{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1190","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"ae14d6ec5afe1ad75403d71dd73e6190584e39f600f6b6c24845f91dd2570c56","description":"Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.\n\nExploited applications are often websites/web servers, but can also include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other system with Internet-accessible open sockets.(Citation: NVD CVE-2016-6662)(Citation: CIS Multiple SMB Vulnerabilities)(Citation: US-CERT TA18-106A Network Infrastructure Devices 2018)(Citation: Cisco Blog Legacy Device Attacks)(Citation: NVD CVE-2014-7169) On ESXi infrastructure, adversaries may exploit exposed OpenSLP services; they may alternatively exploit exposed VMware vCenter servers.(Citation: Recorded Future ESXiArgs Ransomware 2023)(Citation: Ars Technica VMWare Code Execution Vulnerability 2021) Depending on the flaw being exploited, this may also involve [Exploitation for Stealth](https://attack.mitre.org/techniques/T1211) or [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203).\n\nIf an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container. This can allow an adversary a path to access the cloud or container APIs (e.g., via the [Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005)), exploit container host access via [Escape to Host](https://attack.mitre.org/techniques/T1611), or take advantage of weak identity and access management policies.\n\nAdversaries may also exploit edge network infrastructure and related appliances, specifically targeting devices that do not support robust host-based defenses.(Citation: Mandiant Fortinet Zero Day)(Citation: Wired Russia Cyberwar)\n\nFor websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.(Citation: OWASP Top 10)(Citation: CWE top 25)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1190","external_id":"T1190"},{"source_name":"CWE top 25","description":"Christey, S., Brown, M., Kirby, D., Martin, B., Paller, A.. (2011, September 13). 2011 CWE/SANS Top 25 Most Dangerous Software Errors. Retrieved April 10, 2019.","url":"https://cwe.mitre.org/top25/index.html"},{"source_name":"CIS Multiple SMB Vulnerabilities","description":"CIS. (2017, May 15). Multiple Vulnerabilities in Microsoft Windows SMB Server Could Allow for Remote Code Execution. Retrieved April 3, 2018.","url":"https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-windows-smb-server-could-allow-for-remote-code-execution/"},{"source_name":"Ars Technica VMWare Code Execution Vulnerability 2021","description":"Dan Goodin . (2021, February 25). Code-execution flaw in VMware has a severity rating of 9.8 out of 10. Retrieved April 8, 2025.","url":"https://arstechnica.com/information-technology/2021/02/armed-with-exploits-hackers-on-the-prowl-for-a-critical-vmware-vulnerability/"},{"source_name":"Recorded Future ESXiArgs Ransomware 2023","description":"German Hoeffner, Aaron Soehnen and Gianni Perez. (2023, February 7). ESXiArgs Ransomware Targets Publicly-Exposed ESXi OpenSLP Servers. Retrieved March 26, 2025.","url":"https://www.recordedfuture.com/blog/esxiargs-ransomware-targets-vmware-esxi-openslp-servers"},{"source_name":"Wired Russia Cyberwar","description":"Greenberg, A. (2022, November 10). Russia’s New Cyberwarfare in Ukraine Is Fast, Dirty, and Relentless. Retrieved March 22, 2023.","url":"https://www.wired.com/story/russia-ukraine-cyberattacks-mandiant/"},{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"},{"source_name":"NVD CVE-2016-6662","description":"National Vulnerability Database. (2017, February 2). CVE-2016-6662 Detail. Retrieved April 3, 2018.","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-6662"},{"source_name":"NVD CVE-2014-7169","description":"National Vulnerability Database. (2017, September 24). CVE-2014-7169 Detail. Retrieved April 3, 2018.","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7169"},{"source_name":"Cisco Blog Legacy Device Attacks","description":"Omar Santos. (2020, October 19). Attackers Continue to Target Legacy Devices. Retrieved October 20, 2020.","url":"https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954"},{"source_name":"OWASP Top 10","description":"OWASP. (2018, February 23). OWASP Top Ten Project. Retrieved April 3, 2018.","url":"https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project"},{"source_name":"US-CERT TA18-106A Network Infrastructure Devices 2018","description":"US-CERT. (2018, April 20). Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/TA18-106A"}],"platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Linux","macOS","Network Devices","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1190","technique_page":"techniques/enterprise/T1190/","page":"detections/enterprise/T1190/","status":"rule_source_available","counts":{"sigma":46,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":7,"live_validated":0},"sigma_rules":[{"id":"fd435618-981e-4a7c-81f8-f78ce480d616","title":"Django Framework Exceptions","status":"stable","level":"medium","logsource":{"category":"application","product":"django"},"data_path":"data/detection-rules/fd435618-981e-4a7c-81f8-f78ce480d616.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/django/appframework_django_exceptions.yml","author":"Thomas Patzke","kind":"sigma"},{"id":"bb0e9cec-d4da-46f5-997f-22efc59f3dca","title":"Potential JNDI Injection Exploitation In JVM Based Application","status":"test","level":"high","logsource":{"category":"application","product":"jvm","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"},"data_path":"data/detection-rules/bb0e9cec-d4da-46f5-997f-22efc59f3dca.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/jvm/java_jndi_injection_exploitation_attempt.yml","author":"Moti Harmats","kind":"sigma"},{"id":"e032f5bc-4563-4096-ae3b-064bab588685","title":"Potential Local File Read Vulnerability In JVM Based Application","status":"test","level":"high","logsource":{"category":"application","product":"jvm","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"},"data_path":"data/detection-rules/e032f5bc-4563-4096-ae3b-064bab588685.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/jvm/java_local_file_read.yml","author":"Moti Harmats","kind":"sigma"},{"id":"4d0af518-828e-4a04-a751-a7d03f3046ad","title":"Potential OGNL Injection Exploitation In JVM Based Application","status":"test","level":"high","logsource":{"category":"application","product":"jvm","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"},"data_path":"data/detection-rules/4d0af518-828e-4a04-a751-a7d03f3046ad.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/jvm/java_ognl_injection_exploitation_attempt.yml","author":"Moti Harmats","kind":"sigma"},{"id":"d65f37da-a26a-48f8-8159-3dde96680ad2","title":"Process Execution Error In JVM Based Application","status":"test","level":"high","logsource":{"category":"application","product":"jvm","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"},"data_path":"data/detection-rules/d65f37da-a26a-48f8-8159-3dde96680ad2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/jvm/java_rce_exploitation_attempt.yml","author":"Moti Harmats","kind":"sigma"},{"id":"c4e06896-e27c-4583-95ac-91ce2279345d","title":"Potential XXE Exploitation Attempt In JVM Based Application","status":"test","level":"high","logsource":{"category":"application","product":"jvm","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"},"data_path":"data/detection-rules/c4e06896-e27c-4583-95ac-91ce2279345d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/jvm/java_xxe_exploitation_attempt.yml","author":"Moti Harmats","kind":"sigma"},{"id":"97661d9d-2beb-4630-b423-68985291a8af","title":"Potential RCE Exploitation Attempt In NodeJS","status":"test","level":"high","logsource":{"category":"application","product":"nodejs","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"},"data_path":"data/detection-rules/97661d9d-2beb-4630-b423-68985291a8af.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/nodejs/nodejs_rce_exploitation_attempt.yml","author":"Moti Harmats","kind":"sigma"},{"id":"6991bc2b-ae2e-447f-bc55-3a1ba04c14e5","title":"OpenCanary - FTP Login Attempt","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/6991bc2b-ae2e-447f-bc55-3a1ba04c14e5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_ftp_login_attempt.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"af6c3078-84cd-4c68-8842-08b76bd81b13","title":"OpenCanary - HTTP GET Request","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/af6c3078-84cd-4c68-8842-08b76bd81b13.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_http_get.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"af1ac430-df6b-4b38-b976-0b52f07a0252","title":"OpenCanary - HTTP POST Login Attempt","status":"test","level":"high","logsource":{"category":"application","product":"opencanary"},"data_path":"data/detection-rules/af1ac430-df6b-4b38-b976-0b52f07a0252.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/opencanary/opencanary_http_post_login_attempt.yml","author":"Security Onion Solutions","kind":"sigma"},{"id":"19aefed0-ffd4-47dc-a7fc-f8b1425e84f9","title":"Python SQL Exceptions","status":"stable","level":"medium","logsource":{"category":"application","product":"python"},"data_path":"data/detection-rules/19aefed0-ffd4-47dc-a7fc-f8b1425e84f9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/python/app_python_sql_exceptions.yml","author":"Thomas Patzke","kind":"sigma"},{"id":"0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a","title":"Ruby on Rails Framework Exceptions","status":"stable","level":"medium","logsource":{"category":"application","product":"ruby_on_rails"},"data_path":"data/detection-rules/0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/ruby/appframework_ruby_on_rails_exceptions.yml","author":"Thomas Patzke","kind":"sigma"},{"id":"ae48ab93-45f7-4051-9dfe-5d30a3f78e33","title":"Spring Framework Exceptions","status":"stable","level":"medium","logsource":{"category":"application","product":"spring"},"data_path":"data/detection-rules/ae48ab93-45f7-4051-9dfe-5d30a3f78e33.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/spring/spring_application_exceptions.yml","author":"Thomas Patzke","kind":"sigma"},{"id":"e9edd087-89d8-48c9-b0b4-5b9bb10896b8","title":"Potential SpEL Injection In Spring Framework","status":"test","level":"high","logsource":{"category":"application","product":"spring","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"},"data_path":"data/detection-rules/e9edd087-89d8-48c9-b0b4-5b9bb10896b8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/spring/spring_spel_injection.yml","author":"Moti Harmats","kind":"sigma"},{"id":"8a670c6d-7189-4b1c-8017-a417ca84a086","title":"Suspicious SQL Error Messages","status":"test","level":"high","logsource":{"category":"application","product":"sql","definition":"Requirements: application error logs must be collected (with LOG_LEVEL ERROR and above)"},"data_path":"data/detection-rules/8a670c6d-7189-4b1c-8017-a417ca84a086.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/sql/app_sqlinjection_errors.yml","author":"Bjoern Kimminich","kind":"sigma"},{"id":"16c86189-b556-4ee8-b4c7-7e350a195a4f","title":"Potential Server Side Template Injection In Velocity","status":"test","level":"high","logsource":{"category":"application","product":"velocity","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"},"data_path":"data/detection-rules/16c86189-b556-4ee8-b4c7-7e350a195a4f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/velocity/velocity_ssti_injection.yml","author":"Moti Harmats","kind":"sigma"},{"id":"d84c0ded-edd7-4123-80ed-348bb3ccc4d5","title":"Suspicious SQL Query","status":"test","level":"medium","logsource":{"category":"database","definition":"Requirements: Must be able to log the SQL queries"},"data_path":"data/detection-rules/d84c0ded-edd7-4123-80ed-348bb3ccc4d5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/category/database/db_anomalous_query.yml","author":"@juju4","kind":"sigma"},{"id":"6fb77778-040f-4015-9440-572aa9b6b580","title":"Ingress/Egress Security Group Modification","status":"test","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/6fb77778-040f-4015-9440-572aa9b6b580.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.yml","author":"jamesc-grafana","kind":"sigma"},{"id":"7a4409fc-f8ca-45f6-8006-127d779eaad9","title":"LoadBalancer Security Group Modification","status":"test","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/7a4409fc-f8ca-45f6-8006-127d779eaad9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_loadbalancer.yml","author":"jamesc-grafana","kind":"sigma"},{"id":"14f3f1c8-02d5-43a2-a191-91ffb52d3015","title":"RDS Database Security Group Modification","status":"test","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/14f3f1c8-02d5-43a2-a191-91ffb52d3015.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_rds.yml","author":"jamesc-grafana","kind":"sigma"},{"id":"e76b413a-83d0-4b94-8e4c-85db4a5b8bdc","title":"Suspicious OpenSSH Daemon Error","status":"test","level":"medium","logsource":{"product":"linux","service":"sshd"},"data_path":"data/detection-rules/e76b413a-83d0-4b94-8e4c-85db4a5b8bdc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"c8e35e96-19ce-4f16-aeb6-fd5588dc5365","title":"Suspicious Named Error","status":"test","level":"high","logsource":{"product":"linux","service":"syslog"},"data_path":"data/detection-rules/c8e35e96-19ce-4f16-aeb6-fd5588dc5365.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/syslog/lnx_syslog_susp_named.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"377f33a1-4b36-4ee1-acee-1dbe4b43cfbe","title":"Suspicious VSFTPD Error Messages","status":"test","level":"medium","logsource":{"product":"linux","service":"vsftpd"},"data_path":"data/detection-rules/377f33a1-4b36-4ee1-acee-1dbe4b43cfbe.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"6eea1bf6-f8d2-488a-a742-e6ef6c1b67db","title":"OMIGOD SCX RunAsProvider ExecuteScript","status":"test","level":"high","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/6eea1bf6-f8d2-488a-a742-e6ef6c1b67db.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","kind":"sigma"},{"id":"21541900-27a9-4454-9c4c-3f0a4240344a","title":"OMIGOD SCX RunAsProvider ExecuteShellCommand","status":"test","level":"high","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/21541900-27a9-4454-9c4c-3f0a4240344a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","kind":"sigma"},{"id":"aff715fa-4dd5-497a-8db3-910bea555566","title":"DNS Query to External Service Interaction Domains","status":"test","level":"high","logsource":{"category":"dns"},"data_path":"data/detection-rules/aff715fa-4dd5-497a-8db3-910bea555566.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/dns/net_dns_external_service_interaction_domains.yml","author":"Florian Roth (Nextron Systems), Matt Kelly (list of domains)","kind":"sigma"},{"id":"e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c","title":"Apache Threading Error","status":"test","level":"medium","logsource":{"service":"apache","definition":"Requirements: Must be able to collect the error.log file"},"data_path":"data/detection-rules/e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/product/apache/web_apache_threading_error.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"b59c98c6-95e8-4d65-93ee-f594dfb96b17","title":"F5 BIG-IP iControl Rest API Command Execution - Proxy","status":"test","level":"medium","logsource":{"category":"proxy"},"data_path":"data/detection-rules/b59c98c6-95e8-4d65-93ee-f594dfb96b17.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_f5_tm_utility_bash_api_request.yml","author":"Nasreddine Bencherchali (Nextron Systems), Thurein Oo","kind":"sigma"},{"id":"c42a3073-30fb-48ae-8c99-c23ada84b103","title":"Hack Tool User Agent","status":"test","level":"high","logsource":{"category":"proxy"},"data_path":"data/detection-rules/c42a3073-30fb-48ae-8c99-c23ada84b103.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/proxy_generic/proxy_ua_hacktool.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"85254a62-22be-4239-b79c-2ec17e566c37","title":"F5 BIG-IP iControl Rest API Command Execution - Webserver","status":"test","level":"medium","logsource":{"category":"webserver"},"data_path":"data/detection-rules/85254a62-22be-4239-b79c-2ec17e566c37.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml","author":"Nasreddine Bencherchali (Nextron Systems), Thurein Oo","kind":"sigma"},{"id":"7cb02516-6d95-4ffc-8eee-162075e111ac","title":"Successful IIS Shortname Fuzzing Scan","status":"test","level":"medium","logsource":{"category":"webserver"},"data_path":"data/detection-rules/7cb02516-6d95-4ffc-8eee-162075e111ac.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_iis_tilt_shortname_scan.yml","author":"frack113","kind":"sigma"},{"id":"583aa0a2-30b1-4d62-8bf3-ab73689efe6c","title":"Java Payload Strings","status":"test","level":"high","logsource":{"category":"webserver"},"data_path":"data/detection-rules/583aa0a2-30b1-4d62-8bf3-ab73689efe6c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_java_payload_in_access_logs.yml","author":"frack113, Harjot Singh, \"@cyb3rjy0t\" (update)","kind":"sigma"},{"id":"412d55bc-7737-4d25-9542-5b396867ce55","title":"JNDIExploit Pattern","status":"test","level":"high","logsource":{"category":"webserver"},"data_path":"data/detection-rules/412d55bc-7737-4d25-9542-5b396867ce55.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_jndi_exploit.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"7745c2ea-24a5-4290-b680-04359cb84b35","title":"Path Traversal Exploitation Attempts","status":"test","level":"medium","logsource":{"category":"webserver"},"data_path":"data/detection-rules/7745c2ea-24a5-4290-b680-04359cb84b35.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_path_traversal_exploitation_attempt.yml","author":"Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"5513deaf-f49a-46c2-a6c8-3f111b5cb453","title":"SQL Injection Strings In URI","status":"test","level":"high","logsource":{"category":"webserver"},"data_path":"data/detection-rules/5513deaf-f49a-46c2-a6c8-3f111b5cb453.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_sql_injection_in_access_logs.yml","author":"Saw Win Naung, Nasreddine Bencherchali (Nextron Systems), Thurein Oo (Yoma Bank)","kind":"sigma"},{"id":"19aa4f58-94ca-45ff-bc34-92e533c0994a","title":"Suspicious User-Agents Related To Recon Tools","status":"test","level":"medium","logsource":{"category":"webserver"},"data_path":"data/detection-rules/19aa4f58-94ca-45ff-bc34-92e533c0994a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_susp_useragents.yml","author":"Nasreddine Bencherchali (Nextron Systems), Tim Shelton","kind":"sigma"},{"id":"f88e112a-21aa-44bd-9b01-6ee2a2bbbed1","title":"Failed Logon From Public IP","status":"test","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/f88e112a-21aa-44bd-9b01-6ee2a2bbbed1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml","author":"NVISO","kind":"sigma"},{"id":"6b269392-9eba-40b5-acb6-55c882b20ba6","title":"Suspicious File Drop by Exchange","status":"test","level":"medium","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/6b269392-9eba-40b5-acb6-55c882b20ba6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_exchange_webshell_drop_suspicious.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"7280c9f3-a5af-45d0-916a-bc01cb4151c9","title":"Suspicious MSExchangeMailboxReplication ASPX Write","status":"test","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/7280c9f3-a5af-45d0-916a-bc01cb4151c9.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_exchange_aspx_write.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"89c42960-f244-4dad-9151-ae9b1a3287a2","title":"Suspicious File Write to Webapps Root Directory","status":"experimental","level":"medium","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/89c42960-f244-4dad-9151-ae9b1a3287a2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_file_write_in_webapps_root.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"1f0489be-b496-4ddf-b3a9-5900f2044e9c","title":"Suspicious File Write to SharePoint Layouts Directory","status":"experimental","level":"high","logsource":{"product":"windows","category":"file_event"},"data_path":"data/detection-rules/1f0489be-b496-4ddf-b3a9-5900f2044e9c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_event/file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"869b9ca7-9ea2-4a5a-8325-e80e62f75445","title":"Suspicious Child Process Of SQL Server","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/869b9ca7-9ea2-4a5a-8325-e80e62f75445.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_mssql_susp_child_process.yml","author":"FPT.EagleEye Team, wagga","kind":"sigma"},{"id":"b19146a3-25d4-41b4-928b-1e2a92641b1b","title":"Remote Access Tool - ScreenConnect Server Web Shell Execution","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/b19146a3-25d4-41b4-928b-1e2a92641b1b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_webshell.yml","author":"Jason Rathbun (Blackpoint Cyber)","kind":"sigma"},{"id":"1012f107-b8f1-4271-af30-5aed2de89b39","title":"Terminal Service Process Spawn","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/1012f107-b8f1-4271-af30-5aed2de89b39.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"8202070f-edeb-4d31-a010-a26c72ac5600","title":"Suspicious Process By Web Server Process","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/8202070f-edeb-4d31-a010-a26c72ac5600.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_webshell_susp_process_spawned_from_webserver.yml","author":"Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"5cc2cda8-f261-4d88-a2de-e9e193c86716","title":"Suspicious Processes Spawned by WinRM","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/5cc2cda8-f261-4d88-a2de-e9e193c86716.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_winrm_susp_child_process.yml","author":"Andreas Hunkeler (@Karneades), Markus Neis","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1190-1","technique_id":"T1190","title":"T1190 Exploit Public-Facing Application","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#initial-access","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":45,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L45","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"374721c2e268ff151e5ce88a6a1a793ffda50b807e09c9b28b862a5794e09049","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(waf_exploit_signature OR ids_exploit_signature OR known_exploit_request_pattern) -> ALERT","log_sources":[{"title":"Web Application Firewall Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#67-web-application-firewall-logs"},{"title":"Network Intrusion Detection Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#61-network-intrusion-detection-logs"},{"title":"Web Server Access Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#79-web-server-access-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1190-1","technique_id":"T1190","title":"Public-facing application exploitation — T1190 Exploit Public-Facing Application","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#public-app-exploitation","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":34,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L34","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"467fdafebf64343bdafb30d527432037c4ce49a39426b3bae0151ea0b64e587b","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"request and application process.","expected_behavior":"requests produce known response patterns and application behavior.","deviation":"request feature combinations, error distributions, or request-to-child-process transitions outside the normal application flow. Signature detection is often stronger for known exploits.","anomaly_types":[{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"},{"title":"Distribution-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#34-distribution-shift-anomaly"}],"log_sources":[{"title":"Web Application Firewall Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#67-web-application-firewall-logs"},{"title":"Web Server Access Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#79-web-server-access-logs"},{"title":"Application Runtime Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#82-application-runtime-logs"}],"context_references":[{"title":"Play ransomware joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/ic3-aa23-352a-play-ransomware.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/231218.pdf"}]}],"anomaly_types":[{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Distribution-Shift Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#34-distribution-shift-anomaly"},{"title":"Transition Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#61-transition-anomaly"}],"strategies":[{"id":"DET0080","name":"Exploit Public-Facing Application – multi-signal correlation (request → error → post-exploit process/egress)","url":"https://attack.mitre.org/detectionstrategies/DET0080","stix_id":"x-mitre-detection-strategy--dd8477c8-2aad-4db3-b810-fe0d2f605fa8","relationship_id":"relationship--69e8d620-b9a1-4bfd-9bf0-62d2915f08ad","description":"","analytics":[{"id":"AN0219","name":"Analytic 0219","guidance":"Adversary sends crafted HTTP/S (or other service) input to an Internet-facing app (IIS/ASP.NET, API, device portal). Chain: (1) abnormal request patterns to public endpoint → (2) elevated 4xx/5xx or unusual methods/paths → (3) server process (w3wp.exe/other service) spawns shell/LOLbins or loads non-standard modules → (4) optional outbound callback from the host/container.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0219","platforms":["Windows"],"tuning":[{"field":"PublicVIPs","description":"List of public IPs/hostnames that front apps; used to scope web log and Zeek/proxy data."},{"field":"SuspiciousPatterns","description":"Regex set for exploit-like inputs (../, union select, cmd=, ${jndi:, rO0AB (Java serialization), %00, ${env:}, ${${::-j}ndi})."},{"field":"ErrorRateThreshold","description":"Spike threshold for HTTP status 5xx/4xx per client or URI (e.g., >5 in 5m)."},{"field":"TimeWindow","description":"Correlation horizon between request, error, process spawn, and egress (e.g., 15 minutes)."},{"field":"AllowedChildList","description":"Known child processes of app pools (e.g., msbuild.exe in CI) to reduce false positives."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"ApplicationLog:IIS","channel":"IIS W3C logs in C:\\inetpub\\logs\\LogFiles\\W3SVC* (spikes in 5xx, RCE/SQLi/path traversal/JNDI patterns)","platforms":["Windows"],"analytic_id":"AN0219","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0219","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0219","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0219","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN0219","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0219","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN0219","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0219","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN0220","name":"Analytic 0220","guidance":"Adversary exploits Apache/Nginx/app servers. Chain: (1) suspicious requests in access logs → (2) spike of 5xx or WAF blocks → (3) web server or interpreter (apache2/nginx/php-fpm/node/python) spawns /bin/sh, curl, wget, socat, or writes webshell → (4) outbound callback.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0220","platforms":["Linux"],"tuning":[{"field":"WebProcList","description":"server/interpreter names to watch (apache2, httpd, nginx, php-fpm, uwsgi, gunicorn, node)."},{"field":"ChildToolList","description":"post-exploitation binaries (sh, bash, curl, wget, python, perl, socat, nc)."},{"field":"BurstThreshold","description":"Rate of errors/requests per src_ip/uri to flag reconnaissance/exploit spray."},{"field":"TimeWindow","description":"Exec/network correlation window."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"ApplicationLog:WebServer","channel":"/var/log/httpd/access_log, /var/log/apache2/access.log, /var/log/nginx/access.log with exploit indicators and burst errors","platforms":["Linux"],"analytic_id":"AN0220","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0220","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0220","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0220","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"HTTP payloads with SQLi/LFI/JNDI/deserialization indicators","platforms":["Linux"],"analytic_id":"AN0220","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0220","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN0221","name":"Analytic 0221","guidance":"Adversary targets macOS-hosted public services (e.g., nginx, node). Chain: suspicious inbound request → service crash/5xx → service spawns shell or writes file → new outbound connection.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0221","platforms":["macOS"],"tuning":[{"field":"ServiceList","description":"Names/paths of public daemons on macOS (httpd, nginx, node, java)."},{"field":"TimeWindow","description":"Correlation window for request → exec → egress."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"macos:unifiedlog","channel":"App/web server logs ingested via unified logging or filebeat (nginx/apache/node).","platforms":["macOS"],"analytic_id":"AN0221","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0221","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"exec events where web process starts a shell/tooling","platforms":["macOS"],"analytic_id":"AN0221","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0221","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"outbound egress from web host after suspicious request","platforms":["macOS"],"analytic_id":"AN0221","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0221","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN0222","name":"Analytic 0222","guidance":"Adversary exploits containerized app via ingress or service. Chain: (1) suspicious request in ingress/app logs → (2) container process spawns a shell/exec/sidecar (kubectl exec/docker exec) → (3) egress to Internet or metadata service (169.254.169.254).","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0222","platforms":["Containers"],"tuning":[{"field":"IngressNamespaces","description":"Namespaces that are Internet-facing."},{"field":"MetadataEndpoints","description":"Cloud metadata IPs/hostnames for exfil of credentials."},{"field":"TimeWindow","description":"Join period between ingress request and pod exec/egress."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"ApplicationLog:Ingress","channel":"Kubernetes NGINX/Envoy ingress controller logs with anomalous payloads and 5xx spikes","platforms":["Containers"],"analytic_id":"AN0222","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0222","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0032","component":"Process Creation","name":"docker:events","channel":"Docker/Kubernetes audit of exec/attach (kubectl exec) or unexpected child processes inside container","platforms":["Containers"],"analytic_id":"AN0222","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0222","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"Requests towards cloud metadata or command & control from pod IPs","platforms":["Containers"],"analytic_id":"AN0222","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0222","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN0223","name":"Analytic 0223","guidance":"Adversary targets cloud-hosted public endpoints. Chain: (1) ALB/ELB/Cloud LB logs show exploit-like inputs or error spikes → (2) workload spawns shell or reaches metadata API → (3) egress to new external hosts.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0223","platforms":["IaaS"],"tuning":[{"field":"LBProjects","description":"Cloud accounts/subscriptions/regions to include."},{"field":"ErrorBurst","description":"5xx/4xx per client threshold."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"ALB:HTTPLogs","channel":"AWS ALB/ELB/GCP/Azure Application Gateway HTTP logs with unusual methods, long URIs, serialized payloads, 4xx/5xx bursts","platforms":["IaaS"],"analytic_id":"AN0223","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0223","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"AWS:VPCFlowLogs","channel":"VPC/NSG flow logs for pod/instance egress to Internet or metadata","platforms":["IaaS"],"analytic_id":"AN0223","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0223","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN0224","name":"Analytic 0224","guidance":"Adversary exploits exposed OpenSLP on ESXi or vCenter public endpoints. Chain: inbound request pattern to mgmt service → hostd/vpxd error/crash/restart → unexpected process behavior or datastore access → outbound callback.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0224","platforms":["ESXi"],"tuning":[{"field":"MgmtCIDR","description":"Only trusted admin networks should reach ESXi/vCenter."},{"field":"TimeWindow","description":"Join errors and inbound flows."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"esxi:hostd","channel":"/var/log/hostd.log anomalies (faults, crashes, restarts) around inbound connections","platforms":["ESXi"],"analytic_id":"AN0224","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0224","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"Connections to TCP 427 (SLP) or vCenter web services from untrusted sources","platforms":["ESXi"],"analytic_id":"AN0224","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0224","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN0225","name":"Analytic 0225","guidance":"Adversary exploits public admin services on routers/firewalls/switches. Chain: anomalous HTTP/SNMP/SmartInstall inputs → device syslog errors/restarts → config changes/CLI spawn → egress to attacker C2.","url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0225","platforms":["Network Devices"],"tuning":[{"field":"MgmtPorts","description":"List of admin services to watch (8443, 443, 161/udp, 4786, 22)."},{"field":"TrustedAdmins","description":"Admin source ranges to allow."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"networkdevice:controlplane","channel":"Syslog from edge devices with HTTP 500s on mgmt portal, SmartInstall events, unexpected CLI commands","platforms":["Network Devices"],"analytic_id":"AN0225","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0225","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Flow","channel":"NetFlow/sFlow for odd egress to Internet from mgmt plane","platforms":["Network Devices"],"analytic_id":"AN0225","source_url":"https://attack.mitre.org/detectionstrategies/DET0080#AN0225","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0224","name":"Havij","page":"tools/S0224/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0225","name":"sqlmap","page":"tools/S0225/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"6dd540363c83","title":"SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 1. (basic, wizard)","published_at":"2024-11-04","url":"https://1200km.com/articles/read/2024/2024-11-04-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83/","original_url":"https://medium.com/@1200km/sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83","archive_path":"docs/articles/2024/2024-11-04-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83.md","source_sha256":"d8951045446bc9f5168b3e1032d024bcfd2ff100b0f54c6012122f82aad3b67a","tool_ids":["S0225"]},{"id":"0136ac6ffe53","title":"SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 2. (Advanced, custom setup)","published_at":"2024-11-05","url":"https://1200km.com/articles/read/2024/2024-11-05-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53/","original_url":"https://medium.com/@1200km/sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53","archive_path":"docs/articles/2024/2024-11-05-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53.md","source_sha256":"d82b8c4dccb451315b718e43711c1c27ff5dadc203475a1bf94df4805e967a33","tool_ids":["S0225"]}]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0224","name":"Havij","page":"tools/S0224/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0225","name":"sqlmap","page":"tools/S0225/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"6dd540363c83","title":"SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 1. (basic, wizard)","published_at":"2024-11-04","url":"https://1200km.com/articles/read/2024/2024-11-04-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83/","original_url":"https://medium.com/@1200km/sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83","archive_path":"docs/articles/2024/2024-11-04-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-1-basic-wizard-6dd540363c83.md","source_sha256":"d8951045446bc9f5168b3e1032d024bcfd2ff100b0f54c6012122f82aad3b67a","tool_ids":["S0225"]},{"id":"0136ac6ffe53","title":"SQLMap: A Deep Dive into Automated SQL Injection Testing. Part 2. (Advanced, custom setup)","published_at":"2024-11-05","url":"https://1200km.com/articles/read/2024/2024-11-05-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53/","original_url":"https://medium.com/@1200km/sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53","archive_path":"docs/articles/2024/2024-11-05-sqlmap-a-deep-dive-into-automated-sql-injection-testing-part-2-advanced-custom-setup-0136ac6ffe53.md","source_sha256":"d82b8c4dccb451315b718e43711c1c27ff5dadc203475a1bf94df4805e967a33","tool_ids":["S0225"]}]}],"software":[{"id":"S0224","name":"Havij","url":"https://attack.mitre.org/software/S0224","kind":"tool","description":"[Havij](https://attack.mitre.org/software/S0224) is used to automate SQL injection.(Citation: Check Point Havij Analysis)","relationship_id":"relationship--ced175fd-1f27-44cb-8d7f-44277b1754e4","references":[{"source_name":"Check Point Havij Analysis","description":"Ganani, M. (2015, May 14). Analysis of the Havij SQL Injection tool. Retrieved March 19, 2018.","url":"https://blog.checkpoint.com/2015/05/14/analysis-havij-sql-injection-tool/"}]},{"id":"S0225","name":"sqlmap","url":"https://attack.mitre.org/software/S0225","kind":"tool","description":"[sqlmap](https://attack.mitre.org/software/S0225) can be used to automate exploitation of SQL injection vulnerabilities.(Citation: sqlmap Introduction)","relationship_id":"relationship--547b575e-bc3c-488a-ae38-8bf6387b33f5","references":[{"source_name":"sqlmap Introduction","description":"Damele, B., Stampar, M. (n.d.). sqlmap. Retrieved March 19, 2018.","url":"http://sqlmap.org/"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.(Citation: Talos ZxShell Oct 2014)","relationship_id":"relationship--66fe07f5-fe08-4ad1-98b6-cb300007fe42","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}]},{"id":"S0516","name":"SoreFang","url":"https://attack.mitre.org/software/S0516","kind":"malware","description":"[SoreFang](https://attack.mitre.org/software/S0516) can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.(Citation: CISA SoreFang July 2016)","relationship_id":"relationship--61ee8aa7-89fc-4414-97f3-95fa9f1f26ad","references":[{"source_name":"CISA SoreFang July 2016","description":"CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}]},{"id":"S0623","name":"Siloscape","url":"https://attack.mitre.org/software/S0623","kind":"malware","description":"[Siloscape](https://attack.mitre.org/software/S0623) is executed after the attacker gains initial access to a Windows container using a known vulnerability.(Citation: Unit 42 Siloscape Jun 2021) ","relationship_id":"relationship--26ecce49-13ab-43a9-a626-10dae30b6961","references":[{"source_name":"Unit 42 Siloscape Jun 2021","description":"Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021.","url":"https://unit42.paloaltonetworks.com/siloscape/"}]},{"id":"S1105","name":"COATHANGER","url":"https://attack.mitre.org/software/S1105","kind":"malware","description":"[COATHANGER](https://attack.mitre.org/software/S1105) is installed following exploitation of a vulnerable FortiGate device. (Citation: NCSC-NL COATHANGER Feb 2024)","relationship_id":"relationship--6bbf2f6b-de27-435b-bf3e-bc991a25e561","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","description":"Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}]},{"id":"S1184","name":"BOLDMOVE","url":"https://attack.mitre.org/software/S1184","kind":"malware","description":"[BOLDMOVE](https://attack.mitre.org/software/S1184) is associated with exploitation of CVE-2022-49475 in FortiOS.(Citation: Google Cloud BOLDMOVE 2023)","relationship_id":"relationship--a7fbea9e-99a2-4319-b159-f4cb18908c27","references":[{"source_name":"Google Cloud BOLDMOVE 2023","description":"Scott Henderson, Cristiana Kittner, Sarah Hawley & Mark Lechtik, Google Cloud. (2023, January 19). Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475). Retrieved December 31, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/chinese-actors-exploit-fortios-flaw/"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) has been delivered through exploitation of exposed applications and interfaces including Citrix and RDP.(Citation: SentinelOne Qilin NOV 2022)","relationship_id":"relationship--96295901-89c2-4646-b18f-3d2eeec651ba","references":[{"source_name":"SentinelOne Qilin NOV 2022","description":"SentinelOne. (2022, November 30). Agenda (Qilin). Retrieved September 26, 2025.","url":"https://www.sentinelone.com/anthology/agenda-qilin/"}]}],"actors":[{"id":"G0001","name":"Axiom","url":"https://attack.mitre.org/groups/G0001","kind":"intrusion-set","description":"[Axiom](https://attack.mitre.org/groups/G0001) has been observed using SQL injection to gain access to systems.(Citation: Novetta-Axiom)(Citation: Cisco Group 72)","relationship_id":"relationship--e11a3d87-d9cf-4dcf-b722-fef4b0a324b4","references":[{"source_name":"Cisco Group 72","description":"Esler, J., Lee, M., and Williams, C. (2014, October 14). Threat Spotlight: Group 72. Retrieved January 14, 2016.","url":"http://blogs.cisco.com/security/talos/threat-spotlight-group-72"},{"source_name":"Novetta-Axiom","description":"Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"[Ke3chang](https://attack.mitre.org/groups/G0004) has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.(Citation: Microsoft NICKEL December 2021)","relationship_id":"relationship--7e834bba-4d5d-47b6-b689-b905eba66c0d","references":[{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.(Citation: US District Court Indictment GRU Oct 2018)(Citation: Cybersecurity Advisory GRU Brute Force Campaign July 2021)","relationship_id":"relationship--329d115e-2a1d-443e-800c-d28f5f11d6b9","references":[{"source_name":"US District Court Indictment GRU Oct 2018","description":"Brady, S . (2018, October 3). Indictment - United States vs Aleksei Sergeyevich Morenets, et al.. Retrieved October 1, 2020.","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source_name":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","description":"NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"id":"G0016","name":"APT29","url":"https://attack.mitre.org/groups/G0016","kind":"intrusion-set","description":"[APT29](https://attack.mitre.org/groups/G0016) has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.(Citation: Cybersecurity Advisory SVR TTP May 2021)(Citation: NCSC APT29 July 2020)","relationship_id":"relationship--bf0ff6f3-51a5-4718-af3f-8f75b1eb507c","references":[{"source_name":"NCSC APT29 July 2020","description":"National Cyber Security Centre. (2020, July 16). Advisory: APT29 targets COVID-19 vaccine development. Retrieved September 29, 2020.","url":"https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"},{"source_name":"Cybersecurity Advisory SVR TTP May 2021","description":"NCSC, CISA, FBI, NSA. (2021, May 7). Further TTPs associated with SVR cyber actors. Retrieved July 29, 2021.","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"}]},{"id":"G0027","name":"Threat Group-3390","url":"https://attack.mitre.org/groups/G0027","kind":"intrusion-set","description":"[Threat Group-3390](https://attack.mitre.org/groups/G0027) has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.(Citation: Trend Micro Iron Tiger April 2021)","relationship_id":"relationship--11e07a59-502c-44e9-9a70-03eff1433c33","references":[{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) exploits public-facing applications for initial access and to acquire infrastructure, such as exploitation of the EXIM mail transfer agent in Linux systems.(Citation: NSA Sandworm 2020)(Citation: Leonard TAG 2023)","relationship_id":"relationship--31353596-4fa7-4a37-8bb9-bc0690742576","references":[{"source_name":"Leonard TAG 2023","description":"Billy Leonard. (2023, April 19). Ukraine remains Russia’s biggest cyber focus in 2023. Retrieved March 1, 2024.","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"},{"source_name":"NSA Sandworm 2020","description":"National Security Agency. (2020, March 28). Sandworm Actors Exploiting Vulnerability In EXIM Mail Transfer Agent. Retrieved March 1, 2024.","url":"https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.(Citation: CISA AA20-296A Berserk Bear December 2020)","relationship_id":"relationship--d06cd799-f61b-460e-a287-e58e8ff39022","references":[{"source_name":"CISA AA20-296A Berserk Bear December 2020","description":"CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"}]},{"id":"G0045","name":"menuPass","url":"https://attack.mitre.org/groups/G0045","kind":"intrusion-set","description":"[menuPass](https://attack.mitre.org/groups/G0045) has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--9e27b122-a10d-4f0a-8ca8-6040d8879586","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"G0046","name":"FIN7","url":"https://attack.mitre.org/groups/G0046","kind":"intrusion-set","description":"[FIN7](https://attack.mitre.org/groups/G0046) has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange.(Citation: Microsoft Ransomware as a Service)","relationship_id":"relationship--198a9aa2-5d98-46c2-b43b-0191786049e7","references":[{"source_name":"Microsoft Ransomware as a Service","description":"Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via \"ProxyShell\" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).(Citation: Check Point APT35 CharmPower January 2022)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: Cybereason PowerLess February 2022)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)(Citation: Microsoft Log4j Vulnerability Exploitation December 2021)","relationship_id":"relationship--54af36a6-0a08-4853-9002-a1ae51b22ca5","references":[{"source_name":"Check Point APT35 CharmPower January 2022","description":"Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"},{"source_name":"Cybereason PowerLess February 2022","description":"Cybereason Nocturnus. (2022, February 1). PowerLess Trojan: Iranian APT Phosphorus Adds New PowerShell Backdoor for Espionage. Retrieved June 1, 2022.","url":"https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"},{"source_name":"DFIR Phosphorus November 2021","description":"DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source_name":"DFIR Report APT35 ProxyShell March 2022","description":"DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022.","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source_name":"Microsoft Log4j Vulnerability Exploitation December 2021","description":"Microsoft Threat Intelligence. (2021, December 11). Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability. Retrieved December 7, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/"},{"source_name":"Microsoft Iranian Threat Actor Trends November 2021","description":"MSTIC. (2021, November 16). Evolving trends in Iranian threat actor activity – MSTIC presentation at CyberWarCon 2021. Retrieved January 12, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"id":"G0065","name":"Leviathan","url":"https://attack.mitre.org/groups/G0065","kind":"intrusion-set","description":"[Leviathan](https://attack.mitre.org/groups/G0065) has used exploits against publicly-disclosed vulnerabilities for initial access into victim networks.(Citation: CISA Leviathan 2024)","relationship_id":"relationship--c010891f-9ddb-4943-a87a-e83c46075406","references":[{"source_name":"CISA Leviathan 2024","description":"CISA et al. (2024, July 8). People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action. Retrieved February 3, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"}]},{"id":"G0069","name":"MuddyWater","url":"https://attack.mitre.org/groups/G0069","kind":"intrusion-set","description":"[MuddyWater](https://attack.mitre.org/groups/G0069) has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).(Citation: DHS CISA AA22-055A MuddyWater February 2022)","relationship_id":"relationship--f439858f-020c-4476-b032-42b3abdc0e19","references":[{"source_name":"DHS CISA AA22-055A MuddyWater February 2022","description":"FBI, CISA, CNMF, NCSC-UK. (2022, February 24). Iranian Government-Sponsored Actors Conduct Cyber Operations Against Global Government and Commercial Networks. Retrieved September 27, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used SQL injection for initial compromise.(Citation: Symantec Chafer February 2018)","relationship_id":"relationship--fab9f76e-570c-4235-8045-dec89714d435","references":[{"source_name":"Symantec Chafer February 2018","description":"Symantec. (2018, February 28). Chafer: Latest Attacks Reveal Heightened Ambitions. Retrieved May 22, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}]},{"id":"G0093","name":"GALLIUM","url":"https://attack.mitre.org/groups/G0093","kind":"intrusion-set","description":"[GALLIUM](https://attack.mitre.org/groups/G0093) exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)","relationship_id":"relationship--ad60e0be-02a4-4f79-a81d-afdde78492be","references":[{"source_name":"Cybereason Soft Cell June 2019","description":"Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"},{"source_name":"Microsoft GALLIUM December 2019","description":"MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.(Citation: KISA Operation Muzabi)","relationship_id":"relationship--33eb4a61-d966-4193-a8e5-237eb5a5129a","references":[{"source_name":"KISA Operation Muzabi","description":"KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024.","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.(Citation: FireEye APT41 March 2020) [APT41](https://attack.mitre.org/groups/G0096) leveraged vulnerabilities such as ProxyLogon exploitation or SQL injection for initial access.(Citation: Rostovcev APT41 2021) [APT41](https://attack.mitre.org/groups/G0096) exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server to gain initial access to the victim network.(Citation: apt41_dcsocytec_dec2022)","relationship_id":"relationship--e7fc5a89-f5a7-432f-a885-6b9532153e7e","references":[{"source_name":"apt41_dcsocytec_dec2022","description":"DCSO CyTec Blog. (2022, December 24). APT41 — The spy who failed to encrypt me. Retrieved June 13, 2024.","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"},{"source_name":"FireEye APT41 March 2020","description":"Glyer, C, et al. (2020, March). This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved April 28, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"},{"source_name":"Rostovcev APT41 2021","description":"Nikita Rostovcev. (2022, August 18). APT41 World Tour 2021 on a tight schedule. Retrieved February 22, 2024.","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"id":"G0098","name":"BlackTech","url":"https://attack.mitre.org/groups/G0098","kind":"intrusion-set","description":"[BlackTech](https://attack.mitre.org/groups/G0098) has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.(Citation: TrendMicro BlackTech June 2017)","relationship_id":"relationship--51cc3f41-f5aa-4d04-95de-15d96e103bac","references":[{"source_name":"TrendMicro BlackTech June 2017","description":"Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}]},{"id":"G0106","name":"Rocke","url":"https://attack.mitre.org/groups/G0106","kind":"intrusion-set","description":"[Rocke](https://attack.mitre.org/groups/G0106) exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)","relationship_id":"relationship--06508c23-746d-4894-b414-cff925692bd5","references":[{"source_name":"Talos Rocke August 2018","description":"Liebenberg, D.. (2018, August 30). Rocke: The Champion of Monero Miners. Retrieved May 26, 2020.","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source_name":"Unit 42 Rocke January 2019","description":"Xingyu, J.. (2019, January 17). Malware Used by Rocke Group Evolves to Evade Detection by Cloud Security Products. Retrieved May 26, 2020.","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"}]},{"id":"G0108","name":"Blue Mockingbird","url":"https://attack.mitre.org/groups/G0108","kind":"intrusion-set","description":"[Blue Mockingbird](https://attack.mitre.org/groups/G0108) has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.(Citation: RedCanary Mockingbird May 2020)","relationship_id":"relationship--a4bb6f26-b659-4d1d-b0fc-f4f4efe32db6","references":[{"source_name":"RedCanary Mockingbird May 2020","description":"Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"id":"G0115","name":"GOLD SOUTHFIELD","url":"https://attack.mitre.org/groups/G0115","kind":"intrusion-set","description":"[GOLD SOUTHFIELD](https://attack.mitre.org/groups/G0115) has exploited Oracle WebLogic vulnerabilities for initial compromise.(Citation: Secureworks REvil September 2019)","relationship_id":"relationship--42d0b653-1d08-4e7b-910f-753412fda316","references":[{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.(Citation: ClearkSky Fox Kitten February 2020)(Citation: Dragos PARISITE )(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)","relationship_id":"relationship--6d4f3696-caa9-4100-bef5-e42d0f18470e","references":[{"source_name":"ClearkSky Fox Kitten February 2020","description":"ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020.","url":"https://www.clearskysec.com/fox-kitten/"},{"source_name":"Dragos PARISITE ","description":"Dragos. (n.d.). PARISITE. Retrieved December 21, 2020.","url":"https://www.dragos.com/threat/parisite/"},{"source_name":"CrowdStrike PIONEER KITTEN August 2020","description":"Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.","url":"https://www.crowdstrike.com/blog/who-is-pioneer-kitten/"},{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","description":"CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source_name":"ClearSky Pay2Kitten December 2020","description":"ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"id":"G0123","name":"Volatile Cedar","url":"https://attack.mitre.org/groups/G0123","kind":"intrusion-set","description":"[Volatile Cedar](https://attack.mitre.org/groups/G0123) has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.(Citation: CheckPoint Volatile Cedar March 2015) (Citation: ClearSky Lebanese Cedar Jan 2021) ","relationship_id":"relationship--c4bc8f71-e4f4-42b8-a39f-b4512987a423","references":[{"source_name":"CheckPoint Volatile Cedar March 2015","description":"Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"},{"source_name":"ClearSky Lebanese Cedar Jan 2021","description":"ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"id":"G0125","name":"HAFNIUM","url":"https://attack.mitre.org/groups/G0125","kind":"intrusion-set","description":"[HAFNIUM](https://attack.mitre.org/groups/G0125) has exploited multiple vulnerabilities to compromise edge devices and on-premises versions of Microsoft Exchange Server.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)(Citation: FireEye Exchange Zero Days March 2021)(Citation: Tarrask scheduled task)(Citation: Microsoft Log4j Vulnerability Exploitation December 2021)(Citation: Microsoft Silk Typhoon MAR 2025)","relationship_id":"relationship--e8e6f472-e048-401c-8a2e-5e2effc09040","references":[{"source_name":"FireEye Exchange Zero Days March 2021","description":"Bromiley, M. et al. (2021, March 4). Detection and Response to Exploitation of Microsoft Exchange Zero-Day Vulnerabilities. Retrieved March 9, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html"},{"source_name":"Volexity Exchange Marauder March 2021","description":"Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021.","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"source_name":"Microsoft Silk Typhoon MAR 2025","description":"Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"},{"source_name":"Tarrask scheduled task","description":"Microsoft Threat Intelligence Team & Detection and Response Team . (2022, April 12). Tarrask malware uses scheduled tasks for defense evasion. Retrieved June 1, 2022.","url":"https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"},{"source_name":"Microsoft Log4j Vulnerability Exploitation December 2021","description":"Microsoft Threat Intelligence. (2021, December 11). Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability. Retrieved December 7, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/"},{"source_name":"Microsoft HAFNIUM March 2020","description":"MSTIC. (2021, March 2). HAFNIUM targeting Exchange Servers with 0-day exploits. Retrieved March 3, 2021.","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"id":"G0135","name":"BackdoorDiplomacy","url":"https://attack.mitre.org/groups/G0135","kind":"intrusion-set","description":"[BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. [BackdoorDiplomacy](https://attack.mitre.org/groups/G0135) has also exploited mis-configured Plesk servers.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--3f4096d5-06d8-4a1e-bb31-0e2b37d5f622","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"G1003","name":"Ember Bear","url":"https://attack.mitre.org/groups/G1003","kind":"intrusion-set","description":"[Ember Bear](https://attack.mitre.org/groups/G1003) gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange; and multiple vulnerabilities in open-source platforms such as content management systems.(Citation: Cadet Blizzard emerges as novel threat actor)(Citation: CISA GRU29155 2024)","relationship_id":"relationship--37306ec5-a50c-43a5-aa02-08b2179fb09d","references":[{"source_name":"Cadet Blizzard emerges as novel threat actor","description":"Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source_name":"CISA GRU29155 2024","description":"US Cybersecurity & Infrastructure Security Agency et al. (2024, September 5). Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure. Retrieved September 6, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"id":"G1006","name":"Earth Lusca","url":"https://attack.mitre.org/groups/G1006","kind":"intrusion-set","description":"[Earth Lusca](https://attack.mitre.org/groups/G1006) has compromised victims by directly exploiting vulnerabilities of public-facing servers, including those associated with Microsoft Exchange and Oracle GlassFish.(Citation: TrendMicro EarthLusca 2022)","relationship_id":"relationship--b8012238-cfd9-4c5b-8759-8d86f0d6f933","references":[{"source_name":"TrendMicro EarthLusca 2022","description":"Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"id":"G1009","name":"Moses Staff","url":"https://attack.mitre.org/groups/G1009","kind":"intrusion-set","description":"[Moses Staff](https://attack.mitre.org/groups/G1009) has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.(Citation: Checkpoint MosesStaff Nov 2021)","relationship_id":"relationship--cf1d394d-a767-40a8-be7a-87c17531dfdb","references":[{"source_name":"Checkpoint MosesStaff Nov 2021","description":"Checkpoint Research. (2021, November 15). Uncovering MosesStaff techniques: Ideology over Money. Retrieved August 11, 2022.","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"id":"G1016","name":"FIN13","url":"https://attack.mitre.org/groups/G1016","kind":"intrusion-set","description":"[FIN13](https://attack.mitre.org/groups/G1016) has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)","relationship_id":"relationship--4f5f1da9-9396-4b66-a67b-c08470924882","references":[{"source_name":"Sygnia Elephant Beetle Jan 2022","description":"Sygnia Incident Response Team. (2022, January 5). TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION. Retrieved February 9, 2023.","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source_name":"Mandiant FIN13 Aug 2022","description":"Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has gained initial access through exploitation of multiple vulnerabilities in internet-facing software and appliances such as Fortinet, Ivanti (formerly Pulse Secure), NETGEAR, Citrix, and Cisco.(Citation: Secureworks BRONZE SILHOUETTE May 2023)(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--284eb222-c310-480c-aaaa-82c1d5c64e62","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source_name":"Secureworks BRONZE SILHOUETTE May 2023","description":"Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"id":"G1021","name":"Cinnamon Tempest","url":"https://attack.mitre.org/groups/G1021","kind":"intrusion-set","description":"[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) has exploited multiple unpatched vulnerabilities for initial access including vulnerabilities in Microsoft Exchange, Manage Engine AdSelfService Plus, Confluence, and Log4j.(Citation: Microsoft Ransomware as a Service)(Citation: Microsoft Log4j Vulnerability Exploitation December 2021)(Citation: Sygnia Emperor Dragonfly October 2022)(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)","relationship_id":"relationship--7bf7f711-823d-41b8-8e88-801f7fa98591","references":[{"source_name":"Sygnia Emperor Dragonfly October 2022","description":"Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"},{"source_name":"SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022","description":"Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023.","url":"https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"},{"source_name":"Microsoft Log4j Vulnerability Exploitation December 2021","description":"Microsoft Threat Intelligence. (2021, December 11). Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability. Retrieved December 7, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/"},{"source_name":"Microsoft Ransomware as a Service","description":"Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"id":"G1022","name":"ToddyCat","url":"https://attack.mitre.org/groups/G1022","kind":"intrusion-set","description":"[ToddyCat](https://attack.mitre.org/groups/G1022) has exploited the ProxyLogon vulnerability (CVE-2021-26855) to compromise Exchange Servers at multiple organizations.(Citation: Kaspersky ToddyCat June 2022)","relationship_id":"relationship--a2a5e505-b957-430e-9bbd-75e6d9e34532","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"}]},{"id":"G1023","name":"APT5","url":"https://attack.mitre.org/groups/G1023","kind":"intrusion-set","description":"[APT5](https://attack.mitre.org/groups/G1023) has exploited vulnerabilities in externally facing software and devices including Pulse Secure VPNs and Citrix Application Delivery Controllers.(Citation: Mandiant Pulse Secure Zero-Day April 2021)(Citation: Mandiant Pulse Secure Update May 2021)(Citation: NSA APT5 Citrix Threat Hunting December 2022) (Citation: Microsoft East Asia Threats September 2023)","relationship_id":"relationship--f147e87d-1ed7-4ab3-a414-0537a9bfb887","references":[{"source_name":"Microsoft East Asia Threats September 2023","description":"Microsoft Threat Intelligence. (2023, September). Digital threats from East Asia increase in breadth and effectiveness. Retrieved February 5, 2024.","url":"https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW1aFyW"},{"source_name":"NSA APT5 Citrix Threat Hunting December 2022","description":"National Security Agency. (2022, December). APT5: Citrix ADC Threat Hunting Guidance. Retrieved February 5, 2024.","url":"https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF"},{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","description":"Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"},{"source_name":"Mandiant Pulse Secure Update May 2021","description":"Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"id":"G1030","name":"Agrius","url":"https://attack.mitre.org/groups/G1030","kind":"intrusion-set","description":"[Agrius](https://attack.mitre.org/groups/G1030) exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices and SQL injection activity.(Citation: SentinelOne Agrius 2021) ","relationship_id":"relationship--83cd501e-c042-4d2d-bf76-f2d499971302","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"G1032","name":"INC Ransom","url":"https://attack.mitre.org/groups/G1032","kind":"intrusion-set","description":"[INC Ransom](https://attack.mitre.org/groups/G1032) has exploited known vulnerabilities including CVE-2023-3519 in Citrix NetScaler for initial access.(Citation: SOCRadar INC Ransom January 2024)(Citation: SentinelOne INC Ransomware)","relationship_id":"relationship--c962253b-d89e-4645-bdd4-5625df63abc1","references":[{"source_name":"SentinelOne INC Ransomware","description":"SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source_name":"SOCRadar INC Ransom January 2024","description":"SOCRadar. (2024, January 24). Dark Web Profile: INC Ransom. Retrieved June 5, 2024.","url":"https://socradar.io/dark-web-profile-inc-ransom/"}]},{"id":"G1035","name":"Winter Vivern","url":"https://attack.mitre.org/groups/G1035","kind":"intrusion-set","description":"[Winter Vivern](https://attack.mitre.org/groups/G1035) has exploited known and zero-day vulnerabilities in software usch as Roundcube Webmail servers and the \"Follina\" vulnerability.(Citation: ESET WinterVivern 2023)(Citation: Proofpoint WinterVivern 2023)","relationship_id":"relationship--b20bd897-988b-422b-82d1-61e155d34115","references":[{"source_name":"ESET WinterVivern 2023","description":"Matthieu Faou. (2023, October 25). Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers. Retrieved July 29, 2024.","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"},{"source_name":"Proofpoint WinterVivern 2023","description":"Michael Raggi & The Proofpoint Threat Research Team. (2023, March 30). Exploitation is a Dish Best Served Cold: Winter Vivern Uses Known Zimbra Vulnerability to Target Webmail Portals of NATO-Aligned Governments in Europe. Retrieved July 29, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/exploitation-dish-best-served-cold-winter-vivern-uses-known-zimbra-vulnerability"}]},{"id":"G1040","name":"Play","url":"https://attack.mitre.org/groups/G1040","kind":"intrusion-set","description":"[Play](https://attack.mitre.org/groups/G1040) has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 (\"ProxyNotShell\") in Microsoft Exchange.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)","relationship_id":"relationship--e8148225-e246-45c4-b203-2958d0bb07da","references":[{"source_name":"CISA Play Ransomware Advisory December 2023","description":"CISA. (2023, December 18). #StopRansomware: Play Ransomware AA23-352A. Retrieved September 24, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","description":"Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"id":"G1041","name":"Sea Turtle","url":"https://attack.mitre.org/groups/G1041","kind":"intrusion-set","description":"[Sea Turtle](https://attack.mitre.org/groups/G1041) gained access to victim environments by exploiting multiple known vulnerabilities over several campaigns.(Citation: Talos Sea Turtle 2019)(Citation: PWC Sea Turtle 2023)","relationship_id":"relationship--6496a79b-5946-4928-a92f-d8372e9c5de8","references":[{"source_name":"Talos Sea Turtle 2019","description":"Cisco Talos. (2019, April 17). Sea Turtle: DNS Hijacking Abuses Trust In Core Internet Service. Retrieved November 20, 2024.","url":"https://blog.talosintelligence.com/seaturtle/"},{"source_name":"PWC Sea Turtle 2023","description":"PwC Threat Intelligence. (2023, December 5). The Tortoise and The Malware. Retrieved November 20, 2024.","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html"}]},{"id":"G1043","name":"BlackByte","url":"https://attack.mitre.org/groups/G1043","kind":"intrusion-set","description":"[BlackByte](https://attack.mitre.org/groups/G1043) exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.(Citation: FBI BlackByte 2022)(Citation: Picus BlackByte 2022)(Citation: Symantec BlackByte 2022)(Citation: Microsoft BlackByte 2023)","relationship_id":"relationship--7cd37736-47d4-4d56-8398-bd4104f43cb9","references":[{"source_name":"Picus BlackByte 2022","description":"Huseyin Can Yuceel. (2022, February 21). TTPs used by BlackByte Ransomware Targeting Critical Infrastructure. Retrieved December 16, 2024.","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source_name":"Microsoft BlackByte 2023","description":"Microsoft Incident Response. (2023, July 6). The five-day job: A BlackByte ransomware intrusion case study. Retrieved December 16, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source_name":"Symantec BlackByte 2022","description":"Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"},{"source_name":"FBI BlackByte 2022","description":"US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024.","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has leveraged vulnerabilities in public facing applications and network edge devices including Cisco IOS and IOS XE through CVE-2018-0171, Ivanti Connect Secure through CVE-2023-46805, and Palo Alto Networks GlobalProtect through CVE-2024-3400.(Citation: Cisco Salt Typhoon FEB 2025)(Citation: CISA_AA25-239ASaltTyphoon_Sept2025)(Citation: CarySentinelLabs_CiscoSaltTyphoon_Dec2025)","relationship_id":"relationship--f63e09a1-6ed2-48b4-9ba2-69eec39091b4","references":[{"source_name":"CarySentinelLabs_CiscoSaltTyphoon_Dec2025","description":"Cary, D. (2025, December 10). Malicious Apprentice | How Two Hackers Went From Cisco Academy to Cisco CVEs. Retrieved September 22, 2026.","url":"https://www.sentinelone.com/labs/malicious-apprentice-how-two-hackers-went-from-cisco-academy-to-cisco-cves/"},{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"},{"source_name":"Cisco Salt Typhoon FEB 2025","description":"Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":"[UNC3886](https://attack.mitre.org/groups/G1048) has exploited CVE-2022-42475 in FortiOS SSL VPNs to obtain access.(Citation: Google Cloud Mandiant UNC3886 2024)(Citation: Mandiant Fortinet Zero Day)","relationship_id":"relationship--ca3b64e6-7422-48ce-b9c0-eff9d4ad2635","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source_name":"Mandiant Fortinet Zero Day","description":"Marvi, A. et al.. (2023, March 16). Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation. Retrieved March 22, 2023.","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has leveraged public facing vulnerabilities in their campaigns against victim organizations to gain initial access.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: Broadcom Medusa Ransomware Medusa Group March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) has also utilized CVE-2024-1709 in ScreenConnect, and CVE-2023-48788 in Fortinet EMS for initial access to victim environments.(Citation: CISA Medusa Group Medusa Ransomware March 2025)","relationship_id":"relationship--62ab55a6-4341-41df-866d-5cc784770e6f","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Broadcom Medusa Ransomware Medusa Group March 2025","description":"Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"id":"G1053","name":"Storm-0501","url":"https://attack.mitre.org/groups/G1053","kind":"intrusion-set","description":"[Storm-0501](https://attack.mitre.org/groups/G1053) has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)","relationship_id":"relationship--65971cda-62b8-4685-8070-3d61ded0850d","references":[{"source_name":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","description":"Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has exploited vulnerabilities in Fortigate and Array AG devices for initial access.(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--cebc9afb-0f47-4fb5-b3f4-53aa59653a83","references":[{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604.(Citation: DOJ FBI Handala Hack March 2026)","relationship_id":"relationship--2f30a994-602d-48a0-bd19-bcd02e1cb322","references":[{"source_name":"DOJ FBI Handala Hack March 2026","description":"DOJ/FBI. (2026, March 19). Case 1:26-mj-00683-CDA: Affidavit in Support of Seizure Warrant: In the Matter of the Seizure of Domain Names Justicehomeland[.]org; karmabelow80[.]org; handala-hack[.]to; and handala-redwatned[.]to. Retrieved April 20, 2026.","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"id":"G1056","name":"TeamPCP","url":"https://attack.mitre.org/groups/G1056","kind":"intrusion-set","description":"[TeamPCP](https://attack.mitre.org/groups/G1056) has exploited misconfigurations in GitHub Actions and vulnerabilities such as CVE-2026-33634 in the Aqua Security Trivy scanner and CVE-2025-55182 (React2Shell) against vulnerable cloud endpoints.(Citation: Aqua Security Blog Trivy Compromise APR 2026)(Citation: Aikido TeamPCP Telnyx MAR 2026)(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Wiz Mini Shai-Hulud MAY 2026)","relationship_id":"relationship--269fbafb-f9ad-4782-b9e6-ccf44e3723f8","references":[{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Aikido TeamPCP Telnyx MAR 2026","description":"Eriksen, C. (2026, March 27). Popular telnyx package compromised on PyPI by TeamPCP. Retrieved July 16, 2026.","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source_name":"Wiz Mini Shai-Hulud MAY 2026","description":"McCarthy, R., Cohen, A., and Read, B. (2026, May 12). Mini Shai-Hulud Strikes Again: TanStack + more npm Packages Compromised. Retrieved July 16, 2026.","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"},{"source_name":"Palo Alto TeamPCP MAR 2026","description":"Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has exploited CVE-2026-35273 against Oracle PeopleSoft application infrastructure.(Citation: Google_SHOracle_Jun2026) [ShinyHunters](https://attack.mitre.org/groups/G1057) has exploited known vulnerabilities in internet-facing servers.(Citation: ElecticIQ Buyukkaya_ShinyHunters_Sept2025)  ","relationship_id":"relationship--430c6ce1-4461-4c3a-b7e2-3617cc82483a","references":[{"source_name":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","description":"Büyükkaya, A. (2025, September 22). ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications. Retrieved May 18, 2026.","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"},{"source_name":"Google_SHOracle_Jun2026","description":"Mandiant, Google Threat Intelligence Group. (2026, June 11). ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit. Retrieved June 11, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"id":"G1058","name":"The Gentlemen","url":"https://attack.mitre.org/groups/G1058","kind":"intrusion-set","description":"[The Gentlemen](https://attack.mitre.org/groups/G1058) has exploited vulnerable public-facing devices and services to gain access to victim environments.(Citation: Intel471_TheGentlemen_Aug2026)(Citation: SoučekESET_Gentlemen_Jun2026)(Citation: BradyUnit42_TheGentlemen_July2026)(Citation: TrendAI_TheGentlemen_Sept2025)","relationship_id":"relationship--836ba167-10bd-40ce-8578-bbac18d074ed","references":[{"source_name":"BradyUnit42_TheGentlemen_July2026","description":"Brady, M. (2026, July 10). No Manners Here: The Ruthless Rise of The Gentlemen Ransomware. Retrieved September 18, 2026.","url":"https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/"},{"source_name":"Intel471_TheGentlemen_Aug2026","description":"Intel 471. (2026, August 11). Threat Hunting Case Study: The Gentlemen. Retrieved September 18, 2026.","url":"https://www.intel471.com/blog/threat-hunting-case-study-the-gentlemen"},{"source_name":"TrendAI_TheGentlemen_Sept2025","description":"Santos, J., et al. (2025, September 9). Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed . Retrieved September 18, 2026.","url":"https://www.trendaisecurity.com/en-us/resources-insights/trendai-security-blog/unmasking-the-gentlemen-ransomware"},{"source_name":"SoučekESET_Gentlemen_Jun2026","description":"Souček, J. (2026, June 18). Killing me gently: Inside Gentlemen’s EDR killer framework. Retrieved September 18, 2026.","url":"https://www.welivesecurity.com/en/eset-research/killing-me-gently-inside-gentlemens-edr-killer-framework/"}]}],"mitigations":[{"id":"M1016","name":"Vulnerability Scanning","url":"https://attack.mitre.org/mitigations/M1016","kind":"course-of-action","description":"Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.(Citation: OWASP Top 10)","relationship_id":"relationship--4c308ec1-f0c6-4444-af7d-ff045204c326","references":[{"source_name":"OWASP Top 10","description":"OWASP. (2018, February 23). OWASP Top Ten Project. Retrieved April 3, 2018.","url":"https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project"}]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.","relationship_id":"relationship--4d50a045-d85d-481f-ac7d-672065f1e348","references":[]},{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.","relationship_id":"relationship--3b726298-74dc-4f8a-b58d-f623bc645124","references":[]},{"id":"M1035","name":"Limit Access to Resource Over Network","url":"https://attack.mitre.org/mitigations/M1035","kind":"course-of-action","description":"Ensure that all publicly exposed services are actually intended to be so, and restrict access to any that should only be available internally. ","relationship_id":"relationship--b7b6cc9f-50ac-4774-9dd4-3c14b408b99e","references":[]},{"id":"M1037","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M1037","kind":"course-of-action","description":"Restrict outbound network traffic from public-facing servers to prevent unauthorized connections from initiating communications with attacker-controlled infrastructure. While this may not prevent the initial exploitation, it limits the attacker's ability to verify and control the compromised server post-exploit, reducing the overall impact of the attack.","relationship_id":"relationship--1c0c0c90-7974-48f4-9de0-15a8d9b00e0a","references":[]},{"id":"M1048","name":"Application Isolation and Sandboxing","url":"https://attack.mitre.org/mitigations/M1048","kind":"course-of-action","description":"Application isolation will limit what other processes and system features the exploited target can access.","relationship_id":"relationship--0c8fdb59-a28f-4f8f-a788-9e3e8928c6d5","references":[]},{"id":"M1050","name":"Exploit Protection","url":"https://attack.mitre.org/mitigations/M1050","kind":"course-of-action","description":"Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.","relationship_id":"relationship--53a95297-1cce-401c-99a3-34079e878fac","references":[]},{"id":"M1051","name":"Update Software","url":"https://attack.mitre.org/mitigations/M1051","kind":"course-of-action","description":"Update software regularly by employing patch management for externally exposed applications.","relationship_id":"relationship--d373eebb-b578-4b59-9de1-2946bf837d96","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1211":"/ttp-simulation/techniques/enterprise/T1211/","T1203":"/ttp-simulation/techniques/enterprise/T1203/","T1552.005":"/ttp-simulation/techniques/enterprise/T1552.005/","T1611":"/ttp-simulation/techniques/enterprise/T1611/","T1190":"/ttp-simulation/techniques/enterprise/T1190/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1190","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}