered.html"},{"source_name":"Intel 471 REvil March 2020","description":"Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"Kaspersky Sodin July 2019","description":"Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.","url":"https://securelist.com/sodin-ransomware/91473/"},{"source_name":"McAfee Sodinokibi October 2019","description":"McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"},{"source_name":"Secureworks GandCrab and REvil September 2019","description":"Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.","url":"https://www.secureworks.com/blog/revil-the-gandcrab-connection"}]},{"id":"S0501","name":"PipeMon","url":"https://attack.mitre.org/software/S0501","kind":"malware","description":"[PipeMon](https://attack.mitre.org/software/S0501) can collect and send OS version and computer name as a part of its C2 beacon.(Citation: ESET PipeMon May 2020)","relationship_id":"relationship--270c93ba-a3d4-4ace-8fad-691c64c13e2f","references":[{"source_name":"ESET PipeMon May 2020","description":"Tartare, M. et al. (2020, May 21). No “Game over” for the Winnti Group. Retrieved August 24, 2020.","url":"https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/"}]},{"id":"S0504","name":"Anchor","url":"https://attack.mitre.org/software/S0504","kind":"malware","description":"[Anchor](https://attack.mitre.org/software/S0504) can determine the hostname and linux version on a compromised host.(Citation: Medium Anchor DNS July 2020)","relationship_id":"relationship--23c89ec7-3407-4f6d-8b4b-0ab16fbf356c","references":[{"source_name":"Medium Anchor DNS July 2020","description":"Grange, W. (2020, July 13). Anchor_dns malware goes cross platform. Retrieved September 10, 2020.","url":"https://medium.com/stage-2-security/anchor-dns-malware-family-goes-cross-platform-d807ba13ca30"}]},{"id":"S0512","name":"FatDuke","url":"https://attack.mitre.org/software/S0512","kind":"malware","description":"[FatDuke](https://attack.mitre.org/software/S0512) can collect the user name, Windows version, computer name, and available space on discs from a compromised host.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--4f5fd1ed-a91e-4a9e-b2e8-6c45cc31e065","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0513","name":"LiteDuke","url":"https://attack.mitre.org/software/S0513","kind":"malware","description":"[LiteDuke](https://attack.mitre.org/software/S0513) can enumerate the CPUID and BIOS version on a compromised system.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--137ce702-f0e6-4dfa-8ca5-439155d91af9","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0514","name":"WellMess","url":"https://attack.mitre.org/software/S0514","kind":"malware","description":"[WellMess](https://attack.mitre.org/software/S0514) can identify the computer name of a compromised host.(Citation: PWC WellMess July 2020)(Citation: CISA WellMess July 2020)","relationship_id":"relationship--5e967f56-9186-43d5-b748-4ee383df4174","references":[{"source_name":"PWC WellMess July 2020","description":"PWC. (2020, July 16). How WellMess malware has been used to target COVID-19 vaccines. Retrieved September 24, 2020.","url":"https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"},{"source_name":"CISA WellMess July 2020","description":"CISA. (2020, July 16). MAR-10296782-2.v1 – WELLMESS. Retrieved September 24, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198b"}]},{"id":"S0516","name":"SoreFang","url":"https://attack.mitre.org/software/S0516","kind":"malware","description":"[SoreFang](https://attack.mitre.org/software/S0516) can collect the hostname, operating system configuration, and product ID on victim machines by executing [Systeminfo](https://attack.mitre.org/software/S0096).(Citation: CISA SoreFang July 2016)","relationship_id":"relationship--75e01f6a-9f45-4db2-a79d-a21453b6d83f","references":[{"source_name":"CISA SoreFang July 2016","description":"CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}]},{"id":"S0520","name":"BLINDINGCAN","url":"https://attack.mitre.org/software/S0520","kind":"malware","description":"[BLINDINGCAN](https://attack.mitre.org/software/S0520) has collected from a victim machine the system name, processor information, and OS version.(Citation: US-CERT BLINDINGCAN Aug 2020)","relationship_id":"relationship--11ed4654-a7bf-4063-9452-6d6174b9f8bc","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","description":"US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"}]},{"id":"S0531","name":"Grandoreiro","url":"https://attack.mitre.org/software/S0531","kind":"malware","description":"[Grandoreiro](https://attack.mitre.org/software/S0531) can collect the computer name and OS version from a compromised host.(Citation: ESET Grandoreiro April 2020)","relationship_id":"relationship--68fc9cf1-d191-4ebd-af14-004519ab76d7","references":[{"source_name":"ESET Grandoreiro April 2020","description":"ESET. (2020, April 28). Grandoreiro: How engorged can an EXE get?. Retrieved November 13, 2020.","url":"https://www.welivesecurity.com/2020/04/28/grandoreiro-how-engorged-can-exe-get/"}]},{"id":"S0532","name":"Lucifer","url":"https://attack.mitre.org/software/S0532","kind":"malware","description":"[Lucifer](https://attack.mitre.org/software/S0532) can collect the computer name, system architecture, default language, and processor frequency of a compromised host.(Citation: Unit 42 Lucifer June 2020)","relationship_id":"relationship--aecb4057-07a2-4b44-805a-5566a4047e23","references":[{"source_name":"Unit 42 Lucifer June 2020","description":"Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.","url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/"}]},{"id":"S0533","name":"SLOTHFULMEDIA","url":"https://attack.mitre.org/software/S0533","kind":"malware","description":"[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) has collected system name, OS version, adapter information, and memory usage from a victim machine.(Citation: CISA MAR SLOTHFULMEDIA October 2020)","relationship_id":"relationship--f8a9e39a-0038-437c-96ad-4408d028dd86","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","description":"DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can fingerprint architecture, computer name, and OS version on the compromised host. [Bazar](https://attack.mitre.org/software/S0534) can also check if the Russian language is installed on the infected machine and terminate if it is found.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)","relationship_id":"relationship--f6f600fd-796d-4f1f-b2c6-0ca283b2cdb1","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"NCC Group Team9 June 2020","description":"Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}]},{"id":"S0543","name":"Spark","url":"https://attack.mitre.org/software/S0543","kind":"malware","description":"[Spark](https://attack.mitre.org/software/S0543) can collect the hostname, keyboard layout, and language from the system.(Citation: Unit42 Molerat Mar 2020) ","relationship_id":"relationship--7f659555-cfc4-420f-8548-3a89aa1da8c9","references":[{"source_name":"Unit42 Molerat Mar 2020","description":"Falcone, R., et al. (2020, March 3). Molerats Delivers Spark Backdoor to Government and Telecommunications Organizations. Retrieved December 14, 2020.","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}]},{"id":"S0546","name":"SharpStage","url":"https://attack.mitre.org/software/S0546","kind":"malware","description":"[SharpStage](https://attack.mitre.org/software/S0546) has checked the system settings to see if Arabic is the configured language.(Citation: BleepingComputer Molerats Dec 2020)","relationship_id":"relationship--9e85e741-0dcd-4a15-a35a-a920f46824c2","references":[{"source_name":"BleepingComputer Molerats Dec 2020","description":"Ilascu, I. (2020, December 14). Hacking group’s new malware abuses Google and Facebook services. Retrieved December 28, 2020.","url":"https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/"}]},{"id":"S0547","name":"DropBook","url":"https://attack.mitre.org/software/S0547","kind":"malware","description":"[DropBook](https://attack.mitre.org/software/S0547) has checked for the presence of Arabic language in the infected machine's settings.(Citation: Cybereason Molerats Dec 2020) ","relationship_id":"relationship--e11c02c8-e740-489f-925f-33c05c94c80f","references":[{"source_name":"Cybereason Molerats Dec 2020","description":"Cybereason Nocturnus Team. (2020, December 9). MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign. Retrieved December 22, 2020.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"}]},{"id":"S0553","name":"MoleNet","url":"https://attack.mitre.org/software/S0553","kind":"malware","description":"[MoleNet](https://attack.mitre.org/software/S0553) can collect information about the about the system.(Citation: Cybereason Molerats Dec 2020)","relationship_id":"relationship--01b542b1-3222-459b-9cdf-b91dcd29c749","references":[{"source_name":"Cybereason Molerats Dec 2020","description":"Cybereason Nocturnus Team. (2020, December 9). MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign. Retrieved December 22, 2020.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"}]},{"id":"S0554","name":"Egregor","url":"https://attack.mitre.org/software/S0554","kind":"malware","description":"[Egregor](https://attack.mitre.org/software/S0554) can perform a language check of the infected system and can query the CPU information (cupid).(Citation: JoeSecurity Egregor 2020)(Citation: NHS Digital Egregor Nov 2020)","relationship_id":"relationship--f0a74237-9a46-4ea8-a268-3ac87f593ea9","references":[{"source_name":"JoeSecurity Egregor 2020","description":"Joe Security. (n.d.). Analysis Report fasm.dll. Retrieved November 17, 2024.","url":"https://www.joesandbox.com/analysis/326673/0/pdf"},{"source_name":"NHS Digital Egregor Nov 2020","description":"NHS Digital. (2020, November 26). Egregor Ransomware The RaaS successor to Maze. Retrieved December 29, 2020.","url":"https://digital.nhs.uk/cyber-alerts/2020/cc-3681#summary"}]},{"id":"S0556","name":"Pay2Key","url":"https://attack.mitre.org/software/S0556","kind":"malware","description":"[Pay2Key](https://attack.mitre.org/software/S0556) has the ability to gather the hostname of the victim machine.(Citation: Check Point Pay2Key November 2020)","relationship_id":"relationship--85b17ee3-cd16-4f7d-bfaa-23e756f344d5","references":[{"source_name":"Check Point Pay2Key November 2020","description":"Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.","url":"https://research.checkpoint.com/2020/ransomware-alert-pay2key/"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) collected hostname and OS version.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)","relationship_id":"relationship--142afe71-581e-415e-9867-97ac0aaded65","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"},{"source_name":"Microsoft Analyzing Solorigate Dec 2020","description":"MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.","url":"https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"}]},{"id":"S0567","name":"Dtrack","url":"https://attack.mitre.org/software/S0567","kind":"malware","description":"[Dtrack](https://attack.mitre.org/software/S0567) can collect the victim's computer name, hostname and adapter information to create a unique identifier.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)","relationship_id":"relationship--1b47deed-a8b9-4e0f-a47e-9570ecccaa90","references":[{"source_name":"Securelist Dtrack","description":"Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.","url":"https://securelist.com/my-name-is-dtrack/93338/"},{"source_name":"CyberBit Dtrack","description":"Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.","url":"https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"}]},{"id":"S0568","name":"EVILNUM","url":"https://attack.mitre.org/software/S0568","kind":"malware","description":"[EVILNUM](https://attack.mitre.org/software/S0568) can obtain the computer name from the victim's system.(Citation: Prevailion EvilNum May 2020)","relationship_id":"relationship--3ff46c64-10c7-474c-86eb-c66f1f85f5ac","references":[{"source_name":"Prevailion EvilNum May 2020","description":"Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/"}]},{"id":"S0569","name":"Explosive","url":"https://attack.mitre.org/software/S0569","kind":"malware","description":"[Explosive](https://attack.mitre.org/software/S0569) has collected the computer name from the infected host.(Citation: CheckPoint Volatile Cedar March 2015) ","relationship_id":"relationship--c0220333-2cfb-4449-acbb-9bea0b7751b4","references":[{"source_name":"CheckPoint Volatile Cedar March 2015","description":"Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"}]},{"id":"S0572","name":"Caterpillar WebShell","url":"https://attack.mitre.org/software/S0572","kind":"malware","description":"[Caterpillar WebShell](https://attack.mitre.org/software/S0572) has a module to gather information from the compromised asset, including the computer version, computer name, IIS version, and more.(Citation: ClearSky Lebanese Cedar Jan 2021) ","relationship_id":"relationship--b844919a-e7d8-4317-9f0d-56338bae818c","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","description":"ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"id":"S0584","name":"AppleJeus","url":"https://attack.mitre.org/software/S0584","kind":"malware","description":"[AppleJeus](https://attack.mitre.org/software/S0584) has collected the victim host information after infection.(Citation: CISA AppleJeus Feb 2021)","relationship_id":"relationship--70c29cd1-53a2-48a6-8f94-515e7812013b","references":[{"source_name":"CISA AppleJeus Feb 2021","description":"Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}]},{"id":"S0585","name":"Kerrdown","url":"https://attack.mitre.org/software/S0585","kind":"malware","description":"[Kerrdown](https://attack.mitre.org/software/S0585) has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.(Citation: Unit 42 KerrDown February 2019)","relationship_id":"relationship--7727f1e9-4914-4512-a319-3e5758c47602","references":[{"source_name":"Unit 42 KerrDown February 2019","description":"Ray, V. and Hayashi, K. (2019, February 1). Tracking OceanLotus’ new Downloader, KerrDown. Retrieved October 1, 2021.","url":"https://unit42.paloaltonetworks.com/tracking-oceanlotus-new-downloader-kerrdown/"}]},{"id":"S0587","name":"Penquin","url":"https://attack.mitre.org/software/S0587","kind":"malware","description":"[Penquin](https://attack.mitre.org/software/S0587) can report the file system type of a compromised host to C2.(Citation: Leonardo Turla Penquin May 2020)","relationship_id":"relationship--e2b67455-4986-46f4-a4ff-f5ee215ef998","references":[{"source_name":"Leonardo Turla Penquin May 2020","description":"Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021.","url":"https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"}]},{"id":"S0596","name":"ShadowPad","url":"https://attack.mitre.org/software/S0596","kind":"malware","description":"[ShadowPad](https://attack.mitre.org/software/S0596) has discovered system information including memory status, CPU frequency, and OS versions.(Citation: Kaspersky ShadowPad Aug 2017)","relationship_id":"relationship--d216c395-ceb2-4103-8035-336a0821b79c","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","description":"Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}]},{"id":"S0601","name":"Hildegard","url":"https://attack.mitre.org/software/S0601","kind":"malware","description":"[Hildegard](https://attack.mitre.org/software/S0601) has collected the host's OS, CPU, and memory information.(Citation: Unit 42 Hildegard Malware)","relationship_id":"relationship--810630f3-01fb-416d-992c-3f5a0390d962","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) collects system information including computer and domain names, OS version, and S7P paths.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--061cfa7a-df09-40cc-bed5-35407b425cb8","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604) collects the victim machine’s Windows GUID.(Citation: Dragos Crashoverride 2017)","relationship_id":"relationship--d0592d8b-cb1e-431f-a27e-1412892ca030","references":[{"source_name":"Dragos Crashoverride 2017","description":"Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.","url":"https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"}]},{"id":"S0610","name":"SideTwist","url":"https://attack.mitre.org/software/S0610","kind":"malware","description":"[SideTwist](https://attack.mitre.org/software/S0610) can collect the computer name of a targeted system.(Citation: Check Point APT34 April 2021)","relationship_id":"relationship--d68f3474-8ba0-45e8-8876-3b1dd8a56fbf","references":[{"source_name":"Check Point APT34 April 2021","description":"Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) can execute <code>getinfo</code> to enumerate the computer name and OS version of a compromised system.(Citation: BlackBerry CostaRicto November 2020)","relationship_id":"relationship--ff3ade9d-2665-4794-bb1e-cb436d790f3f","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}]},{"id":"S0622","name":"AppleSeed","url":"https://attack.mitre.org/software/S0622","kind":"malware","description":"[AppleSeed](https://attack.mitre.org/software/S0622) can identify the OS version of a targeted system.(Citation: Malwarebytes Kimsuky June 2021)","relationship_id":"relationship--7920e962-00d7-4eb0-a94d-ed1ca196cd50","references":[{"source_name":"Malwarebytes Kimsuky June 2021","description":"Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"id":"S0627","name":"SodaMaster","url":"https://attack.mitre.org/software/S0627","kind":"malware","description":"[SodaMaster](https://attack.mitre.org/software/S0627) can enumerate the host name and OS version on a target system.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--695e51bb-e410-40b1-b8fc-d40734796729","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"S0631","name":"Chaes","url":"https://attack.mitre.org/software/S0631","kind":"malware","description":"[Chaes](https://attack.mitre.org/software/S0631) has collected system information, including the machine name and OS version.(Citation: Cybereason Chaes Nov 2020)","relationship_id":"relationship--ee466042-fd08-4c86-898d-63fc5d4ed1d6","references":[{"source_name":"Cybereason Chaes Nov 2020","description":"Salem, E. (2020, November 17). CHAES: Novel Malware Targeting Latin American E-Commerce. Retrieved June 30, 2021.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/11-2020-Chaes-e-commerce-malware-research.pdf"}]},{"id":"S0632","name":"GrimAgent","url":"https://attack.mitre.org/software/S0632","kind":"malware","description":"[GrimAgent](https://attack.mitre.org/software/S0632) can collect the OS, and build version on a compromised host.(Citation: Group IB GrimAgent July 2021)","relationship_id":"relationship--eed367b8-b1d1-492e-a376-6725b6db7103","references":[{"source_name":"Group IB GrimAgent July 2021","description":"Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.","url":"https://www.group-ib.com/blog/grimagent/"}]},{"id":"S0634","name":"EnvyScout","url":"https://attack.mitre.org/software/S0634","kind":"malware","description":"[EnvyScout](https://attack.mitre.org/software/S0634) can determine whether the ISO payload was received by a Windows or iOS device.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--055a15db-2f5b-4c61-821e-36de6f83a90b","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0635","name":"BoomBox","url":"https://attack.mitre.org/software/S0635","kind":"malware","description":"[BoomBox](https://attack.mitre.org/software/S0635) can enumerate the hostname, domain, and IP of a compromised host.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--773efcb6-760f-496f-92e9-2387d04d2c53","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0641","name":"Kobalos","url":"https://attack.mitre.org/software/S0641","kind":"malware","description":"[Kobalos](https://attack.mitre.org/software/S0641) can record the hostname and kernel version of the target machine.(Citation: ESET Kobalos Jan 2021)","relationship_id":"relationship--f068a0fc-0461-4034-a0ea-b629788bc9f3","references":[{"source_name":"ESET Kobalos Jan 2021","description":"M.Leveille, M., Sanmillan, I. (2021, January). A WILD KOBALOS APPEARS Tricksy Linux malware goes after HPCs. Retrieved August 24, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/01/ESET_Kobalos.pdf"}]},{"id":"S0642","name":"BADFLICK","url":"https://attack.mitre.org/software/S0642","kind":"malware","description":"[BADFLICK](https://attack.mitre.org/software/S0642) has captured victim computer name, memory space, and CPU details.(Citation: Accenture MUDCARP March 2019)","relationship_id":"relationship--634d3199-9979-4df1-8fbe-5fc355726602","references":[{"source_name":"Accenture MUDCARP March 2019","description":"Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"}]},{"id":"S0644","name":"ObliqueRAT","url":"https://attack.mitre.org/software/S0644","kind":"malware","description":"[ObliqueRAT](https://attack.mitre.org/software/S0644) has the ability to check for blocklisted computer names on infected endpoints.(Citation: Talos Oblique RAT March 2021)","relationship_id":"relationship--792376f7-db54-4ae9-b50a-38b67ed96053","references":[{"source_name":"Talos Oblique RAT March 2021","description":"Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}]},{"id":"S0646","name":"SpicyOmelette","url":"https://attack.mitre.org/software/S0646","kind":"malware","description":"[SpicyOmelette](https://attack.mitre.org/software/S0646) can identify the system name of a compromised host.(Citation: Secureworks GOLD KINGSWOOD September 2018)","relationship_id":"relationship--44272fb3-a31d-4cea-b11c-b65e2bdcbd68","references":[{"source_name":"Secureworks GOLD KINGSWOOD September 2018","description":"CTU. (2018, September 27). Cybercriminals Increasingly Trying to Ensnare the Big Financial Fish. Retrieved September 20, 2021.","url":"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"}]},{"id":"S0647","name":"Turian","url":"https://attack.mitre.org/software/S0647","kind":"malware","description":"[Turian](https://attack.mitre.org/software/S0647) can retrieve system information including OS version, memory usage, local hostname, and system adapter information.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--da0a0a14-0f29-43f8-abf7-b281a1071928","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"S0649","name":"SMOKEDHAM","url":"https://attack.mitre.org/software/S0649","kind":"malware","description":"[SMOKEDHAM](https://attack.mitre.org/software/S0649) has used the <code>systeminfo</code> command on a compromised host.(Citation: FireEye SMOKEDHAM June 2021)","relationship_id":"relationship--4ae0fc35-a321-4ffb-b7fa-b03a20230fc4","references":[{"source_name":"FireEye SMOKEDHAM June 2021","description":"FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can collect system information including the OS version and domain on a compromised host.(Citation: Crowdstrike Qakbot October 2020)(Citation: ATT QakBot April 2021)(Citation: Group IB Ransomware September 2020)(Citation: Microsoft Ransomware as a Service)","relationship_id":"relationship--d5be9ea1-7bf2-453b-bbca-19a9d82ea532","references":[{"source_name":"Crowdstrike Qakbot October 2020","description":"CS. (2020, October 7). Duck Hunting with Falcon Complete: A Fowl Banking Trojan Evolves, Part 2. Retrieved September 27, 2021.","url":"https://www.crowdstrike.com/blog/duck-hunting-with-falcon-complete-qakbot-zip-based-campaign/"},{"source_name":"Group IB Ransomware September 2020","description":"Group IB. (2020, September). LOCK LIKE  A PRO. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220119114433/https://groupib.pathfactory.com/ransomware-reports/prolock_wp"},{"source_name":"Microsoft Ransomware as a Service","description":"Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"},{"source_name":"ATT QakBot April 2021","description":"Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.","url":"https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"}]},{"id":"S0652","name":"MarkiRAT","url":"https://attack.mitre.org/software/S0652","kind":"malware","description":"[MarkiRAT](https://attack.mitre.org/software/S0652) can obtain the computer name from a compromised host.(Citation: Kaspersky Ferocious Kitten Jun 2021)","relationship_id":"relationship--7ac890f4-b4d0-4899-be19-bcbda48c3736","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","description":"GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"id":"S0657","name":"BLUELIGHT","url":"https://attack.mitre.org/software/S0657","kind":"malware","description":"[BLUELIGHT](https://attack.mitre.org/software/S0657) has collected the computer name and OS version from victim machines.(Citation: Volexity InkySquid BLUELIGHT August 2021)","relationship_id":"relationship--1da27474-f902-419e-97a9-1fba8743cce8","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","description":"Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}]},{"id":"S0658","name":"XCSSET","url":"https://attack.mitre.org/software/S0658","kind":"malware","description":"[XCSSET](https://attack.mitre.org/software/S0658) identifies the macOS version and uses <code>ioreg</code> to determine serial number.(Citation: trendmicro xcsset xcode project 2020)","relationship_id":"relationship--cb37da3b-6ffd-4882-9680-4e467f25d7f4","references":[{"source_name":"trendmicro xcsset xcode project 2020","description":"Mac Threat Response, Mobile Research Team. (2020, August 13). The XCSSET Malware: Inserts Malicious Code Into Xcode Projects, Performs UXSS Backdoor Planting in Safari, and Leverages Two Zero-day Exploits. Retrieved October 5, 2021.","url":"https://documents.trendmicro.com/assets/pdf/XCSSET_Technical_Brief.pdf"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) can collect the computer name and OS version from the system.(Citation: Fortinet Diavol July 2021)","relationship_id":"relationship--ccd4c695-2458-4eb0-ad9c-a19d411f7627","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) can discover the hostname, computer name, and Windows version of a targeted machine.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)","relationship_id":"relationship--8b4c7113-2f11-44a7-863d-1ff49ae64215","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Talent-Jump Clambling February 2020","description":"Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.","url":"https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"}]},{"id":"S0662","name":"RCSession","url":"https://attack.mitre.org/software/S0662","kind":"malware","description":"[RCSession](https://attack.mitre.org/software/S0662) can gather system information from a compromised host.(Citation: Profero APT27 December 2020)","relationship_id":"relationship--d7e5009a-1eb3-4b74-ad0c-53ba0e151935","references":[{"source_name":"Profero APT27 December 2020","description":"Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"}]},{"id":"S0663","name":"SysUpdate","url":"https://attack.mitre.org/software/S0663","kind":"malware","description":"[SysUpdate](https://attack.mitre.org/software/S0663) can collect a system's architecture, operating system version, and hostname.(Citation: Trend Micro Iron Tiger April 2021)(Citation: Lunghi Iron Tiger Linux)","relationship_id":"relationship--89d37095-2f31-42e9-b8f7-3abdd76d5f57","references":[{"source_name":"Lunghi Iron Tiger Linux","description":"Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"},{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S0665","name":"ThreatNeedle","url":"https://attack.mitre.org/software/S0665","kind":"malware","description":"[ThreatNeedle](https://attack.mitre.org/software/S0665) can collect system profile information from a compromised host.(Citation: Kaspersky ThreatNeedle Feb 2021)","relationship_id":"relationship--53d7fdab-05fb-4427-b0e0-11463e05b3f3","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","description":"Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--86b8a22d-66c3-4b54-82fd-662455d0e2c5","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0667","name":"Chrommme","url":"https://attack.mitre.org/software/S0667","kind":"malware","description":"[Chrommme](https://attack.mitre.org/software/S0667) has the ability to obtain the computer name of a compromised host.(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--52f3a62b-621b-4cef-86f6-8152fa719473","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0669","name":"KOCTOPUS","url":"https://attack.mitre.org/software/S0669","kind":"malware","description":"[KOCTOPUS](https://attack.mitre.org/software/S0669) has checked the OS version using `wmic.exe` and the `find` command.(Citation: MalwareBytes LazyScripter Feb 2021)","relationship_id":"relationship--55f54b3e-7058-4299-98e8-ab33dd42a6ef","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","description":"Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) can collect compromised host information, including OS version, PC name, RAM size, and CPU details.(Citation: Check Point Warzone Feb 2020)","relationship_id":"relationship--384b6787-f69b-4d81-bc5e-c01a5c5b026e","references":[{"source_name":"Check Point Warzone Feb 2020","description":"Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) can collect the OS version, system architecture, and computer name.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--ecb55914-837c-4600-a0f8-65d83d2d726b","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S0674","name":"CharmPower","url":"https://attack.mitre.org/software/S0674","kind":"malware","description":"[CharmPower](https://attack.mitre.org/software/S0674) can enumerate the OS version and computer name on a targeted system.(Citation: Check Point APT35 CharmPower January 2022)","relationship_id":"relationship--0586324a-680a-46a4-917b-8c00c7211065","references":[{"source_name":"Check Point APT35 CharmPower January 2022","description":"Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}]},{"id":"S0679","name":"Ferocious","url":"https://attack.mitre.org/software/S0679","kind":"malware","description":"[Ferocious](https://attack.mitre.org/software/S0679) can use <code>GET.WORKSPACE</code> in Microsoft Excel to determine the OS version of the compromised host.(Citation: Kaspersky WIRTE November 2021)","relationship_id":"relationship--c6172742-12ae-4d3f-9fd6-194cfdc93de7","references":[{"source_name":"Kaspersky WIRTE November 2021","description":"Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"id":"S0680","name":"LitePower","url":"https://attack.mitre.org/software/S0680","kind":"malware","description":"[LitePower](https://attack.mitre.org/software/S0680) has the ability to enumerate the OS architecture.(Citation: Kaspersky WIRTE November 2021)","relationship_id":"relationship--f93060a3-7c58-444f-a45e-1386c289cee6","references":[{"source_name":"Kaspersky WIRTE November 2021","description":"Yamout, M. (2021, November 29). WIRTE’s campaign in the Middle East ‘living off the land’ since at least 2019. Retrieved February 1, 2022.","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"id":"S0681","name":"Lizar","url":"https://attack.mitre.org/software/S0681","kind":"malware","description":"[Lizar](https://attack.mitre.org/software/S0681) can collect the computer name from the machine.(Citation: BiZone Lizar May 2021)(Citation: SekoiaBourhis_DiceLoader_Feb2024)","relationship_id":"relationship--aaa42f0a-5709-45e2-81d3-0687b3c72cc9","references":[{"source_name":"BiZone Lizar May 2021","description":"BI.ZONE Cyber Threats Research Team. (2021, May 13). From pentest to APT attack: cybercriminal group FIN7 disguises its malware as an ethical hacker’s toolkit. Retrieved February 2, 2022.","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"},{"source_name":"SekoiaBourhis_DiceLoader_Feb2024","description":"Bourhis, P., Sekoia TDR. (2024, February 1). Unveiling the intricacies of DiceLoader. Retrieved May 14, 2025.","url":"https://blog.sekoia.io/unveiling-the-intricacies-of-diceloader/"}]},{"id":"S0687","name":"Cyclops Blink","url":"https://attack.mitre.org/software/S0687","kind":"malware","description":"[Cyclops Blink](https://attack.mitre.org/software/S0687) has the ability to query device information.(Citation: NCSC Cyclops Blink February 2022)","relationship_id":"relationship--350776c3-9234-4c8f-adff-9b36778e90c4","references":[{"source_name":"NCSC Cyclops Blink February 2022","description":"NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022.","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"}]},{"id":"S0688","name":"Meteor","url":"https://attack.mitre.org/software/S0688","kind":"malware","description":"[Meteor](https://attack.mitre.org/software/S0688) has the ability to discover the hostname of a compromised host.(Citation: Check Point Meteor Aug 2021)","relationship_id":"relationship--c3893875-4f9e-43e4-babf-6f45ec485444","references":[{"source_name":"Check Point Meteor Aug 2021","description":"Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.","url":"https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"}]},{"id":"S0690","name":"Green Lambert","url":"https://attack.mitre.org/software/S0690","kind":"malware","description":"[Green Lambert](https://attack.mitre.org/software/S0690) can use `uname` to identify the operating system name, version, and processor type.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citation: Glitch-Cat Green Lambert ATTCK Oct 2021)  ","relationship_id":"relationship--48ee2b91-2ce7-46c0-a27a-aea1695355b4","references":[{"source_name":"Objective See Green Lambert for OSX Oct 2021","description":"Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.","url":"https://objective-see.com/blog/blog_0x68.html"},{"source_name":"Glitch-Cat Green Lambert ATTCK Oct 2021","description":"Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211018145402/https://www.glitch-cat.com/blog/green-lambert-and-attack"}]},{"id":"S0691","name":"Neoichor","url":"https://attack.mitre.org/software/S0691","kind":"malware","description":"[Neoichor](https://attack.mitre.org/software/S0691) can collect the OS version and computer name from a compromised host.(Citation: Microsoft NICKEL December 2021)","relationship_id":"relationship--c089604b-f25e-4a4c-857b-0c2d157d34bb","references":[{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can collect information related to a compromised host, including OS version.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--fbe4387a-5e79-45e0-aae1-9b3a53dcd3ee","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0693","name":"CaddyWiper","url":"https://attack.mitre.org/software/S0693","kind":"malware","description":"[CaddyWiper](https://attack.mitre.org/software/S0693) can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. [CaddyWiper](https://attack.mitre.org/software/S0693) can also halt execution if the compromised host is identified as a domain controller.(Citation: Cisco CaddyWiper March 2022)(Citation: Malwarebytes IssacWiper CaddyWiper March 2022 )","relationship_id":"relationship--6b7ef377-d7c3-47ca-9707-03d4ccaf5adb","references":[{"source_name":"Cisco CaddyWiper March 2022","description":"Malhotra, A. (2022, March 15). Threat Advisory: CaddyWiper. Retrieved March 23, 2022.","url":"https://blog.talosintelligence.com/2022/03/threat-advisory-caddywiper.html"},{"source_name":"Malwarebytes IssacWiper CaddyWiper March 2022 ","description":"Threat Intelligence Team. (2022, March 18). Double header: IsaacWiper and CaddyWiper . Retrieved April 11, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/03/double-header-isaacwiper-and-caddywiper/"}]},{"id":"S0697","name":"HermeticWiper","url":"https://attack.mitre.org/software/S0697","kind":"malware","description":"[HermeticWiper](https://attack.mitre.org/software/S0697) can determine the OS version and bitness on a targeted host.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Crowdstrike DriveSlayer February 2022)(Citation: ESET Hermetic Wizard March 2022)(Citation: Qualys Hermetic Wiper March 2022)","relationship_id":"relationship--87a01c6d-b7a3-481f-82a9-5dee8c6f91db","references":[{"source_name":"Qualys Hermetic Wiper March 2022","description":"Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"},{"source_name":"ESET Hermetic Wizard March 2022","description":"ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"},{"source_name":"SentinelOne Hermetic Wiper February 2022","description":"Guerrero-Saade, J. (2022, February 23). HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine. Retrieved March 25, 2022.","url":"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"},{"source_name":"Crowdstrike DriveSlayer February 2022","description":"Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022.","url":"https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"}]},{"id":"S1013","name":"ZxxZ","url":"https://attack.mitre.org/software/S1013","kind":"malware","description":"[ZxxZ](https://attack.mitre.org/software/S1013) has collected the host name and operating system product name from a compromised machine.(Citation: Cisco Talos Bitter Bangladesh May 2022) ","relationship_id":"relationship--16e1777b-af28-412b-bcc3-469aba0f8a87","references":[{"source_name":"Cisco Talos Bitter Bangladesh May 2022","description":"Raghuprasad, C . (2022, May 11). Bitter APT adds Bangladesh to their targets. Retrieved June 1, 2022.","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"id":"S1015","name":"Milan","url":"https://attack.mitre.org/software/S1015","kind":"malware","description":"[Milan](https://attack.mitre.org/software/S1015) can enumerate the targeted machine's name and GUID.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)","relationship_id":"relationship--1daf23d1-fdf0-4858-8509-836efb883f18","references":[{"source_name":"Accenture Lyceum Targets November 2021","description":"Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.","url":"https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"},{"source_name":"ClearSky Siamesekitten August 2021","description":"ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.","url":"https://www.clearskysec.com/siamesekitten/"}]},{"id":"S1016","name":"MacMa","url":"https://attack.mitre.org/software/S1016","kind":"malware","description":"[MacMa](https://attack.mitre.org/software/S1016) can collect information about a compromised computer, including: Hardware UUID, Mac serial number, and macOS version.(Citation: ESET DazzleSpy Jan 2022)","relationship_id":"relationship--1501c966-8f40-4093-b0d1-b3d572b3a1ee","references":[{"source_name":"ESET DazzleSpy Jan 2022","description":"M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) can identify the OS version, CPU, and other details from a victim's machine.(Citation: Malwarebytes Saint Bot April 2021)","relationship_id":"relationship--4eb0635f-1851-4516-a584-4d5ff3c2e078","references":[{"source_name":"Malwarebytes Saint Bot April 2021","description":"Hasherezade. (2021, April 6). A deep dive into Saint Bot, a new downloader. Retrieved June 9, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/a-deep-dive-into-saint-bot-downloader/"}]},{"id":"S1019","name":"Shark","url":"https://attack.mitre.org/software/S1019","kind":"malware","description":"[Shark](https://attack.mitre.org/software/S1019) can collect the GUID of a targeted machine.(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)","relationship_id":"relationship--21f5a441-fe32-430e-935c-0929f4101b6e","references":[{"source_name":"Accenture Lyceum Targets November 2021","description":"Accenture. (2021, November 9). Who are latest targets of cyber group Lyceum?. Retrieved June 16, 2022.","url":"https://www.accenture.com/us-en/blogs/cyber-defense/iran-based-lyceum-campaigns"},{"source_name":"ClearSky Siamesekitten August 2021","description":"ClearSky Cyber Security . (2021, August). New Iranian Espionage Campaign By “Siamesekitten” - Lyceum. Retrieved June 6, 2022.","url":"https://www.clearskysec.com/siamesekitten/"}]},{"id":"S1020","name":"Kevin","url":"https://attack.mitre.org/software/S1020","kind":"malware","description":"[Kevin](https://attack.mitre.org/software/S1020) can enumerate the OS version and hostname of a targeted machine.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--2b9ce635-3ce2-4145-864e-70b0b09438b8","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"S1022","name":"IceApple","url":"https://attack.mitre.org/software/S1022","kind":"malware","description":"The [IceApple](https://attack.mitre.org/software/S1022) Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.(Citation: CrowdStrike IceApple May 2022)","relationship_id":"relationship--ca765e99-996e-4d0f-ada0-5c44d3930404","references":[{"source_name":"CrowdStrike IceApple May 2022","description":"CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022.","url":"https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"}]},{"id":"S1025","name":"Amadey","url":"https://attack.mitre.org/software/S1025","kind":"malware","description":"[Amadey](https://attack.mitre.org/software/S1025) has collected the computer name and OS version from a compromised machine.(Citation: Korean FSI TA505 2020)(Citation: BlackBerry Amadey 2020)","relationship_id":"relationship--a6904fd0-d121-4b26-b05c-1615e3baf599","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="},{"source_name":"BlackBerry Amadey 2020","description":"Kasuya, M. (2020, January 8). Threat Spotlight: Amadey Bot Targets Non-Russian Users. Retrieved July 14, 2022.","url":"https://blogs.blackberry.com/en/2020/01/threat-spotlight-amadey-bot"}]},{"id":"S1026","name":"Mongall","url":"https://attack.mitre.org/software/S1026","kind":"malware","description":"[Mongall](https://attack.mitre.org/software/S1026) can retrieve the hostname via `gethostbyname`.(Citation: SentinelOne Aoqin Dragon June 2022)\n","relationship_id":"relationship--d336d669-ef00-476d-81f6-0fe88093e1e6","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"S1028","name":"Action RAT","url":"https://attack.mitre.org/software/S1028","kind":"malware","description":"[Action RAT](https://attack.mitre.org/software/S1028) has the ability to collect the hostname, OS version, and OS architecture of an infected host.(Citation: MalwareBytes SideCopy Dec 2021)","relationship_id":"relationship--c707d09b-1b36-4a1c-99be-c905fdd3ff6b","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","description":"Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"id":"S1029","name":"AuTo Stealer","url":"https://attack.mitre.org/software/S1029","kind":"malware","description":"[AuTo Stealer](https://attack.mitre.org/software/S1029) has the ability to collect the hostname and OS information from an infected host.(Citation: MalwareBytes SideCopy Dec 2021)","relationship_id":"relationship--96ef9f6c-46aa-4a59-ad5a-5ef72279d12a","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","description":"Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"id":"S1030","name":"Squirrelwaffle","url":"https://attack.mitre.org/software/S1030","kind":"malware","description":"[Squirrelwaffle](https://attack.mitre.org/software/S1030) has gathered victim computer information and configurations.(Citation: ZScaler Squirrelwaffle Sep 2021)","relationship_id":"relationship--0f688474-53c2-4ad5-8998-bd8c39a79f04","references":[{"source_name":"ZScaler Squirrelwaffle Sep 2021","description":"Kumar, A., Stone-Gross, Brett. (2021, September 28). Squirrelwaffle: New Loader Delivering Cobalt Strike. Retrieved August 9, 2022.","url":"https://www.zscaler.com/blogs/security-research/squirrelwaffle-new-loader-delivering-cobalt-strike"}]},{"id":"S1031","name":"PingPull","url":"https://attack.mitre.org/software/S1031","kind":"malware","description":"[PingPull](https://attack.mitre.org/software/S1031) can retrieve the hostname of a compromised host.(Citation: Unit 42 PingPull Jun 2022)","relationship_id":"relationship--4e109125-e22b-4aaf-ac3c-9a0f5351b440","references":[{"source_name":"Unit 42 PingPull Jun 2022","description":"Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.","url":"https://unit42.paloaltonetworks.com/pingpull-gallium/"}]},{"id":"S1034","name":"StrifeWater","url":"https://attack.mitre.org/software/S1034","kind":"malware","description":"[StrifeWater](https://attack.mitre.org/software/S1034) can collect the OS version, architecture, and machine name to create a unique token for the infected host.(Citation: Cybereason StrifeWater Feb 2022)","relationship_id":"relationship--9ba5068b-4e9e-445f-831b-c3d8ca444e2a","references":[{"source_name":"Cybereason StrifeWater Feb 2022","description":"Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022.","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}]},{"id":"S1037","name":"STARWHALE","url":"https://attack.mitre.org/software/S1037","kind":"malware","description":"[STARWHALE](https://attack.mitre.org/software/S1037) can gather the computer name of an infected host.(Citation: Mandiant UNC3313 Feb 2022)(Citation: DHS CISA AA22-055A MuddyWater February 2022)","relationship_id":"relationship--12168524-c6cf-4b8f-b114-7b10b06b8f32","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","description":"FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"},{"source_name":"Mandiant UNC3313 Feb 2022","description":"Tomcik, R. et al. (2022, February 24). Left On Read: Telegram Malware Spotted in Latest Iranian Cyber Espionage Activity. Retrieved August 18, 2022.","url":"https://www.mandiant.com/resources/telegram-malware-iranian-espionage"}]},{"id":"S1039","name":"Bumblebee","url":"https://attack.mitre.org/software/S1039","kind":"malware","description":"[Bumblebee](https://attack.mitre.org/software/S1039) can enumerate the OS version and domain on a targeted system.(Citation: Google EXOTIC LILY March 2022)(Citation: Proofpoint Bumblebee April 2022)(Citation: Symantec Bumblebee June 2022)","relationship_id":"relationship--02a1f8ce-390e-46e4-b945-9cd61c593f9f","references":[{"source_name":"Symantec Bumblebee June 2022","description":"Kamble, V. (2022, June 28). Bumblebee: New Loader Rapidly Assuming Central Position in Cyber-crime Ecosystem. Retrieved August 24, 2022.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime"},{"source_name":"Proofpoint Bumblebee April 2022","description":"Merriman, K. and Trouerbach, P. (2022, April 28). This isn't Optimus Prime's Bumblebee but it's Still Transforming. Retrieved August 22, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"},{"source_name":"Google EXOTIC LILY March 2022","description":"Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022.","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"id":"S1048","name":"macOS.OSAMiner","url":"https://attack.mitre.org/software/S1048","kind":"malware","description":"[macOS.OSAMiner](https://attack.mitre.org/software/S1048) can gather the device serial number.(Citation: SentinelLabs reversing run-only applescripts 2021)","relationship_id":"relationship--71935bd0-44ca-4d2b-850d-707bc4db91d5","references":[{"source_name":"SentinelLabs reversing run-only applescripts 2021","description":"Phil Stokes. (2021, January 11). FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts. Retrieved September 29, 2022.","url":"https://www.sentinelone.com/labs/fade-dead-adventures-in-reversing-malicious-run-only-applescripts/"}]},{"id":"S1052","name":"DEADEYE","url":"https://attack.mitre.org/software/S1052","kind":"malware","description":"[DEADEYE](https://attack.mitre.org/software/S1052) can enumerate a victim computer's volume serial number and host name.(Citation: Mandiant APT41)","relationship_id":"relationship--2eb32b46-9833-4391-b282-c7ee10bbfc62","references":[{"source_name":"Mandiant APT41","description":"Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022.","url":"https://www.mandiant.com/resources/apt41-us-state-governments"}]},{"id":"S1059","name":"metaMain","url":"https://attack.mitre.org/software/S1059","kind":"malware","description":"[metaMain](https://attack.mitre.org/software/S1059) can collect the computer name from a compromised host.(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--fcad9dc8-fa79-491e-91ec-35a2a9cd55e8","references":[{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can collect the computer name of a compromised host.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--91cea20a-9698-4bec-8fdd-c1eda3ea66e7","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1064","name":"SVCReady","url":"https://attack.mitre.org/software/S1064","kind":"malware","description":"[SVCReady](https://attack.mitre.org/software/S1064) has the ability to collect information such as computer name, computer manufacturer, BIOS, operating system, and firmware, including through the use of `systeminfo.exe`.(Citation: HP SVCReady Jun 2022)","relationship_id":"relationship--bfaa2e3f-fab0-4136-a951-ed1bad30a771","references":[{"source_name":"HP SVCReady Jun 2022","description":"Schlapfer, Patrick. (2022, June 6). A New Loader Gets Ready. Retrieved December 13, 2022.","url":"https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) can retrieve the following information from an infected machine: OS, architecture, computer name, OS build version, and environment variables.(Citation: MalwareBytes WoodyRAT Aug 2022)","relationship_id":"relationship--303ff42e-09fa-49ab-9fa3-420aedb090dc","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1066","name":"DarkTortilla","url":"https://attack.mitre.org/software/S1066","kind":"malware","description":"[DarkTortilla](https://attack.mitre.org/software/S1066) can obtain system information by querying the `Win32_ComputerSystem`, `Win32_BIOS`, `Win32_MotherboardDevice`, `Win32_PnPEntity`, and `Win32_DiskDrive` WMI objects.(Citation: Secureworks DarkTortilla Aug 2022)","relationship_id":"relationship--48a5b14e-81c8-4629-a846-7c8273bc3963","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}]},{"id":"S1068","name":"BlackCat","url":"https://attack.mitre.org/software/S1068","kind":"malware","description":"[BlackCat](https://attack.mitre.org/software/S1068) can obtain the computer name and UUID.(Citation: Microsoft BlackCat Jun 2022)","relationship_id":"relationship--3ca38ed9-3691-461d-81a1-1ad8de5817bb","references":[{"source_name":"Microsoft BlackCat Jun 2022","description":"Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"[Black Basta](https://attack.mitre.org/software/S1070) can collect system boot configuration and CPU information.(Citation: Minerva Labs Black Basta May 2022)(Citation: Cyble Black Basta May 2022)","relationship_id":"relationship--0e714323-a3b6-4848-852c-5e35608d0970","references":[{"source_name":"Cyble Black Basta May 2022","description":"Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"},{"source_name":"Minerva Labs Black Basta May 2022","description":"Zargarov, N. (2022, May 2). New Black Basta Ransomware Hijacks Windows Fax Service. Retrieved March 7, 2023.","url":"https://minerva-labs.com/blog/new-black-basta-ransomware-hijacks-windows-fax-service/"}]},{"id":"S1073","name":"Royal","url":"https://attack.mitre.org/software/S1073","kind":"malware","description":" [Royal](https://attack.mitre.org/software/S1073) can use `GetNativeSystemInfo` to enumerate system processors.(Citation: Cybereason Royal December 2022)(Citation: Trend Micro Royal Linux ESXi February 2023)","relationship_id":"relationship--20f43b8b-55c7-4710-8813-6512c3b11c1a","references":[{"source_name":"Cybereason Royal December 2022","description":"Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"},{"source_name":"Trend Micro Royal Linux ESXi February 2023","description":"Morales, N. et al. (2023, February 20). Royal Ransomware Expands Attacks by Targeting Linux ESXi Servers. Retrieved March 30, 2023.","url":"https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html"}]},{"id":"S1078","name":"RotaJakiro","url":"https://attack.mitre.org/software/S1078","kind":"malware","description":"[RotaJakiro](https://attack.mitre.org/software/S1078) executes a set of commands to collect device information, including `uname`.  Another example is the `cat /etc/*release | uniq` command used to collect the current OS distribution.(Citation: RotaJakiro 2021 netlab360 analysis)","relationship_id":"relationship--87ef3b62-acb4-4cd2-86ec-36683a57bedf","references":[{"source_name":"RotaJakiro 2021 netlab360 analysis","description":" Alex Turing, Hui Wang. (2021, April 28). RotaJakiro: A long live secret backdoor with 0 VT detection. Retrieved June 14, 2023.","url":"https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/"}]},{"id":"S1081","name":"BADHATCH","url":"https://attack.mitre.org/software/S1081","kind":"malware","description":"[BADHATCH](https://attack.mitre.org/software/S1081) can obtain current system information from a compromised machine such as the `SHELL PID`, `PSVERSION`, `HOSTNAME`, `LOGONSERVER`, `LASTBOOTUP`, OS type/version, bitness, and hostname.(Citation: Gigamon BADHATCH Jul 2019)(Citation: BitDefender BADHATCH Mar 2021) ","relationship_id":"relationship--2c88062e-f63f-4313-85ef-3d68a9d3fde5","references":[{"source_name":"Gigamon BADHATCH Jul 2019","description":"Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.","url":"https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/"},{"source_name":"BitDefender BADHATCH Mar 2021","description":"Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf"}]},{"id":"S1085","name":"Sardonic","url":"https://attack.mitre.org/software/S1085","kind":"malware","description":"[Sardonic](https://attack.mitre.org/software/S1085) has the ability to collect the computer name, and CPU manufacturer name from a compromised machine. [Sardonic](https://attack.mitre.org/software/S1085) also has the ability to execute the `ver` and `systeminfo` commands.(Citation: Bitdefender Sardonic Aug 2021)","relationship_id":"relationship--12ecc5cc-dad6-4532-9945-df575b008c2a","references":[{"source_name":"Bitdefender Sardonic Aug 2021","description":"Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}]},{"id":"S1086","name":"Snip3","url":"https://attack.mitre.org/software/S1086","kind":"malware","description":"[Snip3](https://attack.mitre.org/software/S1086) has the ability to query `Win32_ComputerSystem` for system information. (Citation: Morphisec Snip3 May 2021) ","relationship_id":"relationship--6deb7ae9-9e35-47cb-8db2-e708ad9543b6","references":[{"source_name":"Morphisec Snip3 May 2021","description":"Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.","url":"https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader"}]},{"id":"S1100","name":"Ninja","url":"https://attack.mitre.org/software/S1100","kind":"malware","description":"[Ninja](https://attack.mitre.org/software/S1100) can obtain the computer name and information on the OS from targeted hosts.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--708161ff-7d5d-417a-83ad-d68ec6d4d01a","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"S1107","name":"NKAbuse","url":"https://attack.mitre.org/software/S1107","kind":"malware","description":"[NKAbuse](https://attack.mitre.org/software/S1107) conducts multiple system checks and includes these in subsequent \"heartbeat\" messages to the malware's command and control server.(Citation: NKAbuse SL)","relationship_id":"relationship--6eb8329a-b0ca-4751-a014-473af182b177","references":[{"source_name":"NKAbuse SL","description":"KASPERSKY GERT. (2023, December 14). Unveiling NKAbuse: a new multiplatform threat abusing the NKN protocol. Retrieved February 8, 2024.","url":"https://securelist.com/unveiling-nkabuse/111512/"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) will gather various system information such as domain, display adapter description, operating system type and version, processor type, and RAM amount.(Citation: Ensilo Darkgate 2018)(Citation: Rapid7 BlackBasta 2024)","relationship_id":"relationship--011286cc-53bc-4910-bf38-79f1d79fc707","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"},{"source_name":"Rapid7 BlackBasta 2024","description":"McGraw, T. (2024, December 4). Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware. Retrieved December 9, 2024.","url":"https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"}]},{"id":"S1121","name":"LITTLELAMB.WOOLTEA","url":"https://attack.mitre.org/software/S1121","kind":"malware","description":"[LITTLELAMB.WOOLTEA](https://attack.mitre.org/software/S1121) can check the type of Ivanti VPN device it is running on by executing `first_run()` to identify the first four bytes of the motherboard serial number.(Citation: Mandiant Cutting Edge Part 3 February 2024)","relationship_id":"relationship--f619f10a-a579-49a6-a64f-80be117eea94","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","description":"Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}]},{"id":"S1122","name":"Mispadu","url":"https://attack.mitre.org/software/S1122","kind":"malware","description":"[Mispadu](https://attack.mitre.org/software/S1122) collects the OS version, computer name, and language ID.(Citation: ESET Security Mispadu Facebook Ads 2019)","relationship_id":"relationship--4d39c319-bf5d-4129-83ba-11df82fdca17","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","description":"ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"}]},{"id":"S1124","name":"SocGholish","url":"https://attack.mitre.org/software/S1124","kind":"malware","description":"[SocGholish](https://attack.mitre.org/software/S1124) has the ability to enumerate system information including the victim computer name.(Citation: SocGholish-update)(Citation: Red Canary SocGholish March 2024)(Citation: Secureworks Gold Prelude Profile)","relationship_id":"relationship--1a28d78a-d11b-466a-977f-19d2e88c1952","references":[{"source_name":"SocGholish-update","description":"Andrew Northern. (2022, November 22). SocGholish, a very real threat from a very fake update. Retrieved February 13, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source_name":"Red Canary SocGholish March 2024","description":"Red Canary. (2024, March). Red Canary 2024 Threat Detection Report: SocGholish. Retrieved March 22, 2024.","url":"https://redcanary.com/threat-detection-report/threats/socgholish/"},{"source_name":"Secureworks Gold Prelude Profile","description":"Secureworks. (n.d.). GOLD PRELUDE . Retrieved March 22, 2024.","url":"https://www.secureworks.com/research/threat-profiles/gold-prelude"}]},{"id":"S1129","name":"Akira","url":"https://attack.mitre.org/software/S1129","kind":"malware","description":"[Akira](https://attack.mitre.org/software/S1129) uses the <code>GetSystemInfo</code> Windows function to determine the number of processors on a victim machine.(Citation: Kersten Akira 2023)","relationship_id":"relationship--0d853746-8d17-4d1a-be4a-6133e39a6c84","references":[{"source_name":"Kersten Akira 2023","description":"Max Kersten & Alexandre Mundo. (2023, November 29). Akira Ransomware. Retrieved April 4, 2024.","url":"https://www.trellix.com/blogs/research/akira-ransomware/"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) performs several system checks as part of anti-analysis mechanisms, including querying the operating system build number, processor vendor and type, video controller, and CPU temperature.(Citation: HP RaspberryRobin 2024)","relationship_id":"relationship--11764f59-a7b9-4dff-8e37-471d739f5343","references":[{"source_name":"HP RaspberryRobin 2024","description":"Patrick Schläpfer . (2024, April 10). Raspberry Robin Now Spreading Through Windows Script Files. Retrieved May 17, 2024.","url":"https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"}]},{"id":"S1138","name":"Gootloader","url":"https://attack.mitre.org/software/S1138","kind":"malware","description":"[Gootloader](https://attack.mitre.org/software/S1138) can inspect the User-Agent string in GET request header information to determine the operating system of targeted systems.(Citation: Sophos Gootloader)","relationship_id":"relationship--7f4685df-335f-4c8a-900a-4018e52d92c3","references":[{"source_name":"Sophos Gootloader","description":"Szappanos, G. & Brandt, A. (2021, March 1). “Gootloader” expands its payload delivery options. Retrieved September 30, 2022.","url":"https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/"}]},{"id":"S1141","name":"LunarWeb","url":"https://attack.mitre.org/software/S1141","kind":"malware","description":"[LunarWeb](https://attack.mitre.org/software/S1141) can use WMI queries and shell commands such as systeminfo.exe to collect the operating system, BIOS version, and domain name of the targeted system.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--0ed59ea2-85bb-4633-9b55-9e322dcbbd83","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1142","name":"LunarMail","url":"https://attack.mitre.org/software/S1142","kind":"malware","description":"[LunarMail](https://attack.mitre.org/software/S1142) can capture environmental variables on compromised hosts.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--b7d456ea-d533-4d29-b6d4-45586c4a124e","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1145","name":"Pikabot","url":"https://attack.mitre.org/software/S1145","kind":"malware","description":"[Pikabot](https://attack.mitre.org/software/S1145) performs a variety of system checks and gathers system information, including commands such as <code>whoami</code>.(Citation: Zscaler Pikabot 2023)(Citation: Elastic Pikabot 2024)","relationship_id":"relationship--713bde00-ab9d-4eaf-99b2-4d9b2b21df4c","references":[{"source_name":"Zscaler Pikabot 2023","description":"Brett Stone-Gross & Nikolaos Pantazopoulos. (2023, May 24). Technical Analysis of Pikabot. Retrieved July 12, 2024.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-pikabot"},{"source_name":"Elastic Pikabot 2024","description":"Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024.","url":"https://www.elastic.co/security-labs/pikabot-i-choose-you"}]},{"id":"S1147","name":"Nightdoor","url":"https://attack.mitre.org/software/S1147","kind":"malware","description":"[Nightdoor](https://attack.mitre.org/software/S1147) gathers information on the victim system such as CPU and Computer name as well as device drivers.(Citation: ESET EvasivePanda 2024)","relationship_id":"relationship--e0dc0d73-4e0a-46a6-8100-0c231eba58a5","references":[{"source_name":"ESET EvasivePanda 2024","description":"Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"id":"S1148","name":"Raccoon Stealer","url":"https://attack.mitre.org/software/S1148","kind":"malware","description":"[Raccoon Stealer](https://attack.mitre.org/software/S1148) gathers information on infected systems such as operating system, processor information, RAM, and display information.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon2 2022)","relationship_id":"relationship--e5b20ee8-7af4-41a4-ac76-622a55a37e13","references":[{"source_name":"Sekoia Raccoon2 2022","description":"Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"},{"source_name":"S2W Racoon 2022","description":"S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}]},{"id":"S1152","name":"IMAPLoader","url":"https://attack.mitre.org/software/S1152","kind":"malware","description":"[IMAPLoader](https://attack.mitre.org/software/S1152) uses WMI queries to gather information about the victim machine.(Citation: PWC Yellow Liderc 2023)","relationship_id":"relationship--778df1e8-d307-496d-861a-45052ee2e019","references":[{"source_name":"PWC Yellow Liderc 2023","description":"PwC Threat Intelligence. (2023, October 25). Yellow Liderc ships its scripts and delivers IMAPLoader malware. Retrieved August 14, 2024.","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"id":"S1153","name":"Cuckoo Stealer","url":"https://attack.mitre.org/software/S1153","kind":"malware","description":"[Cuckoo Stealer](https://attack.mitre.org/software/S1153) can gather information about the OS version and hardware on compromised hosts.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024)","relationship_id":"relationship--eeb8635c-0297-470c-a66c-56f8e30c771e","references":[{"source_name":"Kandji Cuckoo April 2024","description":"Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"},{"source_name":"SentinelOne Cuckoo Stealer May 2024","description":"Stokes, P. (2024, May 9). macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge. Retrieved August 20, 2024.","url":"https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/"}]},{"id":"S1155","name":"Covenant","url":"https://attack.mitre.org/software/S1155","kind":"tool","description":"[Covenant](https://attack.mitre.org/software/S1155) implants can gather basic information on infected systems.(Citation: Github Covenant)","relationship_id":"relationship--698c4736-5a86-4d72-9855-4bdee856d6de","references":[{"source_name":"Github Covenant","description":"cobbr. (2021, April 21). Covenant. Retrieved September 4, 2024.","url":"https://github.com/cobbr/Covenant"}]},{"id":"S1156","name":"Manjusaka","url":"https://attack.mitre.org/software/S1156","kind":"malware","description":"[Manjusaka](https://attack.mitre.org/software/S1156) performs basic system profiling actions to fingerprint and register the victim system with the C2 controller.(Citation: Talos Manjusaka 2022)","relationship_id":"relationship--0fa5e3ed-8b00-4f03-9adf-caf5d0e0bd2c","references":[{"source_name":"Talos Manjusaka 2022","description":"Asheer Malhotra & Vitor Ventura. (2022, August 2). Manjusaka: A Chinese sibling of Sliver and Cobalt Strike. Retrieved September 4, 2024.","url":"https://blog.talosintelligence.com/manjusaka-offensive-framework/"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) reads the value of the infected system's `HKLM\\SYSTEM\\Microsoft\\Cryptography\\MachineGUID` value.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--d96e80d3-f4ca-40bd-ae69-979a0a782a57","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1160","name":"Latrodectus","url":"https://attack.mitre.org/software/S1160","kind":"malware","description":"\n[Latrodectus](https://attack.mitre.org/software/S1160) can gather operating system information.(Citation: Latrodectus APR 2024)(Citation: Elastic Latrodectus May 2024)(Citation: Elastic Latrodectus May 2024)(Citation: Bitsight Latrodectus June 2024)","relationship_id":"relationship--ac4b5156-e98e-4826-abc5-02e244496c03","references":[{"source_name":"Bitsight Latrodectus June 2024","description":"Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Latrodectus APR 2024","description":"Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"},{"source_name":"Elastic Latrodectus May 2024","description":"Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024.","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}]},{"id":"S1166","name":"Solar","url":"https://attack.mitre.org/software/S1166","kind":"malware","description":"[Solar](https://attack.mitre.org/software/S1166) can send basic information about the infected host to C2.(Citation: ESET OilRig Campaigns Sep 2023)","relationship_id":"relationship--8ed87a9f-db10-4e2c-aa3d-cf1e92797d1f","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","description":"Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}]},{"id":"S1167","name":"AcidPour","url":"https://attack.mitre.org/software/S1167","kind":"malware","description":"[AcidPour](https://attack.mitre.org/software/S1167) can identify various system locations and mapped devices on Linux systems as a precursor to wiping activity.(Citation: SentinelOne AcidPour 2024)","relationship_id":"relationship--85c11944-e1a0-49e0-a0ef-03e9df1b2adb","references":[{"source_name":"SentinelOne AcidPour 2024","description":"Juan Andrés Guerrero-Saade & Tom Hegel. (2024, March 21). AcidPour | New Embedded Wiper Variant of AcidRain Appears in Ukraine. Retrieved November 25, 2024.","url":"https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine/"}]},{"id":"S1168","name":"SampleCheck5000","url":"https://attack.mitre.org/software/S1168","kind":"malware","description":"[SampleCheck5000](https://attack.mitre.org/software/S1168) can create unique victim identifiers by using the compromised system’s computer name.(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--a0e78137-f13e-491e-ba5e-d1cd005ab17c","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"id":"S1169","name":"Mango","url":"https://attack.mitre.org/software/S1169","kind":"malware","description":"[Mango](https://attack.mitre.org/software/S1169) can collect the machine name of a compromised system which is later used as part of a unique victim identifier.(Citation: ESET OilRig Campaigns Sep 2023)","relationship_id":"relationship--4a1308c8-a392-4d89-8fb2-90692e07cadb","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","description":"Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}]},{"id":"S1172","name":"OilBooster","url":"https://attack.mitre.org/software/S1172","kind":"malware","description":"[OilBooster](https://attack.mitre.org/software/S1172) can identify the compromised system's hostname which is used to create a unique identifier.(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--2c351c25-fc11-4168-9ad5-6a5aab84634c","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"id":"S1178","name":"ShrinkLocker","url":"https://attack.mitre.org/software/S1178","kind":"malware","description":"[ShrinkLocker](https://attack.mitre.org/software/S1178) uses WMI queries to gather various information about the victim machine and operating system.(Citation: Kaspersky ShrinkLocker 2024)(Citation: Splunk ShrinkLocker 2024)","relationship_id":"relationship--1b265c93-7331-41b7-9cf2-c8c21a0969e7","references":[{"source_name":"Kaspersky ShrinkLocker 2024","description":"Cristian Souza, Eduardo Ovalle, Ashley Muñoz, & Christopher Zachor. (2024, May 23). ShrinkLocker: Turning BitLocker into ransomware. Retrieved December 7, 2024.","url":"https://securelist.com/ransomware-abuses-bitlocker/112643/"},{"source_name":"Splunk ShrinkLocker 2024","description":"Splunk Threat Research Team , Teoderick Contreras. (2024, September 5). ShrinkLocker Malware: Abusing BitLocker to Lock Your Data. Retrieved December 7, 2024.","url":"https://www.splunk.com/en_us/blog/security/shrinklocker-malware-abusing-bitlocker-to-lock-your-data.html"}]},{"id":"S1180","name":"BlackByte Ransomware","url":"https://attack.mitre.org/software/S1180","kind":"malware","description":"[BlackByte Ransomware](https://attack.mitre.org/software/S1180) gathers victim system information to generate a unique victim identifier.(Citation: Trustwave BlackByte 2021)","relationship_id":"relationship--804cf89b-1070-44e1-a479-a07558ae3128","references":[{"source_name":"Trustwave BlackByte 2021","description":"Rodel Mendrez & Lloyd Macrohon. (2021, October 15). BlackByte Ransomware – Pt. 1 In-depth Analysis. Retrieved December 16, 2024.","url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/"}]},{"id":"S1182","name":"MagicRAT","url":"https://attack.mitre.org/software/S1182","kind":"malware","description":"[MagicRAT](https://attack.mitre.org/software/S1182) collects basic system information from victim machines.(Citation: Cisco MagicRAT 2022)","relationship_id":"relationship--bb4e12ab-cfaa-4693-9156-bb97fc9c5b92","references":[{"source_name":"Cisco MagicRAT 2022","description":"Asheer Malhotra, Vitor Ventura & Jungsoo An, Cisco Talos. (2022, September 7). MagicRAT: Lazarus’ latest gateway into victim networks. Retrieved December 30, 2024.","url":"https://blog.talosintelligence.com/lazarus-magicrat/"}]},{"id":"S1183","name":"StrelaStealer","url":"https://attack.mitre.org/software/S1183","kind":"malware","description":"[StrelaStealer](https://attack.mitre.org/software/S1183) variants collect victim system information for exfiltration.(Citation: IBM StrelaStealer 2024)","relationship_id":"relationship--de9ac4ba-9e06-4704-9549-b3c59882bdb2","references":[{"source_name":"IBM StrelaStealer 2024","description":"Golo Mühr, Joe Fasulo & Charlotte Hammond, IBM X-Force. (2024, November 12). Strela Stealer: Today’s invoice is tomorrow’s phish. Retrieved December 31, 2024.","url":"https://securityintelligence.com/x-force/strela-stealer-todays-invoice-tomorrows-phish/"}]},{"id":"S1184","name":"BOLDMOVE","url":"https://attack.mitre.org/software/S1184","kind":"malware","description":"[BOLDMOVE](https://attack.mitre.org/software/S1184) performs system survey actions following initial execution.(Citation: Google Cloud BOLDMOVE 2023)","relationship_id":"relationship--c4684b0f-86e1-4200-bd12-e9472f892779","references":[{"source_name":"Google Cloud BOLDMOVE 2023","description":"Scott Henderson, Cristiana Kittner, Sarah Hawley & Mark Lechtik, Google Cloud. (2023, January 19). Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475). Retrieved December 31, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/chinese-actors-exploit-fortios-flaw/"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185)'s second stage implant uses the `DeviceInformation` class to collect system information, including CPU usage, battery statistics, memory allocations, screen size, etc.(Citation: Huntress LightSpy macOS 2024)","relationship_id":"relationship--6d965ba4-b5f3-40ce-9153-b328e4b54429","references":[{"source_name":"Huntress LightSpy macOS 2024","description":"Stuart Ashenbrenner, Alden Schmidt. (2024, April 25). LightSpy Malware Variant Targeting macOS. Retrieved January 3, 2025.","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"}]},{"id":"S1186","name":"Line Dancer","url":"https://attack.mitre.org/software/S1186","kind":"malware","description":"[Line Dancer](https://attack.mitre.org/software/S1186) can gather system configuration information by running the native `show configuration` command.(Citation: Cisco ArcaneDoor 2024)","relationship_id":"relationship--e452a193-b1a0-40b6-af3e-a734859fcf0b","references":[{"source_name":"Cisco ArcaneDoor 2024","description":"Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"}]},{"id":"S1190","name":"Kapeka","url":"https://attack.mitre.org/software/S1190","kind":"malware","description":"[Kapeka](https://attack.mitre.org/software/S1190) utilizes WinAPI calls and registry queries to gather system information.(Citation: WithSecure Kapeka 2024)","relationship_id":"relationship--2cc929d2-469a-4c71-ba4e-bc3dec29da5c","references":[{"source_name":"WithSecure Kapeka 2024","description":"Mohammad Kazem Hassan Nejad, WithSecure. (2024, April 17). KAPEKA A novel backdoor spotted in Eastern Europe. Retrieved January 6, 2025.","url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Research-Kapeka.pdf"}]},{"id":"S1196","name":"Troll Stealer","url":"https://attack.mitre.org/software/S1196","kind":"malware","description":"[Troll Stealer](https://attack.mitre.org/software/S1196) can collect local system information.(Citation: S2W Troll Stealer 2024)(Citation: Symantec Troll Stealer 2024)","relationship_id":"relationship--a6f98712-2c65-493f-a707-db17417e5c80","references":[{"source_name":"S2W Troll Stealer 2024","description":"Jiho Kim & Sebin Lee, S2W. (2024, February 7). Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (English ver.). Retrieved January 17, 2025.","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"},{"source_name":"Symantec Troll Stealer 2024","description":"Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}]},{"id":"S1198","name":"Gomir","url":"https://attack.mitre.org/software/S1198","kind":"malware","description":"[Gomir](https://attack.mitre.org/software/S1198) collects information on infected systems such as hostname, username, CPU, and RAM information.(Citation: Symantec Troll Stealer 2024)","relationship_id":"relationship--d31367da-4a66-4fe2-ac2c-d54ba1e985b0","references":[{"source_name":"Symantec Troll Stealer 2024","description":"Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) can enumerate system information including hostname and domain information.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Palo Alto Lockbit 2.0 JUN 2022)","relationship_id":"relationship--65f3f758-ac69-4f7a-b56e-6bbafddae619","references":[{"source_name":"Palo Alto Lockbit 2.0 JUN 2022","description":"Elsad, A. et al. (2022, June 9). LockBit 2.0: How This RaaS Operates and How to Protect Against It. Retrieved January 24, 2025.","url":"https://unit42.paloaltonetworks.com/lockbit-2-ransomware/"},{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}]},{"id":"S1200","name":"StealBit","url":"https://attack.mitre.org/software/S1200","kind":"malware","description":"[StealBit](https://attack.mitre.org/software/S1200) can enumerate the computer name and domain membership of the compromised system.(Citation: Cybereason StealBit Exfiltration Tool)","relationship_id":"relationship--97a31149-5322-472a-b443-b60ab1cec1af","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","description":"Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can enumerate system hostname and domain.(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)","relationship_id":"relationship--9273ab6e-ccee-40ed-8cf1-420cd0650d20","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"}]},{"id":"S1207","name":"XLoader","url":"https://attack.mitre.org/software/S1207","kind":"malware","description":"[XLoader](https://attack.mitre.org/software/S1207) can collect system information and supported language information from the victim machine.(Citation: Acronis XLoader 2021)","relationship_id":"relationship--cc8a3a34-1324-4a4d-8557-3c23fad2b07c","references":[{"source_name":"Acronis XLoader 2021","description":"Acronis. (2021, November 26). Trojan-as-a-service: From Formbook to XLoader. Retrieved March 11, 2025.","url":"https://www.acronis.com/en-us/cyber-protection-center/posts/trojan-as-a-service-from-formbook-to-xloader/"}]},{"id":"S1210","name":"Sagerunex","url":"https://attack.mitre.org/software/S1210","kind":"malware","description":"[Sagerunex](https://attack.mitre.org/software/S1210) gathers information from the infected system such as hostname.(Citation: Cisco LotusBlossom 2025)","relationship_id":"relationship--7e618069-63cd-4739-bbaf-8582743906f8","references":[{"source_name":"Cisco LotusBlossom 2025","description":"Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"id":"S1212","name":"RansomHub","url":"https://attack.mitre.org/software/S1212","kind":"malware","description":"[RansomHub](https://attack.mitre.org/software/S1212) can retrieve information about virtual machines.(Citation: Group-IB RansomHub FEB 2025)","relationship_id":"relationship--f6208ff3-bf0a-4461-bb60-bc6c58cb9e49","references":[{"source_name":"Group-IB RansomHub FEB 2025","description":"Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"}]},{"id":"S1213","name":"Lumma Stealer","url":"https://attack.mitre.org/software/S1213","kind":"malware","description":"[Lumma Stealer](https://attack.mitre.org/software/S1213) has gathered various system information from victim machines.(Citation: Cybereason LumaStealer Undated)(Citation: Fortinet LummaStealer 2024)(Citation: TrendMicro LummaStealer 2025)","relationship_id":"relationship--fe865909-091d-42cd-82a1-5cfc5df38e4d","references":[{"source_name":"TrendMicro LummaStealer 2025","description":"Buddy Tancio, Fe Cureg, and Jovit Samaniego, Trend Micro. (2025, January 30). Lumma Stealer’s GitHub-Based Delivery Explored via Managed Detection and Response. Retrieved March 22, 2025.","url":"https://www.trendmicro.com/en_us/research/25/a/lumma-stealers-github-based-delivery-via-mdr.html"},{"source_name":"Fortinet LummaStealer 2024","description":"Cara Lin, Fortinet. (2024, January 8). Deceptive Cracked Software Spreads Lumma Variant on YouTube. Retrieved March 22, 2025.","url":"https://www.fortinet.com/blog/threat-research/lumma-variant-on-youtube"},{"source_name":"Cybereason LumaStealer Undated","description":"Cybereaon Security Services Team. (n.d.). Your Data Is Under New Lummanagement: The Rise of LummaStealer. Retrieved March 22, 2025.","url":"https://www.cybereason.com/blog/threat-analysis-rise-of-lummastealer"}]},{"id":"S1222","name":"RIFLESPINE","url":"https://attack.mitre.org/software/S1222","kind":"malware","description":"[RIFLESPINE](https://attack.mitre.org/software/S1222) can collect system information after installation on infected systems.(Citation: Google Cloud Mandiant UNC3886 2024)","relationship_id":"relationship--80c87037-4997-449c-8a92-1183103dda8d","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"id":"S1228","name":"PUBLOAD","url":"https://attack.mitre.org/software/S1228","kind":"malware","description":"[PUBLOAD](https://attack.mitre.org/software/S1228) has collected and sent system information including volume serial number, computer name, and system uptime to designated C2.(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)  [PUBLOAD](https://attack.mitre.org/software/S1228) has also used several commands executed in sequence via `cmd` in a short interval to gather system information about the infected host including `systeminfo`.(Citation: Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024) [PUBLOAD](https://attack.mitre.org/software/S1228) has decrypted shellcode that collects the computer name.(Citation: 2022 November_TrendMicro_Earth Preta_Toneshell_Pubload)","relationship_id":"relationship--ff57d2d8-095c-4f9b-bb57-bc0971bb6a8d","references":[{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","description":"Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","description":"Lenart Bermejo, Sunny Lu, Ted Lee. (2024, September 9). Earth Preta Evolves its Attacks with New Malware and Strategies. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"},{"source_name":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","description":"Nick Dai, Vickie Su, Sunny Lu. (2022, November 18). Earth Preta Spear-Phishing Governments Worldwide. Retrieved August 4, 2025.","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"id":"S1229","name":"Havoc","url":"https://attack.mitre.org/software/S1229","kind":"malware","description":"[Havoc](https://attack.mitre.org/software/S1229) can gather system information including hostname, domain, and OS details.(Citation: Fortinet Havoc MAR 2025)","relationship_id":"relationship--4e52b5b5-5f7d-4900-aae0-34b2d71b90e0","references":[{"source_name":"Fortinet Havoc MAR 2025","description":"Wan, Y. (2025, March 3). Havoc: SharePoint with Microsoft Graph API turns into FUD C2. Retrieved August 4, 2025.","url":"https://www.fortinet.com/blog/threat-research/havoc-sharepoint-with-microsoft-graph-api-turns-into-fud-c2"}]},{"id":"S1234","name":"SplatCloak","url":"https://attack.mitre.org/software/S1234","kind":"malware","description":"[SplatCloak](https://attack.mitre.org/software/S1234) has collected the Windows build number using the windows kernel API `RtlGetVersion` to determine if the response is 19000 or higher (Windows 10 version 2004 or later).(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)","relationship_id":"relationship--08b94d01-f4c1-4692-aa39-a203fd97d581","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"id":"S1239","name":"TONESHELL","url":"https://attack.mitre.org/software/S1239","kind":"malware","description":"[TONESHELL](https://attack.mitre.org/software/S1239) has the ability to retrieve the name of the infected machine.(Citation: 2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA)(Citation: Trend Micro Mustang Panda Earth Preta Toneshell February 2025)(Citation: Zscaler)","relationship_id":"relationship--2f2a1144-7a4c-4a9e-9446-627ab73e08da","references":[{"source_name":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","description":"Golo Muhr, Joshua Chung. (2025, May 15). Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign. Retrieved August 4, 2025.","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source_name":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","description":"Nathaniel Morales, Nick Dai. (2025, February 18). Earth Preta Mixes Legitimate and Malicious Components to Sidestep Detection. Retrieved September 10, 2025.","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source_name":"Zscaler","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: ToneShell and StarProxy | P1. Retrieved July 21, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"id":"S1240","name":"RedLine Stealer","url":"https://attack.mitre.org/software/S1240","kind":"malware","description":"[RedLine Stealer](https://attack.mitre.org/software/S1240) can collect information about the local system.(Citation: Kroll RedLine Stealer August 2024)(Citation: Proofpoint RedLine Stealer March 2020)(Citation: Splunk RedLine Stealer June 2023)(Citation: Veriti RedLine Stealer MAAS April 2023)","relationship_id":"relationship--afe95822-7845-4f16-b50c-62f428c59697","references":[{"source_name":"Kroll RedLine Stealer August 2024","description":"George Glass. (2024, August 14). REDLINESTEALER Malware Driving the Initial Access Broker Market. Retrieved September 17, 2025.","url":"https://www.kroll.com/en/publications/cyber/redlinestealer-malware"},{"source_name":"Proofpoint RedLine Stealer March 2020","description":"Proofpoint Threat Insight Team, Jeremy H, Axel F. (2020, March 16). New Redline Password Stealer Malware. Retrieved September 17, 2025.","url":"https://www.proofpoint.com/us/blog/threat-insight/new-redline-stealer-distributed-using-coronavirus-themed-email-campaign"},{"source_name":"Splunk RedLine Stealer June 2023","description":"Splunk Threat Research Team. (2023, June 1). Do Not Cross The 'RedLine' Stealer: Detections and Analysis. Retrieved September 17, 2025.","url":"https://www.splunk.com/en_us/blog/security/do-not-cross-the-redline-stealer-detections-and-analysis.html"},{"source_name":"Veriti RedLine Stealer MAAS April 2023","description":"Yair Herling. (2023, April 4). From ChatGPT to RedLine Stealer: The Dark Side of OpenAI and Google Bard. Retrieved September 17, 2025.","url":"https://veriti.ai/blog/veriti-research/from-chatgpt-to-redline-stealer-the-dark-side-of-openai-and-google-bard/"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can detect whether a system is running FreeBSD, VMkernel (ESXi), Nutanix AHV, or a standard Linux distribution to enable platform-specific encryption behaviors.(Citation: Trend Micro Agenda Ransomware OCT 2025)","relationship_id":"relationship--014d0996-93ef-4435-aac2-f73dbd4a9d60","references":[{"source_name":"Trend Micro Agenda Ransomware OCT 2025","description":"Trend Micro. (2025, October 23). Agenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques. Retrieved March 26, 2026.","url":"https://www.trendmicro.com/en_us/research/25/j/agenda-ransomware-deploys-linux-variant-on-windows-systems.html"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has collected data from the SMBIOS firmware table using `GetSystemFirmwareTable`.(Citation: Security Scorecard Medusa Ransomware January 2024)  ","relationship_id":"relationship--c6f6b904-0246-471c-93ca-0b70c70b0c96","references":[{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S1245","name":"InvisibleFerret","url":"https://attack.mitre.org/software/S1245","kind":"malware","description":"[InvisibleFerret](https://attack.mitre.org/software/S1245) has collected OS type, hostname and system version through the \"pay\" module.(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025) [InvisibleFerret](https://attack.mitre.org/software/S1245) has also queried the victim device using Python scripts to obtain the User and Hostname.(Citation: Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)","relationship_id":"relationship--01a2dceb-e7bf-414b-9919-6c9724cfb404","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","description":"Insikt Group. (2025, February 13). Inside the Scam: North Korea’s IT Worker Threat. Retrieved October 17, 2025.","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"id":"S1246","name":"BeaverTail","url":"https://attack.mitre.org/software/S1246","kind":"malware","description":"[BeaverTail](https://attack.mitre.org/software/S1246) has been known to collect basic system information.(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023) [BeaverTail](https://attack.mitre.org/software/S1246) has also collected data to include hostname and current timestamp prior to uploading data to the API endpoint `/uploads` on the C2 server.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)","relationship_id":"relationship--4c5755ef-d3fc-457d-9103-8bb9e37ae462","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"id":"S1248","name":"XORIndex Loader","url":"https://attack.mitre.org/software/S1248","kind":"malware","description":"[XORIndex Loader](https://attack.mitre.org/software/S1248) has the ability to collect the hostname, OS Username, Geolocation, and OS version of an infected host.(Citation: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025)","relationship_id":"relationship--196fcf2a-e520-4fab-baa2-68af3cb0e57c","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","description":"Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"}]},{"id":"S1249","name":"HexEval Loader","url":"https://attack.mitre.org/software/S1249","kind":"malware","description":"[HexEval Loader](https://attack.mitre.org/software/S1249) has identified the OS and MAC address of victim device through host fingerprinting scripting.(Citation: Socket HexEval BeaverTail Contagious Interview June 2025)","relationship_id":"relationship--01933b06-956c-4f09-9dcc-e7c6b672dc94","references":[{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","description":"Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]},{"id":"S9001","name":"SystemBC","url":"https://attack.mitre.org/software/S9001","kind":"malware","description":"[SystemBC](https://attack.mitre.org/software/S9001) has collected username  , build number and serial number, then sent the information to the C2 server.(Citation: SophosGnGal_SystemBC_Dec2020)(Citation: AhnLab_SystemBC_Apr2022) [SystemBC](https://attack.mitre.org/software/S9001) has also gathered device name, operating system, and processor type.(Citation: HarmonProofpoint_SystemBC_Aug2019)","relationship_id":"relationship--670b59d4-25c6-4171-a36b-efb27155cc95","references":[{"source_name":"AhnLab_SystemBC_Apr2022","description":"AhnLab. (2022, April 4). SystemBC Being Used by Various Attackers . Retrieved June 18, 2025.","url":"https://asec.ahnlab.com/en/33600/"},{"source_name":"SophosGnGal_SystemBC_Dec2020","description":"Gallagher, S., Gn, S. (2020, December 16). Ransomware operators use SystemBC RAT as off-the-shelf Tor backdoor. Retrieved May 16, 2025.","url":"https://news.sophos.com/en-us/2020/12/16/systembc/"},{"source_name":"HarmonProofpoint_SystemBC_Aug2019","description":"Harmon, K., et al. (2019, August 1). SystemBC is like Christmas in July for SOCKS5 Malware and Exploit Kits . Retrieved June 13, 2025.","url":"https://www.proofpoint.com/us/threat-insight/post/systembc-christmas-july-socks5-malware-and-exploit-kits"}]},{"id":"S9002","name":"Diskpart","url":"https://attack.mitre.org/software/S9002","kind":"tool","description":"[Diskpart](https://attack.mitre.org/software/S9002) can show information about the selected disk, partition, volume, or virtual hard disk (VHD).(Citation: Microsoft_diskpart_Feb2023) ","relationship_id":"relationship--5619736a-4081-4fc3-93b7-cf70d01cd094","references":[{"source_name":"Microsoft_diskpart_Feb2023","description":"Microsoft. (2023, February 3). diskpart. Retrieved March 17, 2025.","url":"https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskpart"}]},{"id":"S9008","name":"Shai-Hulud","url":"https://attack.mitre.org/software/S9008","kind":"malware","description":"[Shai-Hulud](https://attack.mitre.org/software/S9008) has gathered victim system information.(Citation: Aikido Shai-Hulud September 2025)(Citation: Socket Shai-Hulud November 2025)","relationship_id":"relationship--d7643073-825d-407c-b2ba-11c313ea6a9e","references":[{"source_name":"Aikido Shai-Hulud September 2025","description":"Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.","url":"https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"},{"source_name":"Socket Shai-Hulud November 2025","description":"Socket Research Team. (2025, November 24). Shai Hulud Strikes Again (v2). Retrieved April 9, 2026.","url":"https://socket.dev/blog/shai-hulud-strikes-again-v2"}]},{"id":"S9010","name":"GlassWorm","url":"https://attack.mitre.org/software/S9010","kind":"malware","description":"[GlassWorm](https://attack.mitre.org/software/S9010) has the ability to check the OS of the victim host.(Citation: Socket GlassWorm January 2026)(Citation: Koi GlassWorm Rust December 2025)  [GlassWorm](https://attack.mitre.org/software/S9010) has checked whether the OS platform value includes `darwin` prior to execution of macOS specific scripts.(Citation: Socket GlassWorm January 2026)(Citation: Koi GlassWorm Rust December 2025)","relationship_id":"relationship--b5076cf3-ccd5-4dd7-895b-abf79eddf63f","references":[{"source_name":"Socket GlassWorm January 2026","description":"Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.","url":"https://socket.dev/blog/glassworm-loader-hits-open-vsx-via-suspected-developer-account-compromise"},{"source_name":"Koi GlassWorm Rust December 2025","description":"Lotan Sery. (2025, December 10). GlassWorm Goes Native: Same Infrastructure, Hardened Delivery. Retrieved April 10, 2026.","url":"https://www.koi.ai/blog/glassworm-goes-native-same-infrastructure-hardened-delivery"}]},{"id":"S9019","name":"PureCrypter","url":"https://attack.mitre.org/software/S9019","kind":"malware","description":"[PureCrypter](https://attack.mitre.org/software/S9019) can enumerate a targeted system's SerialNumber and Version.(Citation: Zscaler PureCrypter JUN 2022)(Citation: Check Point Blind Eagle MAR 2025)","relationship_id":"relationship--0e770d53-2dea-4d8d-8bbf-a2290d4a78a7","references":[{"source_name":"Check Point Blind Eagle MAR 2025","description":"Check Point Research. (2025, March 10). Blind Eagle: …And Justice for All. Retrieved April 16, 2026.","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source_name":"Zscaler PureCrypter JUN 2022","description":"Dumont, R. (2022, June 13). Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers. Retrieved April 16, 2026.","url":"https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"[LODEINFO](https://attack.mitre.org/software/S9020) can disover machine information including OS architecture, the ANSI code page (ACP) identifier, and hostname.(Citation: Kaspersky LODEINFO Part II OCT 2022)(Citation: ITOCHU LODEINFO JAN 2024)","relationship_id":"relationship--83b6ef41-24e7-4ace-bb6e-29faf8ac5ab4","references":[{"source_name":"Kaspersky LODEINFO Part II OCT 2022","description":"Ishimaru, S. (2022, October 31). APT10: Tracking down LODEINFO 2022, part II. Retrieved April 17, 2026.","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-ii/107745/"},{"source_name":"ITOCHU LODEINFO JAN 2024","description":"ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"id":"S9023","name":"HiddenFace","url":"https://attack.mitre.org/software/S9023","kind":"malware","description":"[HiddenFace](https://attack.mitre.org/software/S9023) can enumerate the hostname and username of the compromised system.(Citation: ESET HiddenFace 2024)(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--8aec9b0d-392b-438f-9953-82406e940a44","references":[{"source_name":"ESET HiddenFace 2024","description":"Breitenbacher, D. (2024). Unmasking HiddenFace. Retrieved April 17, 2026.","url":"https://jsac.jpcert.or.jp/archive/2024/pdf/JSAC2024_2_8_Breitenbacher_en.pdf"},{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"id":"S9024","name":"SPAWNCHIMERA","url":"https://attack.mitre.org/software/S9024","kind":"malware","description":"[SPAWNCHIMERA](https://attack.mitre.org/software/S9024) has obtained system information such as release, uptime, and current time.(Citation: Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024)  ","relationship_id":"relationship--fbcc97eb-3768-4c8f-b00e-eb84a69fc0da","references":[{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","description":"Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Crew, Billy Wong, Tyler McLellan. (2024, April 4). Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"}]},{"id":"S9025","name":"NOOPLDR","url":"https://attack.mitre.org/software/S9025","kind":"malware","description":"[NOOPLDR](https://attack.mitre.org/software/S9025) can discover the device ID and hostname from the targeted machine to use for encryption keys.(Citation: Trend Micro Earth Kasha NOV 2024)","relationship_id":"relationship--e07c827b-aa0a-4cc5-b1ff-a2905bc99027","references":[{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"id":"S9029","name":"IronWind","url":"https://attack.mitre.org/software/S9029","kind":"malware","description":"[IronWind](https://attack.mitre.org/software/S9029) can capture the OS version and computer name of the compromised host.(Citation: Check Point Wirte NOV 2024)","relationship_id":"relationship--2dfd1cd3-c2da-4c65-9699-54b943b8c08d","references":[{"source_name":"Check Point Wirte NOV 2024","description":"Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"id":"S9031","name":"AshTag","url":"https://attack.mitre.org/software/S9031","kind":"malware","description":"The [AshTag](https://attack.mitre.org/software/S9031) loader and AshenOrchestrator components can collect reconnaissance data from victim machines.(Citation: Palo Alto Ashen Lepus DEC 2025)","relationship_id":"relationship--24edc813-1a52-47ae-9068-7423c0052a43","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","description":"Unit 42. (2025, December 11). Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite. Retrieved April 20, 2026.","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"id":"S9034","name":"Tsundere Botnet","url":"https://attack.mitre.org/software/S9034","kind":"malware","description":"[Tsundere Botnet](https://attack.mitre.org/software/S9034) has collected the machine’s MAC address, total memory, GPU information and other system information.(Citation: SecureListUbiedo_Tsundere_Nov2025) ","relationship_id":"relationship--c97ef137-79d7-4e87-ba15-f719724eb15b","references":[{"source_name":"SecureListUbiedo_Tsundere_Nov2025","description":"Ubiedo, L. (2025, November 20). Blockchain and Node.js abused by Tsundere: an emerging botnet. Retrieved April 6, 2026.","url":"https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/"}]},{"id":"S9035","name":"LAMEHUG","url":"https://attack.mitre.org/software/S9035","kind":"malware","description":"[LAMEHUG](https://attack.mitre.org/software/S9035) has the ability to execute Windows commands returned from C2 to gather system information.(Citation: Splunk LAMEHUG SEP 2025)(Citation: Nov AI Threat Tracker)","relationship_id":"relationship--170e1e46-f3ea-4edb-a115-dde5a7c13e0f","references":[{"source_name":"Splunk LAMEHUG SEP 2025","description":"Conteras, T., Splunk Research Team. (2025, September 25). From Prompt to Payload: LAMEHUG’s LLM-Driven Cyber Intrusion. Retrieved April 21, 2026.","url":"https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"},{"source_name":"Nov AI Threat Tracker","description":"Google Threat Intelligence Group. (2025, November 5). GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools. Retrieved March 31, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"}]},{"id":"S9037","name":"RustyWater","url":"https://attack.mitre.org/software/S9037","kind":"malware","description":"[RustyWater](https://attack.mitre.org/software/S9037) has gathered the victim machine’s computer name.(Citation: CloudSEK_RustyWater_Jan2026)    ","relationship_id":"relationship--2854c1cb-d7e6-484a-afff-4a1e3a43df64","references":[{"source_name":"CloudSEK_RustyWater_Jan2026","description":"Awasthi, P. (2026, January 8). Reborn in Rust: Muddy Water Evolves Tooling with RustyWater Implant. Retrieved March 19, 2026.","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"}]},{"id":"S9039","name":"LazyWiper","url":"https://attack.mitre.org/software/S9039","kind":"malware","description":"[LazyWiper](https://attack.mitre.org/software/S9039) has used `[System.Net.Dns]::GetHostName()` and `$env:COMPUTERNAME` to enumerate the hostname of a system and determine if it is a domain controller.(Citation: CERT Polska)","relationship_id":"relationship--6ddcaca1-4fd9-4a9f-a4fe-2e5824958f8d","references":[{"source_name":"CERT Polska","description":"CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) has detected if it is on a developer machine by checking if the environmental variable  GITHUB_ACTIONS != “true”.(Citation: Wiz Trivy Compromise MAR 2026) [TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) has also identified readable memory regions on CI/CD runners and enumerated system information using `hostname` and `uname-a`.(Citation: Aqua Security Blog Trivy Compromise APR 2026)","relationship_id":"relationship--f99c66b5-df6f-4097-b72b-82bbe3f5fe02","references":[{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Wiz Trivy Compromise MAR 2026","description":"McCarthy, R. (2026, March 20). Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has gathered system information of victim hosts through the use of common discovery commands to include `hostname`, `uname-a` and `printenv`.(Citation: Trend Micro TeamPCP MAY 2026) [Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has also conducted system checks of the victim device to include enumerating the system type and the number of CPUs operating on victim host.(Citation: Hunt.io TeamPCP Toolkit MAY 2026)(Citation: Phoenix TeamPCP 20 MAY 2026)","relationship_id":"relationship--aa4acffb-0b5c-48b3-b0c4-d321e6ae842d","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"},{"source_name":"Trend Micro TeamPCP MAY 2026","description":"Santos, J. and Navato, J.R. (2026, May 13). Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft. Retrieved July 16, 2026.","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source_name":"Phoenix TeamPCP 20 MAY 2026","description":"Webb, M. (2026, May 20). TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated. Retrieved July 16, 2026.","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"id":"S9045","name":"BACKUPOSINT v9.0 APEX PREDATOR","url":"https://attack.mitre.org/software/S9045","kind":"malware","description":"[BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) has discovered system configurations on victim devices.(Citation: AI-Mexico-Govt-Breach) ","relationship_id":"relationship--12a69be7-09b4-4188-9b78-a035d0b622ee","references":[{"source_name":"AI-Mexico-Govt-Breach","description":"Eyal Sela. (2026, April). The AI-Assisted Breach of Mexico's Government Infrastructure. Retrieved September 2, 2026.","url":"https://cdn.prod.website-files.com/69944dd945f20ca4a27a7c47/69d8bb5aea59e31efb3b8a7f_Tech_Report_ai_breach_mex_gov.pdf"}]},{"id":"S9046","name":"IOControl","url":"https://attack.mitre.org/software/S9046","kind":"malware","description":"IOCONTROL has used the `uname -v` and `uname –r` commands to obtain kernel version and release information as well as the `hostname` command to obtain the hostname of the system.(Citation: Claroty-IOCONTROL)(Citation: Armis-IOCONTROL)","relationship_id":"relationship--8e44e98f-b8aa-46f2-83dd-ada429e9f4e9","references":[{"source_name":"Claroty-IOCONTROL","description":"Claroty Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Retrieved September 2, 2026.","url":"https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol"},{"source_name":"Armis-IOCONTROL","description":"Michael Freeman. (2024, December 16). IOControl Malware: What's New, What's Not?. Retrieved September 2, 2026.","url":"https://www.armis.com/blog/iocontrol-malware-whats-new-whats-not/"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has gathered hardware IDs (HWIDs) regarding the victim machine.(Citation: Unit42_Vidar_July2026) [Vidar](https://attack.mitre.org/software/S9050) has used `GetEnvironmentStringsW` and `GetModuleHandleExW` to gather information about the victim machine.(Citation: Cyfirma_Vidar_June2024) [Vidar](https://attack.mitre.org/software/S9050) has collected OS data from the victim machine.(Citation: QuorumCyber_Vidar_March2023)(Citation: Logpoint_StealerMalwareFamilies_2024)\n","relationship_id":"relationship--b880fc5d-236d-44b5-90ec-46ce43c330ed","references":[{"source_name":"Cyfirma_Vidar_June2024","description":"CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"},{"source_name":"Logpoint_StealerMalwareFamilies_2024","description":"Khadgi, N. (n.d.). A Comprehensive Overview on Stealer Malware Families. Retrieved August 25, 2026.","url":"https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"},{"source_name":"Unit42_Vidar_July2026","description":"Nannaka, B., Chhaparwal, P. (2026, July 7). Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation. Retrieved July 8, 2026.","url":"https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"},{"source_name":"QuorumCyber_Vidar_March2023","description":"Quorum Cyber. (n.d.). Malware Analysis Report Vidar - Stealerware. Retrieved August 28, 2026.","url":"https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf"}]},{"id":"S9052","name":"MiniFast","url":"https://attack.mitre.org/software/S9052","kind":"malware","description":"[MiniFast](https://attack.mitre.org/software/S9052) has collected the victim's username, hostname and domain information.(Citation: CheckPoint_NimbusManticore_May2026)","relationship_id":"relationship--c40c369b-d68a-4f89-a5ee-4fa5b95bf472","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","description":"Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}]},{"id":"S9053","name":"MiniJunk","url":"https://attack.mitre.org/software/S9053","kind":"malware","description":"[MiniJunk](https://attack.mitre.org/software/S9053) has the ability to gather the computer name.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025) ","relationship_id":"relationship--fbf97550-8c44-4b68-8c99-8a61dfae4947","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]},{"id":"S9059","name":"MiniBike","url":"https://attack.mitre.org/software/S9059","kind":"malware","description":"[MiniBike](https://attack.mitre.org/software/S9059) has collected system information from the victim machine.(Citation: Mandiant_UNC1549_Feb2024) ","relationship_id":"relationship--dea3c118-57a6-4ce2-b8f2-01cb6e417d6d","references":[{"source_name":"Mandiant_UNC1549_Feb2024","description":"Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}]},{"id":"S9063","name":"DEEPROOT","url":"https://attack.mitre.org/software/S9063","kind":"malware","description":"[DEEPROOT](https://attack.mitre.org/software/S9063) has gathered the victim hostname.(Citation: Mandiant_UNC1549_Nov2025)","relationship_id":"relationship--8cc363e3-8239-4eb9-b149-cdacedd2879c","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]},{"id":"S9067","name":"TWOSTROKE","url":"https://attack.mitre.org/software/S9067","kind":"malware","description":"[TWOSTROKE](https://attack.mitre.org/software/S9067) has gathered victim hostname and the domain through `GetComputerNameExW(ComputerNameDnsFullyQualified)`.(Citation: Mandiant_UNC1549_Nov2025)","relationship_id":"relationship--09a27a67-29f5-4ecf-ac38-b0acd0041105","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"actors":[{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"[Ke3chang](https://attack.mitre.org/groups/G0004) performs operating system information discovery using <code>systeminfo</code> and has used implants to identify the system language and computer name.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)","relationship_id":"relationship--f865403f-5b4a-4e5a-bb50-8d416ad36db4","references":[{"source_name":"Mandiant Operation Ke3chang November 2014","description":"Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source_name":"NCC Group APT15 Alive and Strong","description":"Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"},{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) surveys a system upon check-in to discover operating system configuration details using the <code>systeminfo</code> and <code>set</code> commands.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020)","relationship_id":"relationship--e2675622-ec8e-4894-9f5e-3c82944e3019","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"ESET ComRAT May 2020","description":"Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"id":"G0012","name":"Darkhotel","url":"https://attack.mitre.org/groups/G0012","kind":"intrusion-set","description":"[Darkhotel](https://attack.mitre.org/groups/G0012) has collected the hostname, OS version, service pack version, and the processor architecture from the victim’s machine.(Citation: Securelist Darkhotel Aug 2015)(Citation: Microsoft DUBNIUM July 2016)","relationship_id":"relationship--2c44970b-616d-401e-b9ed-72ac39ca5709","references":[{"source_name":"Securelist Darkhotel Aug 2015","description":"Kaspersky Lab's Global Research & Analysis Team. (2015, August 10). Darkhotel's attacks in 2015. Retrieved November 2, 2018.","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"},{"source_name":"Microsoft DUBNIUM July 2016","description":"Microsoft. (2016, July 14). Reverse engineering DUBNIUM – Stage 2 payload analysis . Retrieved March 31, 2021.","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}]},{"id":"G0018","name":"admin@338","url":"https://attack.mitre.org/groups/G0018","kind":"intrusion-set","description":"[admin@338](https://attack.mitre.org/groups/G0018) actors used the following commands after exploiting a machine with [LOWBALL](https://attack.mitre.org/software/S0042) malware to obtain information about the OS: <code>ver >> %temp%\\download</code> <code>systeminfo >> %temp%\\download</code>(Citation: FireEye admin@338)","relationship_id":"relationship--eb85fa2e-3c50-4130-9717-8688237fecbc","references":[{"source_name":"FireEye admin@338","description":"FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"id":"G0022","name":"APT3","url":"https://attack.mitre.org/groups/G0022","kind":"intrusion-set","description":"[APT3](https://attack.mitre.org/groups/G0022) has a tool that can obtain information about the local system.(Citation: Symantec Buckeye)(Citation: evolution of pirpi)","relationship_id":"relationship--b0791504-fc65-402b-bc47-bd96ed4abea1","references":[{"source_name":"Symantec Buckeye","description":"Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"},{"source_name":"evolution of pirpi","description":"Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf"}]},{"id":"G0026","name":"APT18","url":"https://attack.mitre.org/groups/G0026","kind":"intrusion-set","description":"[APT18](https://attack.mitre.org/groups/G0026) can collect system information from the victim’s machine.(Citation: PaloAlto DNS Requests May 2016)","relationship_id":"relationship--c47e35e1-cf8a-4c2b-b63d-25b37a008226","references":[{"source_name":"PaloAlto DNS Requests May 2016","description":"Grunzweig, J., et al. (2016, May 24). New Wekby Attacks Use DNS Requests As Command and Control Mechanism. Retrieved November 15, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"Several [Lazarus Group](https://attack.mitre.org/groups/G0032) malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)(Citation: Lazarus APT January 2022)","relationship_id":"relationship--4eec017c-8bf2-4eda-8c92-15926fc7e5aa","references":[{"source_name":"Novetta Blockbuster Destructive Malware","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster Loaders","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Loaders, Installers and Uninstallers Report. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source_name":"Novetta Blockbuster","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Lazarus APT January 2022","description":"Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee Lazarus Resurfaces Feb 2018","description":"Sherstobitoff, R. (2018, February 12). Lazarus Resurfaces, Targets Global Banks and Bitcoin Users. Retrieved February 19, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) used a backdoor to enumerate information about the infected system's operating system.(Citation: ESET Telebots July 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)\t","relationship_id":"relationship--f7f1c7c3-192b-4675-815d-0a61b3e3a206","references":[{"source_name":"ESET Telebots July 2017","description":"Cherepanov, A.. (2017, July 4). Analysis of TeleBots’ cunning backdoor . Retrieved June 11, 2020.","url":"https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"},{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","description":"Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"id":"G0038","name":"Stealth Falcon","url":"https://attack.mitre.org/groups/G0038","kind":"intrusion-set","description":"[Stealth Falcon](https://attack.mitre.org/groups/G0038) malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.(Citation: Citizen Lab Stealth Falcon May 2016)","relationship_id":"relationship--efbe5efa-6863-4334-90e5-d7caab9806a6","references":[{"source_name":"Citizen Lab Stealth Falcon May 2016","description":"Marczak, B. and Scott-Railton, J.. (2016, May 29). Keep Calm and (Don’t) Enable Macros: A New Threat Actor Targets UAE Dissidents. Retrieved June 8, 2016.","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"id":"G0040","name":"Patchwork","url":"https://attack.mitre.org/groups/G0040","kind":"intrusion-set","description":"[Patchwork](https://attack.mitre.org/groups/G0040) collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--e8068ad2-97b3-4693-a6ad-a8ee9a272890","references":[{"source_name":"Cymmetria Patchwork","description":"Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) has used csvde.exe, which is a built-in Windows command line tool, to export system information. Additionally, WsTaskLoad has gathered system information, such as operating system and hostname.(Citation: BlackBerry_FIN7_April2024) ","relationship_id":"relationship--8fa843c8-bd61-48a2-8c65-587f6d96e238","references":[{"source_name":"BlackBerry_FIN7_April2024","description":" The BlackBerry Research and Intelligence Team. (2024, April 17). Threat Group FIN7 Targets the U.S. Automotive Industry. Retrieved May 1, 2025.","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"A [Gamaredon Group](https://attack.mitre.org/groups/G0047) file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025)(Citation: ESET Gamaredon Sept2024) ","relationship_id":"relationship--36112f24-7814-4c75-b5b7-a1205bb28b68","references":[{"source_name":"CERT-EE Gamaredon January 2021","description":"CERT-EE. (2021, January 27). Gamaredon Infection: From Dropper to Entry. Retrieved February 17, 2022.","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source_name":"TrendMicro Gamaredon April 2020","description":"Kakara, H., Maruyama, E. (2020, April 17). Gamaredon APT Group Use Covid-19 Lure in Campaigns. Retrieved May 19, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source_name":"Palo Alto Gamaredon Feb 2017","description":"Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source_name":"ESET Gamaredon Sept2024","description":"Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","description":"Threat Hunter Team, Symantec and Carbon Black. (2025, April 10). Shuckworm Targets Foreign Military Mission Based in Ukraine. Retrieved July 23, 2025.","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has run <code>hostname</code> and <code>systeminfo</code> on a victim.(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: FireEye APT34 July 2019)(Citation: Check Point APT34 April 2021)(Citation: Symantec Crambus OCT 2023)\n\t","relationship_id":"relationship--0c03f2b4-a752-4d74-9c26-5306132a3329","references":[{"source_name":"FireEye APT34 July 2019","description":"Bromiley, M., et al.. (2019, July 18). Hard Pass: Declining APT34’s Invite to Join Their Professional Network. Retrieved August 26, 2019.","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source_name":"Check Point APT34 April 2021","description":"Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"},{"source_name":"Palo Alto OilRig May 2016","description":"Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"},{"source_name":"Palo Alto OilRig Oct 2016","description":"Grunzweig, J. and Falcone, R.. (2016, October 4). OilRig Malware Campaign Updates Toolset and Expands Targets. Retrieved May 3, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/10/unit42-oilrig-malware-campaign-updates-toolset-and-expands-targets/"},{"source_name":"Symantec Crambus OCT 2023","description":"Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050) has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. [APT32](https://attack.mitre.org/groups/G0050) executed shellcode to identify the name of the infected host.(Citation: ESET OceanLotus)(Citation: ESET OceanLotus Mar 2019)(Citation: ESET OceanLotus macOS April 2019)(Citation: FireEye APT32 April 2020)","relationship_id":"relationship--43809fa9-dbe2-4429-875e-f0828563d6aa","references":[{"source_name":"ESET OceanLotus","description":"Foltýn, T. (2018, March 13). OceanLotus ships new backdoor using old tricks. Retrieved May 22, 2018.","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"},{"source_name":"ESET OceanLotus Mar 2019","description":"Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"},{"source_name":"ESET OceanLotus macOS April 2019","description":"Dumont, R.. (2019, April 9). OceanLotus: macOS malware update. Retrieved April 15, 2019.","url":"https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"},{"source_name":"FireEye APT32 April 2020","description":"Henderson, S., et al. (2020, April 22). Vietnamese Threat Actors APT32 Targeting Wuhan Government and Chinese Ministry of Emergency Management in Latest Example of COVID-19 Related Espionage. Retrieved April 28, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"}]},{"id":"G0054","name":"Sowbug","url":"https://attack.mitre.org/groups/G0054","kind":"intrusion-set","description":"[Sowbug](https://attack.mitre.org/groups/G0054) obtained OS version and hardware configuration from a victim.(Citation: Symantec Sowbug Nov 2017)","relationship_id":"relationship--e20b57e5-c010-4b9e-a04e-660daa8b5c87","references":[{"source_name":"Symantec Sowbug Nov 2017","description":"Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)","relationship_id":"relationship--b60dcc78-83b0-4fe2-b874-6f22f99b6087","references":[{"source_name":"DFIR Phosphorus November 2021","description":"DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source_name":"DFIR Report APT35 ProxyShell March 2022","description":"DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022.","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source_name":"Unit 42 Magic Hound Feb 2017","description":"Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"id":"G0061","name":"FIN8","url":"https://attack.mitre.org/groups/G0061","kind":"intrusion-set","description":"[FIN8](https://attack.mitre.org/groups/G0061) has used PowerShell Scripts to check the architecture of a compromised machine before the selection of a 32-bit or 64-bit version of a malicious .NET loader.(Citation: Symantec FIN8 Jul 2023)","relationship_id":"relationship--c8342b87-ceea-40e0-a9ad-11b72aa1378f","references":[{"source_name":"Symantec FIN8 Jul 2023","description":"Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"id":"G0067","name":"APT37","url":"https://attack.mitre.org/groups/G0067","kind":"intrusion-set","description":"[APT37](https://attack.mitre.org/groups/G0067) collects the computer name, the BIOS model, and execution path.(Citation: Talos Group123)","relationship_id":"relationship--3ee8862f-2595-462e-8df8-aab639314b65","references":[{"source_name":"Talos Group123","description":"Mercer, W., Rascagneres, P. (2018, January 16). Korea In The Crosshairs. Retrieved May 21, 2018.","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"id":"G0069","name":"MuddyWater","url":"https://attack.mitre.org/groups/G0069","kind":"intrusion-set","description":"[MuddyWater](https://attack.mitre.org/groups/G0069) has used malware that can collect the victim’s OS version and machine name.(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)","relationship_id":"relationship--9c5c8dbe-ec34-46f9-b4af-0a6e73f00c89","references":[{"source_name":"Talos MuddyWater May 2019","description":"Adamitis, D. et al. (2019, May 20). Recent MuddyWater-associated BlackWater campaign shows signs of new anti-detection techniques. Retrieved June 5, 2019.","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"},{"source_name":"Securelist MuddyWater Oct 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.","url":"https://securelist.com/muddywater/88059/"},{"source_name":"Talos MuddyWater Jan 2022","description":"Malhortra, A and Ventura, V. (2022, January 31). Iranian APT MuddyWater targets Turkish users via malicious PDFs, executables. Retrieved June 22, 2022.","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"},{"source_name":"Trend Micro Muddy Water March 2021","description":"Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source_name":"Reaqta MuddyWater November 2017","description":"Reaqta. (2017, November 22). A dive into MuddyWater APT targeting Middle-East. Retrieved May 18, 2020.","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"}]},{"id":"G0073","name":"APT19","url":"https://attack.mitre.org/groups/G0073","kind":"intrusion-set","description":"[APT19](https://attack.mitre.org/groups/G0073) collected system architecture information. [APT19](https://attack.mitre.org/groups/G0073) used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.(Citation: FireEye APT19)(Citation: Unit 42 C0d0so0 Jan 2016)","relationship_id":"relationship--c3d9182c-178b-4d8d-91d8-f4d1313738bb","references":[{"source_name":"FireEye APT19","description":"Ahl, I. (2017, June 06). Privileges and Credentials: Phished at the Request of Counsel. Retrieved May 17, 2018.","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"},{"source_name":"Unit 42 C0d0so0 Jan 2016","description":"Grunzweig, J., Lee, B. (2016, January 22). New Attacks Linked to C0d0so0 Group. Retrieved August 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) has detected a target system’s OS version.(Citation: TrendMicro TropicTrooper 2015)(Citation: TrendMicro Tropic Trooper May 2020)","relationship_id":"relationship--cd5799f3-8be5-4272-88db-626940136130","references":[{"source_name":"TrendMicro TropicTrooper 2015","description":"Alintanahin, K. (2015). Operation Tropic Trooper: Relying on Tried-and-Tested Flaws to Infiltrate Secret Keepers. Retrieved June 14, 2019.","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"},{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.(Citation: CISA AA20-239A BeagleBoyz August 2020) [APT38](https://attack.mitre.org/groups/G0082) has executed malware to collect current user, host name, system time, and operating system install date from targeted systems.(Citation: Microsoft Axios Compromise APR 2026)(Citation: Microsoft Sapphire Sleet APR 2026)(Citation: MIcrosoft Mastra npm Compromise JUN 2026)","relationship_id":"relationship--870cebf9-bf09-451c-a894-cad79936bb67","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","description":"DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source_name":"Microsoft Axios Compromise APR 2026","description":"Microsoft Threat Intelligence. (2026, April 1). Mitigating the Axios npm supply chain compromise. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"Microsoft Sapphire Sleet APR 2026","description":"Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"},{"source_name":"MIcrosoft Mastra npm Compromise JUN 2026","description":"Microsoft Threat Intelligence. (2026, June 17). From package to postinstall payload: Inside the Mastra npm supply chain compromise by Sapphire Sleet. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/06/17/postinstall-payload-inside-mastra-npm-supply-chain-compromise/"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has enumerated OS type, OS version, and other information using a script or the \"systeminfo\" command.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021) [Kimsuky](https://attack.mitre.org/groups/G0094) has also obtained system information such as OS type, OS version, and system type through querying various Windows Management Instrumentation (WMI) classes including `Win32_OperatingSystem`.(Citation: Securonix Kimsuky February 2025)(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--96a9cf17-42b0-4317-82e6-55e42a2dab41","references":[{"source_name":"Talos Kimsuky Nov 2021","description":"An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"Securonix Kimsuky February 2025","description":"Den Iuzvyk, Tim Peck. (2025, February 13). Analyzing DEEP#DRIVE: North Korean Threat Actors Observed Exploiting Trusted Platforms for Targeted Attacks. Retrieved August 19, 2025.","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source_name":"Securelist Kimsuky Sept 2013","description":"Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) uses multiple built-in commands such as <code>systeminfo</code> and `net config Workstation` to enumerate victim system basic configuration information.(Citation: Rostovcev APT41 2021)","relationship_id":"relationship--0f9f9bd3-ccea-4369-b8e7-371d1aad5ff8","references":[{"source_name":"Rostovcev APT41 2021","description":"Nikita Rostovcev. (2022, August 18). APT41 World Tour 2021 on a tight schedule. Retrieved February 22, 2024.","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"id":"G0100","name":"Inception","url":"https://attack.mitre.org/groups/G0100","kind":"intrusion-set","description":"[Inception](https://attack.mitre.org/groups/G0100) has used a reconnaissance module to gather information about the operating system and hardware on the infected host.(Citation: Symantec Inception Framework March 2018)","relationship_id":"relationship--4b3f85b7-a7a4-446f-a3cb-d922268ee879","references":[{"source_name":"Symantec Inception Framework March 2018","description":"Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}]},{"id":"G0102","name":"Wizard Spider","url":"https://attack.mitre.org/groups/G0102","kind":"intrusion-set","description":"[Wizard Spider](https://attack.mitre.org/groups/G0102) has used [Systeminfo](https://attack.mitre.org/software/S0096) and similar commands to acquire detailed configuration information of a victim's machine. [Wizard Spider](https://attack.mitre.org/groups/G0102) has also utilized the PowerShell cmdlet `Get-ADComputer` to collect DNS hostnames, last logon dates, and operating system information from Active Directory.(Citation: DFIR Ryuk's Return October 2020)(Citation: Mandiant FIN12 Oct 2021)","relationship_id":"relationship--e24411cf-6274-4b6b-87b4-b90b01146c8d","references":[{"source_name":"Mandiant FIN12 Oct 2021","description":"Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source_name":"DFIR Ryuk's Return October 2020","description":"The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"id":"G0106","name":"Rocke","url":"https://attack.mitre.org/groups/G0106","kind":"intrusion-set","description":"[Rocke](https://attack.mitre.org/groups/G0106) has used uname -m to collect the name and information about the infected system's kernel.(Citation: Anomali Rocke March 2019)","relationship_id":"relationship--322876d6-1b49-43d8-9e4a-590919d1f930","references":[{"source_name":"Anomali Rocke March 2019","description":"Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"id":"G0108","name":"Blue Mockingbird","url":"https://attack.mitre.org/groups/G0108","kind":"intrusion-set","description":"[Blue Mockingbird](https://attack.mitre.org/groups/G0108) has collected hardware details for the victim's system, including CPU and memory information.(Citation: RedCanary Mockingbird May 2020)","relationship_id":"relationship--1b9b84cc-f9c7-48c5-8e23-ac00a7a4691a","references":[{"source_name":"RedCanary Mockingbird May 2020","description":"Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"id":"G0112","name":"Windshift","url":"https://attack.mitre.org/groups/G0112","kind":"intrusion-set","description":"[Windshift](https://attack.mitre.org/groups/G0112) has used malware to identify the computer name of a compromised host.(Citation: BlackBerry Bahamut)","relationship_id":"relationship--ea41718b-4215-43d4-8d1f-def88af935e3","references":[{"source_name":"BlackBerry Bahamut","description":"The BlackBerry Research & Intelligence Team. (2020, October). BAHAMUT: Hack-for-Hire Masters of Phishing, Fake News, and Fake Apps. Retrieved February 8, 2021.","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"id":"G0121","name":"Sidewinder","url":"https://attack.mitre.org/groups/G0121","kind":"intrusion-set","description":"[Sidewinder](https://attack.mitre.org/groups/G0121) has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder COVID-19 June 2020)","relationship_id":"relationship--b30cc0be-74f0-42a6-85ef-594d6d184bae","references":[{"source_name":"ATT Sidewinder January 2021","description":"Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source_name":"Rewterz Sidewinder COVID-19 June 2020","description":"Rewterz. (2020, June 22). Analysis on Sidewinder APT Group – COVID-19. Retrieved January 29, 2021.","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"}]},{"id":"G0124","name":"Windigo","url":"https://attack.mitre.org/groups/G0124","kind":"intrusion-set","description":"[Windigo](https://attack.mitre.org/groups/G0124) has used a script to detect which Linux distribution and version is currently installed on the system.(Citation: ESET ForSSHe December 2018)","relationship_id":"relationship--06ae1d46-2349-457e-817b-e9fdca2f7768","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"G0126","name":"Higaisa","url":"https://attack.mitre.org/groups/G0126","kind":"intrusion-set","description":"[Higaisa](https://attack.mitre.org/groups/G0126) collected the system GUID and computer name.(Citation: PTSecurity Higaisa 2020)(Citation: Malwarebytes Higaisa 2020)","relationship_id":"relationship--63dec489-68ad-46c2-9972-55394ad7601a","references":[{"source_name":"Malwarebytes Higaisa 2020","description":"Malwarebytes Threat Intelligence Team. (2020, June 4). New LNK attack tied to Higaisa APT discovered. Retrieved March 2, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source_name":"PTSecurity Higaisa 2020","description":"PT ESC Threat Intelligence. (2020, June 4). COVID-19 and New Year greetings: an investigation into the tools and methods used by the Higaisa group. Retrieved March 2, 2021.","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]},{"id":"G0128","name":"ZIRCONIUM","url":"https://attack.mitre.org/groups/G0128","kind":"intrusion-set","description":"[ZIRCONIUM](https://attack.mitre.org/groups/G0128) has used a tool to capture the processor architecture of a compromised host in order to register it with C2.(Citation: Zscaler APT31 Covid-19 October 2020)","relationship_id":"relationship--0e07a552-cea0-47f0-b96b-009a19c3e09a","references":[{"source_name":"Zscaler APT31 Covid-19 October 2020","description":"Singh, S. and Antil, S. (2020, October 27). APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services. Retrieved March 24, 2021.","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has gathered system information using <code>systeminfo</code>.(Citation: Avira Mustang Panda January 2020)","relationship_id":"relationship--88221b55-8e8a-4a38-b477-a45907083011","references":[{"source_name":"Avira Mustang Panda January 2020","description":"Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has searched for system version, architecture, and hostname information.(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--a641447f-995a-4f06-93d2-637e265c7638","references":[{"source_name":"ATT TeamTNT Chimaera September 2020","description":"AT&T Alien Labs. (2021, September 8). TeamTNT with new campaign aka Chimaera. Retrieved September 22, 2021.","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"},{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"id":"G0143","name":"Aquatic Panda","url":"https://attack.mitre.org/groups/G0143","kind":"intrusion-set","description":"[Aquatic Panda](https://attack.mitre.org/groups/G0143) has used native OS commands to understand privilege levels and system details.(Citation: CrowdStrike AQUATIC PANDA December 2021)","relationship_id":"relationship--cf629c11-56bd-4804-a03a-311689060c85","references":[{"source_name":"CrowdStrike AQUATIC PANDA December 2021","description":"Wiley, B. et al. (2021, December 29). OverWatch Exposes AQUATIC PANDA in Possession of Log4Shell Exploit Tools During Hands-on Intrusion Attempt. Retrieved January 18, 2022.","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"id":"G1001","name":"HEXANE","url":"https://attack.mitre.org/groups/G1001","kind":"intrusion-set","description":"[HEXANE](https://attack.mitre.org/groups/G1001) has collected the hostname of a compromised machine.(Citation: Kaspersky Lyceum October 2021)","relationship_id":"relationship--1f238bb1-62c0-409b-ac79-38b38f54497d","references":[{"source_name":"Kaspersky Lyceum October 2021","description":"Kayal, A. et al. (2021, October). LYCEUM REBORN: COUNTERINTELLIGENCE IN THE MIDDLE EAST. Retrieved June 14, 2022.","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"id":"G1008","name":"SideCopy","url":"https://attack.mitre.org/groups/G1008","kind":"intrusion-set","description":"[SideCopy](https://attack.mitre.org/groups/G1008) has identified the OS version of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)","relationship_id":"relationship--c1c32fe3-7aba-4d58-94df-89ce60a76810","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","description":"Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"id":"G1009","name":"Moses Staff","url":"https://attack.mitre.org/groups/G1009","kind":"intrusion-set","description":"[Moses Staff](https://attack.mitre.org/groups/G1009) collected information about the infected host, including the machine names and OS architecture.(Citation: Checkpoint MosesStaff Nov 2021)\n","relationship_id":"relationship--536e8b4c-af1b-44da-aba7-e46068ced103","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","description":"Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"id":"G1012","name":"CURIUM","url":"https://attack.mitre.org/groups/G1012","kind":"intrusion-set","description":"[CURIUM](https://attack.mitre.org/groups/G1012) deploys information gathering tools focused on capturing IP configuration, running application, system information, and network connectivity information.(Citation: Symantec Tortoiseshell 2019)","relationship_id":"relationship--6600e60d-666f-4d7a-8e30-d4361f892a9f","references":[{"source_name":"Symantec Tortoiseshell 2019","description":"Symantec Threat Hunter Team. (2019, September 18). Tortoiseshell Group Targets IT Providers in Saudi Arabia in Probable Supply Chain Attacks. Retrieved May 20, 2024.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) has executed scripts to identify the underlying operating system to ensure it uses the correct installation package for malicious payloads.(Citation: Mandiant VMware vSphere JUL 2025)","relationship_id":"relationship--a6f54d8a-7659-4efb-b53b-0e05664bdd23","references":[{"source_name":"Mandiant VMware vSphere JUL 2025","description":"Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"id":"G1016","name":"FIN13","url":"https://attack.mitre.org/groups/G1016","kind":"intrusion-set","description":"[FIN13](https://attack.mitre.org/groups/G1016) has collected local host information by utilizing Windows commands `systeminfo`, `fsutil`, and `fsinfo`. [FIN13](https://attack.mitre.org/groups/G1016) has also utilized a compromised Symantex Altiris console and LanDesk account to retrieve host information.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)","relationship_id":"relationship--3114ebc8-7dc2-4ee7-8aad-5b764f27a6d8","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","description":"Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source_name":"Mandiant FIN13 Aug 2022","description":"Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"id":"G1018","name":"TA2541","url":"https://attack.mitre.org/groups/G1018","kind":"intrusion-set","description":"[TA2541](https://attack.mitre.org/groups/G1018) has collected system information prior to downloading malware on the targeted host.(Citation: Proofpoint TA2541 February 2022)","relationship_id":"relationship--2fa01aae-a201-4daa-b0e0-2e22af5788bb","references":[{"source_name":"Proofpoint TA2541 February 2022","description":"Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"id":"G1020","name":"Mustard Tempest","url":"https://attack.mitre.org/groups/G1020","kind":"intrusion-set","description":"[Mustard Tempest](https://attack.mitre.org/groups/G1020) has used implants to perform system reconnaissance on targeted systems.(Citation: Microsoft Ransomware as a Service)","relationship_id":"relationship--e08f461a-7ebb-41e8-8e97-9ade8f52e4e2","references":[{"source_name":"Microsoft Ransomware as a Service","description":"Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"id":"G1026","name":"Malteiro","url":"https://attack.mitre.org/groups/G1026","kind":"intrusion-set","description":"[Malteiro](https://attack.mitre.org/groups/G1026) collects the machine information, system architecture, the OS version, computer name, and Windows product name.(Citation: SCILabs Malteiro 2021)","relationship_id":"relationship--6d279a48-f529-4f5d-be3a-a53529055323","references":[{"source_name":"SCILabs Malteiro 2021","description":"SCILabs. (2021, December 23). Cyber Threat Profile Malteiro. Retrieved March 13, 2024.","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"id":"G1034","name":"Daggerfly","url":"https://attack.mitre.org/groups/G1034","kind":"intrusion-set","description":"[Daggerfly](https://attack.mitre.org/groups/G1034) utilizes victim machine operating system information to create custom User Agent strings for subsequent command and control communication.(Citation: ESET EvasivePanda 2024)","relationship_id":"relationship--b642368c-b543-471a-93f2-40af6ff94cbf","references":[{"source_name":"ESET EvasivePanda 2024","description":"Ahn Ho, Facundo Muñoz, & Marc-Etienne M.Léveillé. (2024, March 7). Evasive Panda leverages Monlam Festival to target Tibetans. Retrieved July 25, 2024.","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"id":"G1035","name":"Winter Vivern","url":"https://attack.mitre.org/groups/G1035","kind":"intrusion-set","description":"[Winter Vivern](https://attack.mitre.org/groups/G1035) script execution includes basic victim information gathering steps which are then transmitted to command and control servers.(Citation: DomainTools WinterVivern 2021)","relationship_id":"relationship--d0ddfe52-8e91-4576-b7e2-912b51eca87d","references":[{"source_name":"DomainTools WinterVivern 2021","description":"Chad Anderson. (2021, April 27). Winter Vivern: A Look At Re-Crafted Government MalDocs Targeting Multiple Languages. Retrieved July 29, 2024.","url":"https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"}]},{"id":"G1036","name":"Moonstone Sleet","url":"https://attack.mitre.org/groups/G1036","kind":"intrusion-set","description":"[Moonstone Sleet](https://attack.mitre.org/groups/G1036) has gathered information on victim systems.(Citation: Microsoft Moonstone Sleet 2024)","relationship_id":"relationship--f65ea007-e6e0-4311-a766-4ca60f17a79f","references":[{"source_name":"Microsoft Moonstone Sleet 2024","description":"Microsoft Threat Intelligence. (2024, May 28). Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks. Retrieved August 26, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"id":"G1039","name":"RedCurl","url":"https://attack.mitre.org/groups/G1039","kind":"intrusion-set","description":"[RedCurl](https://attack.mitre.org/groups/G1039) has collected information about the target system, such as system information and list of network connections.(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)  ","relationship_id":"relationship--85c97a8c-75ff-4469-bcc4-28c64a928390","references":[{"source_name":"group-ib_redcurl1","description":"Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","description":"Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"id":"G1040","name":"Play","url":"https://attack.mitre.org/groups/G1040","kind":"intrusion-set","description":"\n[Play](https://attack.mitre.org/groups/G1040) has leveraged tools to enumerate system information.(Citation: Trend Micro Ransomware Spotlight Play July 2023)","relationship_id":"relationship--b8ecd33a-190f-4f7d-945d-c258512d76d4","references":[{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","description":"Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) used various system commands and tools to pull system information during operations.(Citation: FBI BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--093c0ace-8e89-4948-8aab-f7b484347f6a","references":[{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source_name":"Symantec BlackByte 2022","description":"Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"},{"source_name":"FBI BlackByte 2022","description":"US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024.","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"id":"G1044","name":"APT42","url":"https://attack.mitre.org/groups/G1044","kind":"intrusion-set","description":"[APT42](https://attack.mitre.org/groups/G1044) has used malware, such as GHAMBAR and POWERPOST, to collect system information.(Citation: Mandiant APT42-charms) ","relationship_id":"relationship--c140a027-1994-4e00-a9f9-8c407f22b486","references":[{"source_name":"Mandiant APT42-charms","description":"Mandiant. (n.d.). APT42: Crooked Charms, Cons and Compromises. Retrieved October 9, 2024.","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has discovered system information details utilizing CLI on network devices.(Citation: CISA_AA25-239ASaltTyphoon_Sept2025) ","relationship_id":"relationship--0e79e44d-036a-478f-a6f5-1acc420095bf","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged `cmd.exe` to identify system info `cmd.exe /c systeminfo`.(Citation: CISA Medusa Group Medusa Ransomware March 2025)","relationship_id":"relationship--efa41e3c-752a-43e4-81e4-dfac1dbd75a3","references":[{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"id":"G1052","name":"Contagious Interview","url":"https://attack.mitre.org/groups/G1052","kind":"intrusion-set","description":"[Contagious Interview](https://attack.mitre.org/groups/G1052) has configured malicious webpages to identify the victim’s operating system by reviewing the details of the victims User-Agent of their browser.(Citation: Sekoia ClickFake 2025)","relationship_id":"relationship--bf35d6f4-4ea1-4d4d-bb02-b5d4f6b9f0eb","references":[{"source_name":"Sekoia ClickFake 2025","description":"Amaury G., Coline Chavane, Felix Aimé and Sekoia TDR. (2025, March 31). From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic. Retrieved April 1, 2025.","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"}]},{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) has leveraged native Windows tools and commands such as `systeminfo` and open-source tools including OSQuery and ossec-win32 to query details about the endpoint.(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)","relationship_id":"relationship--baf93cec-ad47-4380-bda7-9569e088b5e9","references":[{"source_name":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","description":"Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has employed malicious macros and native Windows tools such as csvde.exe, nltest.exe and quser.exe for discovery.(Citation: ITOCHU LODEINFO JAN 2024)(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--b6c71a79-0909-4a01-b026-306040e0da44","references":[{"source_name":"ITOCHU LODEINFO JAN 2024","description":"ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"},{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has gathered system information and disseminated it back to C2.(Citation: FBI IC3 Flash VOID MANTICORE Handala Hack March 2026)","relationship_id":"relationship--8ee927ba-1638-46c5-8510-a77d584e42d0","references":[{"source_name":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","description":"FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to  Push Malware to Identified Targets. Retrieved April 20, 2026.","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has used the MeshCentral command-line utility meshctrl.js to collect hostnames and IDs of compromised systems.(Citation: Google_SHOracle_Jun2026)","relationship_id":"relationship--272163a2-0b55-4d7a-b955-b7fa1022a7e2","references":[{"source_name":"Google_SHOracle_Jun2026","description":"Mandiant, Google Threat Intelligence Group. (2026, June 11). ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit. Retrieved June 11, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]}],"mitigations":[],"candidates":[{"id":"034fe21c-3186-49dd-8d5d-128b35f181c7","name":"Linux List Kernel Modules","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Enumerate kernel modules installed 3 different ways. Upon successful execution stdout will display kernel modules installed on host 2 times, followed by list of modules matching 'vmw' if present.\n","inputs":{},"dependencies":[],"source_definition_sha256":"e68884e1d1241ee8446b3f2a4cbd697d292567a0660017922dd43952be1d01f4"},{"id":"07b18a66-6304-47d2-bad0-ef421eb2e107","name":"WinPwn - PowerSharpPack - Watson searching for missing windows patches","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"PowerSharpPack - Watson searching for missing windows patches  technique via function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"3484108b49ecfdbfae80506b0e120ed820a73efb7fafb3ff1747f513de355e84"},{"id":"2040405c-eea6-4c1c-aef3-c2acc430fac9","name":"ESXi - VM Discovery using ESXCLI","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"An adversary will using ESXCLI to enumerate the Virtual Machines on the host prior to executing power off routine.\n[Reference](https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/)\n","inputs":{"vm_host":{"description":"Specify the host name or IP of the ESXi Server","type":"string","default":"atomic.local"},"vm_user":{"description":"Specify the privilege user account on ESXi Server","type":"string","default":"root"},"vm_pass":{"description":"Specify the privilege user password on ESXi Server","type":"string","default":"pass"},"plink_file":{"description":"Path to Plink","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\plink.exe"},"cli_script":{"description":"Path to file with discovery commands","type":"path","default":"PathToAtomicsFolder\\T1082\\src\\esx_vmdiscovery.txt"}},"dependencies":[{"description":"Check if plink is available.\n"}],"source_definition_sha256":"ca28bd279745a21cfff0048be6a82f844ebfc0bf368d9ba31b7b61eb85abb45b"},{"id":"224b4daf-db44-404e-b6b2-f4d1f0126ef8","name":"Windows MachineGUID Discovery","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify the Windows MachineGUID value for a system. Upon execution, the machine GUID will be displayed from registry.\n","inputs":{},"dependencies":[],"source_definition_sha256":"8cf45f39d64dab1aeed05305229f540b5d0e1c1fdb1956d406d667e0ac16c887"},{"id":"31dad7ad-2286-4c02-ae92-274418c85fec","name":"Linux VM Check via Hardware","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify virtual machine hardware. This technique is used by the Pupy RAT and other malware.\n","inputs":{},"dependencies":[],"source_definition_sha256":"244a16f54ff60c00cad8f427083062d9fd5c512e82b8d3614f43f1831d097851"},{"id":"3278b2f6-f733-4875-9ef4-bfed34244f0a","name":"WinPwn - Morerecon","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Gathers local system information using the Morerecon function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"adf2b8158f53345ba8955bceb7909d41ddc24ec2e2f4c0e7a802601b1aedc4ca"},{"id":"327cc050-9e99-4c8e-99b5-1d15f2fb6b96","name":"Show System Integrity Protection status (MacOS)","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Read and Display System Intergrety Protection status. csrutil is commonly used by malware and post-exploitation tools to determine whether certain files and directories on the system are writable or not.\n","inputs":{},"dependencies":[],"source_definition_sha256":"7040b2e487daf2938fb0c8d4d2c66ed44fc3fe5f317d86b963d7bfa193e20697"},{"id":"345cb8e4-d2de-4011-a580-619cf5a9e2d7","name":"WinPwn - Powersploits privesc checks","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Powersploits privesc checks using oldchecks function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"b7771ba0446ca97fc808ecbaad2b1c48d0bfcb2e156a08ae6f351c121fa1d596"},{"id":"3d256a2f-5e57-4003-8eb6-64d91b1da7ce","name":"WinPwn - itm4nprivesc","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Discover Local Privilege Escalation possibilities using itm4nprivesc function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"2de584137b20a8b1cb7d21678b82e0dff60674572a4cb70df4eacebcfcc7bc41"},{"id":"4060ee98-01ae-4c8e-8aad-af8300519cc7","name":"System Information Discovery","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"The script gathernetworkinfo.vbs is employed to collect system information such as the operating system, DNS details, firewall configuration, etc. Outputs are stored in c:\\Windows\\System32\\config or c:\\Windows\\System32\\reg. https://www.verboon.info/2011/06/the-gathernetworkinfo-vbs-script/\n","inputs":{},"dependencies":[],"source_definition_sha256":"1bc00151d9ffee88c401df4d9b0ecacea69083e4d2a75f5f01630085308306fa"},{"id":"486e88ea-4f56-470f-9b57-3f4d73f39133","name":"Hostname Discovery","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify system hostname for FreeBSD, Linux and macOS systems.\n","inputs":{},"dependencies":[],"source_definition_sha256":"5635d7c010605e82b4eff11ec61fc5262299040a686cc2e886f648539e7734af"},{"id":"4947897f-643a-4b75-b3f5-bed6885749f6","name":"FreeBSD List Kernel Modules","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Enumerate kernel modules loaded. Upon successful execution stdout will display kernel modules loaded, followed by list of modules matching 'vmm' if present.\n","inputs":{},"dependencies":[],"source_definition_sha256":"ffaa89c5369f3a3062ea09fead0385b33a137d667a22280a5911378092ec71b5"},{"id":"5b6f39a2-6ec7-4783-a5fd-2c54a55409ed","name":"WinPwn - General privesc checks","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"General privesc checks using the otherchecks function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"c1d0f956e8481951f8f236bdcae20696429f8d2564539dee11eae0dda066fd73"},{"id":"5c16ceb4-ba3a-43d7-b848-a13c1f216d95","name":"WinPwn - PowerSharpPack - Seatbelt","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"PowerSharpPack - Seatbelt technique via function of WinPwn.\n\n[Seatbelt](https://github.com/GhostPack/Seatbelt) is a C# project that performs a number of security oriented host-survey \"safety checks\" relevant from both offensive and defensive security perspectives.","inputs":{},"dependencies":[],"source_definition_sha256":"357c851b5f52533f3b18bacc55f6e68bc91d72f538b9a8357b45449fbd3cf1ce"},{"id":"66703791-c902-4560-8770-42b8a91f7667","name":"System Information Discovery","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify System Info. Upon execution, system info and time info will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"639f5868fe3bc7bec3d0be04676881e58f4a2e29290dad8d216fbafcd35f2560"},{"id":"69bd4abe-8759-49a6-8d21-0f15822d6370","name":"Griffon Recon","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"This script emulates the reconnaissance script seen in used by Griffon and was modified by security researcher Kirk Sayre \nin order simply print the recon results to the screen as opposed to exfiltrating them. [Script](https://gist.github.com/kirk-sayre-work/7cb5bf4e2c7c77fa5684ddc17053f1e5).  \nFor more information see also [https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon](https://malpedia.caad.fkie.fraunhofer.de/details/js.griffon) and [https://attack.mitre.org/software/S0417/](https://attack.mitre.org/software/S0417/)","inputs":{"vbscript":{"description":"Path to sample script","type":"string","default":"PathToAtomicsFolder\\T1082\\src\\griffon_recon.vbs"}},"dependencies":[{"description":"Sample script file must exist on disk at specified location (#{vbscript})\n"}],"source_definition_sha256":"a764b6328dd162f563d30fb4ac70e5de539cbc1f27c2884589215c3c2e80e0c2"},{"id":"70e13ef4-5a74-47e4-9d16-760b41b0e2db","name":"operating system discovery ","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"operating system discovery using get-ciminstance\nhttps://petri.com/getting-operating-system-information-powershell/","inputs":{},"dependencies":[],"source_definition_sha256":"fc0d4a7f05b18130b9b177cb2417e74e1446e7abac8663e0917450cab2aae348"},{"id":"7161b085-816a-491f-bab4-d68e974b7995","name":"Display volume shadow copies with \"vssadmin\"","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"The command shows all available volume shadow copies, along with their creation time and location.","inputs":{},"dependencies":[],"source_definition_sha256":"0e1dbf6b6cd048add25ad5796e68b56eb5c72392d21e21630cc3f4d2aa2cc57f"},{"id":"7804659b-fdbf-4cf6-b06a-c03e758590e8","name":"WinPwn - GeneralRecon","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Collect general computer informations via GeneralRecon function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"bbadcf34e33c35597f7c502e530d651f48f633b2a272b2cbb6d8ee7bea1443a0"},{"id":"8057d484-0fae-49a4-8302-4812c4f1e64e","name":"Linux VM Check via Kernel Modules","platforms":["linux"],"method":"automated","executor":"bash","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify virtual machine guest kernel modules. This technique is used by the Pupy RAT and other malware.\n","inputs":{},"dependencies":[],"source_definition_sha256":"fcfc89f1cbee1d5e1633d7059eaf5c443e3fbffe2017b9c1f9773b7d00c7c222"},{"id":"85cfbf23-4a1e-4342-8792-007e004b975f","name":"Hostname Discovery (Windows)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify system hostname for Windows. Upon execution, the hostname of the device will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"7d6e219c4f9feb550f129d477ec03daab4244022446b74cf4c4539624283fafc"},{"id":"8851b73a-3624-4bf7-8704-aa312411565c","name":"System Information Discovery with WMIC","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify system information with the WMI command-line (WMIC) utility. Upon execution, various system information will be displayed, including: OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions.\nhttps://nwgat.ninja/getting-system-information-with-wmic-on-windows/\nElements of this test were observed in the wild used by Aurora Stealer in late 2022 and early 2023, as highlighted in public reporting:\nhttps://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar\nhttps://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/\n","inputs":{},"dependencies":[],"source_definition_sha256":"09a853e1a10ff2b80bf9a7264cd080d85a568bca77a4cbb9992d1b433a2de3a2"},{"id":"96be6002-9200-47db-94cb-c3e27de1cb36","name":"Check computer location","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Looks up country code configured in the registry, likely geofence. Upon execution, country code info will be displayed.\n- https://tria.ge/210111-eaz8mqhgh6/behavioral1\n","inputs":{},"dependencies":[],"source_definition_sha256":"132cd077eeb118dc5c3eec323f6b759c8eba75673b4cf42f85ce90f951563f23"},{"id":"acfcd709-0013-4f1e-b9ee-bc1e7bafaaec","name":"Discover OS Build Number via Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify the Operating System Build Number via registry with the reg.exe command.\nUpon execution, the OS Build Number will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"fe9da205ebe93afe91369de205ab3234d27cb0f7addee342c16cc2d616d2d7c1"},{"id":"be3b5fe3-a575-4fb8-83f6-ad4a68dd5ce7","name":"Discover OS Product Name via Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify the Operating System Product Name via registry with the reg.exe command.\nUpon execution, the OS Product Name will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"aa675409747ed26025dde38daea6e2d060241fe9f26b5bd70065e18eb620841d"},{"id":"c187c9bc-4511-40b3-aa10-487b2c70b6a5","name":"Enumerate Available Drives via gdr","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"This test simulates an attacker attempting to list the available drives on the system to gather data about file storage locations.\n","inputs":{},"dependencies":[],"source_definition_sha256":"be8920399544079a4b914a01ebc34df3facf8e632bda9957ec6738e3a9938373"},{"id":"c8d40da9-31bd-47da-a497-11ea55d1ef6c","name":"sysctl to gather macOS hardware info","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Gets the macOS hardware information, which can be used to determine whether the target macOS host is running on a physical or virtual machine. sysctl can be used to gather interesting macOS host data, including hardware information, memory size, logical cpu information, etc.","inputs":{},"dependencies":[],"source_definition_sha256":"a95ac4d8febe99b003bd05a0a329200d6ccd41a6ebdcb7f15ad4ce4d75bbbde4"},{"id":"cccb070c-df86-4216-a5bc-9fb60c74e27c","name":"List OS Information","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify System Info\n","inputs":{"output_file":{"description":"Output file used to store the results.","type":"path","default":"/tmp/T1082.txt"}},"dependencies":[],"source_definition_sha256":"1f4f3498b017b9f48dfbdd971d10708f75d822f3b9d49b2a10adee94fc80af7f"},{"id":"cd6fc00d-ad6e-431c-832c-33e97ab9218f","name":"Get System Hardware UUID Via wmic.exe","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Upon execution, displays the system's hardware UUID. Used in BlackCat ransomware to generate a recovery URL.\n","inputs":{},"dependencies":[],"source_definition_sha256":"bc7799dfb6ebfe630de3c2a294114ae340043e40a50e462dda27f161a0fd68f5"},{"id":"ce479c1a-e8fa-42b2-812a-96b0f2f4d28a","name":"Identify System Locale and Regional Settings with PowerShell","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"This action demonstrates how an attacker might gather a system's region and language settings using PowerShell, which could aid in profiling \nthe machine's location and user language preferences. The command outputs system locale details to a temporary file for further analysis.\n","inputs":{},"dependencies":[],"source_definition_sha256":"cfdf55d9902305078dcfb31ea60259d3bee41b788aa8e6e4a11582c18ce932e6"},{"id":"dec6a0d8-bcaf-4c22-9d48-2aee59fb692b","name":"WinPwn - RBCD-Check","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Search for Resource-Based Constrained Delegation attack paths using RBCD-Check function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"a38535217d9ed9176d29297a5952eacc49ec78f5c2cd5706a9377b50605fd87f"},{"id":"edff98ec-0f73-4f63-9890-6b117092aff6","name":"System Information Discovery","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify System Info\n","inputs":{},"dependencies":[],"source_definition_sha256":"79468eeb7a3b92b9cd1b399746f72721f66bb1e762404ea5ecec77b0df4405da"},{"id":"eea1d918-825e-47dd-acc2-814d6c58c0e1","name":"WinPwn - winPEAS","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Discover Local Privilege Escalation possibilities using winPEAS function of WinPwn","inputs":{},"dependencies":[],"source_definition_sha256":"73a9267382a56e3d151709710f68ba4a3cd56800d4f0267cfc16930a7c656cac"},{"id":"eefe6a49-d88b-41d8-8fc2-b46822da90d3","name":"FreeBSD VM Check via Kernel Modules","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify virtual machine host kernel modules.\n","inputs":{},"dependencies":[],"source_definition_sha256":"f28c4c381e4ebb1c2c85f8413e04fb1db856b78359d9a353eb0a0351e2825e4a"},{"id":"efb79454-1101-4224-a4d0-30c9c8b29ffc","name":"WinPwn - PowerSharpPack - Sharpup checking common Privesc vectors","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"PowerSharpPack - Sharpup checking common Privesc vectors technique via function of WinPwn - Takes several minutes to complete.","inputs":{},"dependencies":[],"source_definition_sha256":"8408e906edf9e30117f23ad808c2c2de737d23b2ddd8e609a50a22905efbdcdb"},{"id":"f2f91612-d904-49d7-87c2-6c165d23bead","name":"BIOS Information Discovery through Registry","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Looks up for BIOS information in the registry. BIOS information is often read in order to detect sandboxing environments.  Upon execution, BIOS information will be displayed.\n- https://tria.ge/210111-eaz8mqhgh6/behavioral1\n- https://evasions.checkpoint.com/techniques/registry.html\n","inputs":{},"dependencies":[],"source_definition_sha256":"45087458afdcc32b0dd42861696fcbb593d2a1e0d2cf5a4fd643bbd7ef914856"},{"id":"f400d1c0-1804-4ff8-b069-ef5ddd2adbf3","name":"Environment variables discovery on windows","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify all environment variables. Upon execution, environments variables and your path info will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"8b547a4475adeefe5ceb441ff1e4abd61f382e5cae50b6c52e0e1d454931f21d"},{"id":"f6ecb109-df24-4303-8d85-1987dbae6160","name":"Check OS version via \"ver\" command","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Ver command shows information about os version.","inputs":{},"dependencies":[],"source_definition_sha256":"d147bfb49998ad294d3a2820c3d70fcf547f4300e7f4805734e19657a39b30c9"},{"id":"f89812e5-67d1-4f49-86fa-cbc6609ea86a","name":"ESXi - Darkside system information discovery","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Darkside ransomware utilises various ESXCLI commands to obtain information about the ESXi Host.\n[Reference](https://www.trendmicro.com/en_ph/research/21/e/darkside-linux-vms-targeted.html)\n","inputs":{"vm_host":{"description":"Specify the host name or IP of the ESXi Server","type":"string","default":"atomic.local"},"vm_user":{"description":"Specify the privilege user account on ESXi Server","type":"string","default":"root"},"vm_pass":{"description":"Specify the privilege user password on ESXi Server","type":"string","default":"pass"},"plink_file":{"description":"Path to Plink","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\plink.exe"},"cli_script":{"description":"Path to file containing darkside ransomware discovery commands","type":"path","default":"PathToAtomicsFolder\\T1082\\src\\esx_darkside_discovery.txt"}},"dependencies":[{"description":"Check if plink is available.\n"}],"source_definition_sha256":"d3a2e1676d50899ab8b958cdf5a4fcf2e79ef0a88f82e21efde0c839514d5796"},{"id":"fcbdd43f-f4ad-42d5-98f3-0218097e2720","name":"Environment variables discovery on freebsd, macos and linux","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1082/T1082.yaml","description":"Identify all environment variables. Upon execution, environments variables and your path info will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"ccfcb06a3f7b35058fc09465e6ab09871f131d0578e944acaa88309699cd7484"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1680":"/ttp-simulation/techniques/enterprise/T1680/","T1059.008":"/ttp-simulation/techniques/enterprise/T1059.008/","T1082":"/ttp-simulation/techniques/enterprise/T1082/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1082","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0075","collector":"illustrative-lab-collector","observation":{"action":"list_instances","region":"lab-region","actor":"lab-reader","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}