T1001: T1001
Essential information
- MITRE technique ID
T1001- Confidence
- 100/100
- Revoked
- No
- Published
- 31/05/2017 23:30
- Modified
- 03/04/2026 21:34
- Author / Source
- The MITRE Corporation
Aliases
Data Obfuscation
Platforms
windows macos linux ESXi
Description
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | command-and-control |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (38)
-
SAMBA SPIDER usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Gamaredon Group](https://attack.mitre.org/groups/G0047) is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name…
First seen 01/01/1970 · Last seen 16/11/5138 · -
The MITRE Corporation Confidence 100
[Thrip](https://attack.mitre.org/groups/G0076) is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well…
First seen 01/01/1970 · Last seen 16/11/5138 · -
The MITRE Corporation Confidence 100
[Lazarus Group](https://attack.mitre.org/groups/G0032) is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). (Citation: US-CERT HIDDEN COBRA June 2017) (Citation: Treasury North Korean Cyber…
First seen 01/01/1970 · Last seen 16/11/5138 · -
APT-Q-36 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
MirrorFace usesAlienVault Confidence 100
[MirrorFace](https://attack.mitre.org/groups/G1054) is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the [menuPass](https://attack.mitre.org/groups/G0045) umbrella based on targeting, tools, and infrastructure overlaps. [MirrorFace](https://attack.mitre.org/groups/G1054) has…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Stonefly usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Diicot usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Vo1d usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[ZIRCONIUM](https://attack.mitre.org/groups/G0128) is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Danabot usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
GhostSocks usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (78)
-
Manuscrypt usesFamily
-
DinDoor usesFamily
-
LimeRAT usesFamily
-
CookiePlus usesFamily
-
Cotx uses
-
Charamel Loader usesFamily
-
Redline usesFamily
-
SLOTHFULMEDIA uses
-
CookieTime usesFamily
-
YaRAT uses
-
Trojan:Linux/Mirai uses
-
GOLDVEIN.JAVA usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Reports (20)
-
Threat landscape — Belgium relatedConfidence 100 18 CVEs 200 MITREs 200 Malwares 20 APTs 26 Tools
-
20 MITREs 8 Malwares 8 Observables 1 APT
-
16 MITREs 7 Malwares 14 Observables 1 APT
-
19 MITREs 6 Malwares 5 Observables 1 APT
-
18 MITREs 10 Observables
-
13 MITREs 4 Malwares 1 APT
-
11 MITREs 2 Malwares 12 Observables 1 APT
-
19 MITREs 2 Malwares
-
16 MITREs 2 Malwares 1 APT
-
9 MITREs 1 Malware 59 Observables 1 APT
-
20 MITREs 3 Malwares 48 Observables 1 APT
-
20 MITREs 3 Malwares 12 Observables 1 APT
Vulnerabilities (CVE) (21)
A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An …
- Published
- 14/06/2022
- Modified
- 27/05/2026
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute …
- Attack vector
- NETWORK
- Complexity
- HIGH
- Published
- 24/04/2017
- Modified
- 22/04/2026
Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic …
- Attack vector
- Network
- Published
- 01/05/2023
- Modified
- 21/12/2025
Microsoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel …
- Published
- 03/11/2021
- Modified
- 29/05/2026
Multiple Cisco Small Business RV Series Routers contains a command injection vulnerability in the web-based management interface. Successful exploitation could allow an …
- Attack vector
- Network
- Published
- 03/03/2025
- Modified
- 21/12/2025
Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud contain a deserialization of untrusted data vulnerability involving the …
- Attack vector
- Network
- Published
- 04/09/2025
- Modified
- 21/12/2025
Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related …
- Published
- 03/11/2021
- Modified
- 20/12/2025
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries …
- Attack vector
- Network
- Published
- 29/04/2025
- Modified
- 21/12/2025
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
- Published
- 10/12/2025
- Modified
- 12/12/2025
Attack patterns (MITRE) (2)
-
Steganography subtechnique-ofT1001.002 MITRE
-
T1001.003 subtechnique-ofProtocol or Service Impersonation MITRE
Tool (1)
-
evilginx2 usesThe MITRE Corporation Confidence 75
[evilginx2](https://attack.mitre.org/software/S9003) is an open-source adversary-in-the-middle (AiTM) attack framework based on the open-source nginx web server. [evilginx2](https://attack.mitre.org/software/S9003) can be used as a reverse proxy between victims and legitimate web…
Campaign (1)
-
Operation Wocao uses