T1497.003: T1497.003
Essential information
- MITRE technique ID
T1497.003- Confidence
- 100/100
- Revoked
- No
- Published
- 06/03/2020 22:11
- Modified
- 13/04/2026 17:17
- Author / Source
- The MITRE Corporation
Aliases
Time Based Checks
Platforms
windows macos linux
Description
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | defense-evasion |
| mitre-attack | discovery |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (21)
-
The MITRE Corporation Confidence 100
[MuddyWater](https://attack.mitre.org/groups/G0069) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Venom Spider usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
China-nexus usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
REF3864 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
APT-C-48 (CNC) relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
ForumTroll APT relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
KONNI relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
UAC-0226 relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (81)
-
HarborWatch Agent usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
RansomHub usesThe MITRE Corporation Confidence 100
[RansomHub](https://attack.mitre.org/software/S1212) is a ransomware-as-a-service (RaaS) offering with Windows, ESXi, Linux, and FreeBSD versions that has been in use since at least 2024 to target organizations in multiple sectors…
First seen 01/01/1970 · Last seen 16/11/5138 · -
GrabBot usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
GrimAgent usesFamily The MITRE Corporation Confidence 100
[GrimAgent](https://attack.mitre.org/software/S0632) is a backdoor that has been used before the deployment of [Ryuk](https://attack.mitre.org/software/S0446) ransomware since at least 2020; it is likely used by [FIN6](https://attack.mitre.org/groups/G0037) and [Wizard Spider](https://attack.mitre.org/groups/G0102).(Citation: Group…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Sosano usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
FatDuke usesFamily The MITRE Corporation Confidence 100
[FatDuke](https://attack.mitre.org/software/S0512) is a backdoor used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2016.(Citation: ESET Dukes October 2019)
First seen 01/01/1970 · Last seen 16/11/5138 · -
Raspberry Robin usesFamily The MITRE Corporation Confidence 100
[Raspberry Robin](https://attack.mitre.org/software/S1130) is initial access malware first identified in September 2021, and active through early 2024. The malware is notable for spreading via infected USB devices containing a…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Fooder usesAlienVault Confidence 100
[Fooder](https://attack.mitre.org/software/S9033) is a custom 64-bit C/C++ loader used by [MuddyWater](https://attack.mitre.org/groups/G0069) that can decrypt and reflectively load embedded payloads such as a go-socks5 proxy utility, the open-source HackBrowserData infostealer,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
GoldMax usesFamily The MITRE Corporation Confidence 100
[GoldMax](https://attack.mitre.org/software/S0588) is a second-stage C2 backdoor written in Go with Windows and Linux variants that are nearly identical in functionality. [GoldMax](https://attack.mitre.org/software/S0588) was discovered in early 2021 during the…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Brute Ratel C4 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
SHARDLOADER usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
LunarWeb usesFamily The MITRE Corporation Confidence 100
[LunarWeb](https://attack.mitre.org/software/S1141) is a backdoor that has been used by [Turla](https://attack.mitre.org/groups/G0010) since at least 2020 including in a compromise of a European ministry of foreign affairs (MFA) together with…
First seen 01/01/1970 · Last seen 16/11/5138 ·
Reports (29)
-
AlienVault Confidence 100 20 MITREs 3 Malwares 28 IOCs 8 Observables
-
AlienVault Confidence 100 18 MITREs 1 Malware 3 IOCs 3 Observables 1 APT
-
AlienVault Confidence 100 20 MITREs 7 Malwares 11 IOCs 3 Observables 1 APT
-
AlienVault Confidence 100 1 CVE 10 MITREs 10 IOCs 1 APT
-
AlienVault Confidence 100 17 MITREs 1 Malware 12 IOCs 12 Observables 1 APT
-
AlienVault Confidence 100 19 MITREs 1 Malware 34 IOCs 34 Observables
-
20 MITREs 1 Malware 6 Observables
-
1 CVE 20 MITREs 9 Observables
-
20 MITREs 2 Malwares 14 Observables
-
AlienVault Confidence 100 20 MITREs 2 Malwares 6 IOCs 6 Observables
-
AlienVault Confidence 100 20 MITREs 3 Malwares 3 IOCs 3 Observables 1 APT
-
AlienVault Confidence 100 21 MITREs 1 Malware 8 IOCs 8 Observables 1 APT
Vulnerabilities (CVE) (13)
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being …
- Attack vector
- Network
- Published
- 27/03/2025
- Modified
- 21/12/2025
Tool (2)
-
Brute Ratel C4 usesThe MITRE Corporation Confidence 100
[Brute Ratel C4](https://attack.mitre.org/software/S1063) is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. [Brute Ratel C4](https://attack.mitre.org/software/S1063) was specifically designed to avoid detection by…
-
evilginx2 usesThe MITRE Corporation Confidence 75
[evilginx2](https://attack.mitre.org/software/S9003) is an open-source adversary-in-the-middle (AiTM) attack framework based on the open-source nginx web server. [evilginx2](https://attack.mitre.org/software/S9003) can be used as a reverse proxy between victims and legitimate web…
Campaign (1)
-
Operation Dream Job uses