T1497.003: T1497.003
Essential information
- MITRE technique ID
T1497.003- Confidence
- 100/100
- Revoked
- No
- Published
- 06/03/2020 22:11
- Modified
- 13/04/2026 17:17
- Author / Source
- The MITRE Corporation
Aliases
Time Based Checks
Platforms
windows macos linux
Description
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | defense-evasion |
| mitre-attack | discovery |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (21)
-
AlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
UNC5174 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. [Mustang Panda](https://attack.mitre.org/groups/G0129) has been known to use tailored phishing lures…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Vect usesRansomware.Live Confidence 100
No description available
First seen 01/01/1970 · Last seen 16/11/5138 · -
SLOW#TEMPEST usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
UNK_CraftyCamel usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
ShadyPanda usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
LofyGang usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
DPRK usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Gamaredon usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Winnti usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
GlassWorm usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (81)
-
AHKBot usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Bumblebee usesFamily The MITRE Corporation Confidence 100
[Bumblebee](https://attack.mitre.org/software/S1039) is a custom loader written in C++ that has been used by multiple threat actors, including possible initial access brokers, to download and execute additional payloads since…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Clop usesFamily The MITRE Corporation Confidence 100
[Clop](https://attack.mitre.org/software/S0611) is a ransomware family that was first observed in February 2019 and has been used against retail, transportation and logistics, education, manufacturing, engineering, automotive, energy, financial, aerospace,…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Bazar usesFamily The MITRE Corporation Confidence 100
[Bazar](https://attack.mitre.org/software/S0534) is a downloader and backdoor that has been used since at least April 2020, with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies…
First seen 01/01/1970 · Last seen 16/11/5138 · -
AvNeutralizer usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Lokibot usesFamily The MITRE Corporation Confidence 100
[Lokibot](https://attack.mitre.org/software/S0447) is a widely distributed information stealer that was first reported in 2015. It is designed to steal sensitive information such as usernames, passwords, cryptocurrency wallets, and other…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Havoc usesThe MITRE Corporation Confidence 100
[Havoc](https://attack.mitre.org/software/S1229) is an open-source post-exploitation command and control (C2) framework first released on GitHub in October 2022 by C5pider (Paul Ungur), who continues to maintain and develop it…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Powertrash usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
TSPY_TRICKLOAD usesThe MITRE Corporation Confidence 100
[TrickBot](https://attack.mitre.org/software/S0266) is a Trojan spyware program written in C++ that first emerged in September 2016 as a possible successor to [Dyre](https://attack.mitre.org/software/S0024). [TrickBot](https://attack.mitre.org/software/S0266) was developed and initially used by…
First seen 01/01/1970 · Last seen 16/11/5138 ·
Reports (29)
-
AlienVault Confidence 100 20 MITREs 3 Malwares 28 IOCs 8 Observables
-
AlienVault Confidence 100 18 MITREs 1 Malware 3 IOCs 3 Observables 1 APT
-
AlienVault Confidence 100 20 MITREs 7 Malwares 11 IOCs 3 Observables 1 APT
-
AlienVault Confidence 100 1 CVE 10 MITREs 10 IOCs 1 APT
-
AlienVault Confidence 100 17 MITREs 1 Malware 12 IOCs 12 Observables 1 APT
-
AlienVault Confidence 100 19 MITREs 1 Malware 34 IOCs 34 Observables
-
20 MITREs 1 Malware 6 Observables
-
1 CVE 20 MITREs 9 Observables
-
20 MITREs 2 Malwares 14 Observables
-
AlienVault Confidence 100 20 MITREs 2 Malwares 6 IOCs 6 Observables
-
AlienVault Confidence 100 20 MITREs 3 Malwares 3 IOCs 3 Observables 1 APT
-
AlienVault Confidence 100 21 MITREs 1 Malware 8 IOCs 8 Observables 1 APT
Vulnerabilities (CVE) (13)
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being …
- Attack vector
- Network
- Published
- 27/03/2025
- Modified
- 21/12/2025
Tool (2)
-
Brute Ratel C4 usesThe MITRE Corporation Confidence 100
[Brute Ratel C4](https://attack.mitre.org/software/S1063) is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. [Brute Ratel C4](https://attack.mitre.org/software/S1063) was specifically designed to avoid detection by…
-
evilginx2 usesThe MITRE Corporation Confidence 75
[evilginx2](https://attack.mitre.org/software/S9003) is an open-source adversary-in-the-middle (AiTM) attack framework based on the open-source nginx web server. [evilginx2](https://attack.mitre.org/software/S9003) can be used as a reverse proxy between victims and legitimate web…
Campaign (1)
-
Operation Dream Job uses