Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec).
82 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has obtained MeshCentral to deploy agents masquerading as legitimate cloud endpoints.1 ShinyHunters has obtained WinSCP to gather information on S3 bucket configurations.2 ShinyHunters has obtained ConnectWise and other RMM tools to gain initial access.3
Has obtained and utilized commercial VPN services, open-source software and publicly available offensive security tools to facilitate malicious activities.1
Has used tools including the Secure Copy Protocol (SCP) client from PuTTY and Cobalt Strike.123
Has used remote management and monitoring software such as “AnyDesk”.12345
Has obtained and leveraged numerous RMM services, along with publicly available tools used for scanning.123 Medusa Group has utilized tools such as Advanced IP Scanner and SoftPerfect Network scanner for user, system and network discovery.2 Medusa Group has also acquired tools for command and control and defense evasion which include tunneling tools Ligolo and Cloudflared.2
Acquired various legitimate and malicious tools, such as RMM software and commodity malware packages, for operations.12
All 82 groups for this technique · 6 newest in this preview
26 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
During the Anthropic AI-orchestrated Campaign, the adversary obtained open-source penetration testing tools including network scanners, database exploitation frameworks, password crackers, and binary analysis suites.1
During SharePoint ToolShell Exploitation, threat actors leveraged tools including Impacket, PsExec, and Mimikatz.1
During Operation Digital Eye, threat actors used third party tools including custom implementations of Mimikatz.1
During Operation MidnightEclipse, threat actors used the GO Simple Tunnel (GOST) reverse proxy tool.1
During Cutting Edge, threat actors leveraged tools including Interactsh to identify vulnerable targets, PySoxy to simultaneously dispatch traffic between multiple endpoints, BusyBox to enable post exploitation activities, and Kubo Injector to inject shared objects into process memory.12
During ShadowRay, threat actors used tools including the XMRig miner and Interactsh.1
All 26 campaigns for this technique · 6 newest in this preview
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN1984 · PRE
Monitor for contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information. In some cases, malware repositories can also be used to identify features of tool use associated with an adversary, such as watermarks in Cobalt Strike payloads. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Malware MetadataDC0003 | Malware Repository | None |
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.
13 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|