T1573.001: T1573.001
Essential information
- MITRE technique ID
T1573.001- Confidence
- 100/100
- Revoked
- No
- Published
- 16/03/2020 16:45
- Modified
- 27/03/2026 01:08
- Author / Source
- The MITRE Corporation
Aliases
Symmetric Cryptography
Platforms
windows macos linux Network Devices ESXi
Description
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | command-and-control |
Marking (TLP)
TLP:GREEN Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
External references
Related entities
Intrusion sets, malware, reports, vulnerabilities, indicators and other entities linked to this technique.
Intrusion sets (APT) (57)
-
Core Werewolf relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
DPRK relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
DPRK (North Korea) relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
DPRK-aligned relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
The MITRE Corporation Confidence 100
[Darkhotel](https://attack.mitre.org/groups/G0012) is a suspected South Korean threat group that has targeted victims primarily in East Asia since at least 2004. The group's name is based on cyber espionage…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Dragon RaaS relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
DragonBreath relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
EVALUSION relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Earth Estries relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Emennet Pasargad relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
FAMOUS CHOLLIMA relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
FakeBat relatedAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Malware (79)
-
Brute Ratel usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Meterpreter usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
SeaDesk usesThe MITRE Corporation Confidence 100
[SeaDuke](https://attack.mitre.org/software/S0053) is malware that was used by [APT29](https://attack.mitre.org/groups/G0016) from 2014 to 2015. It was used primarily as a secondary backdoor for victims that were already compromised with [CozyCar](https://attack.mitre.org/software/S0046).…
First seen 01/01/1970 · Last seen 16/11/5138 · -
Eternidade Stealer usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
CurlyGate usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Loader1.dll usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
QuasarRAT - S0262 usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
Remote Access Trojan usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
AufTime usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
GrewApacha usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
-
BBSRAT usesFamily The MITRE Corporation Confidence 100
[BBSRAT](https://attack.mitre.org/software/S0127) is malware with remote access tool functionality that has been used in targeted compromises. (Citation: Palo Alto Networks BBSRAT)
First seen 01/01/1970 · Last seen 16/11/5138 · -
BlackBasta usesAlienVault Confidence 100First seen 01/01/1970 · Last seen 16/11/5138 ·
Reports (50)
-
Miasma Worm Returns to npm relatedAlienVault Confidence 100 18 MITREs 1 Malware 5 IOCs 5 Observables
-
AlienVault Confidence 100 21 MITREs 2 Malwares
-
AlienVault Confidence 100 16 MITREs 1 Malware 2 IOCs 2 Observables
-
AlienVault Confidence 100 23 MITREs 21 IOCs 7 Observables 1 APT
-
AlienVault Confidence 100 20 MITREs 3 Malwares 28 IOCs 8 Observables
-
AlienVault Confidence 100 1 CVE 18 MITREs 1 Malware 140 IOCs 127 Observables
-
AlienVault Confidence 100 19 MITREs 3 Malwares 6 IOCs 1 APT
-
AlienVault Confidence 100 20 MITREs 2 Malwares 11 IOCs 7 Observables 1 APT
-
AlienVault Confidence 100 25 MITREs 6 Malwares 39 IOCs 24 Observables
-
AlienVault Confidence 100 13 CVEs 22 MITREs 6 Malwares 5 IOCs 4 Observables
-
AlienVault Confidence 100 20 MITREs 1 Malware 3 IOCs 1 APT
-
AlienVault Confidence 100 19 MITREs 3 Malwares 4 IOCs 1 APT
Vulnerabilities (CVE) (52)
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker …
- Attack vector
- Network
- Published
- 13/02/2026
- Modified
- 20/02/2026
Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.
- Published
- 03/11/2021
- Modified
- 20/12/2025
Improper Input Validation vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server dashboards allows Command Injection. This affects 1.7.0 versions …
- Attack vector
- NETWORK
- Published
- 27/10/2022
- Modified
- 21/12/2025
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve …
- Attack vector
- Network
- Published
- 02/06/2025
- Modified
- 21/12/2025
Tool (2)
-
QuasarRAT usesThe MITRE Corporation Confidence 100
[QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that has been publicly available on GitHub since at least 2014. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language.(Citation: GitHub QuasarRAT)(Citation: Volexity…
-
Sliver usesThe MITRE Corporation Confidence 100
[Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control (C2) framework written in Golang. [Sliver](https://attack.mitre.org/software/S0633) includes its own package manager, "armory," for staging and downloading additional…