216.73.216.233

Threat tools

Software used in attacks (Cobalt Strike, Mimikatz, etc.) with STIX relationships.

  • Tor
    The MITRE Corporation Confidence 100 2 MITREs 6 APTs 5 Campaigns

    [Tor](https://attack.mitre.org/software/S0183) is a software suite and network that provides increased anonymity on the Internet. It creates a multi-hop proxy network and utilizes multilayer encryption to protect both the…

  • QuasarRAT
    The MITRE Corporation Confidence 100 25 MITREs 7 APTs

    [QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that has been publicly available on GitHub since at least 2014. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language.(Citation: GitHub QuasarRAT)(Citation: Volexity…

  • cipher.exe
    The MITRE Corporation Confidence 100 1 MITRE 1 APT 1 Campaign

    [cipher.exe](https://attack.mitre.org/software/S1205) is a native Microsoft utility that manages encryption of directories and files on NTFS (New Technology File System) partitions by using the Encrypting File System (EFS).(Citation: cipher.exe)

  • SDelete
    The MITRE Corporation Confidence 100 2 MITREs 5 APTs

    [SDelete](https://attack.mitre.org/software/S0195) is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. (Citation: Microsoft SDelete…

  • Mythic
    The MITRE Corporation Confidence 100 13 MITREs

    [Mythic](https://attack.mitre.org/software/S0699) is an open source, cross-platform post-exploitation/command and control platform. [Mythic](https://attack.mitre.org/software/S0699) is designed to "plug-n-play" with various agents and communication channels.(Citation: Mythic Github)(Citation: Mythic SpecterOps)(Citation: Mythc Documentation) Deployed…

  • HTRAN
    The MITRE Corporation Confidence 100 3 MITREs 2 APTs

    [HTRAN](https://attack.mitre.org/software/S0040) is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their…

  • ftp
    The MITRE Corporation Confidence 100 3 MITREs 5 APTs 2 Campaigns

    [ftp](https://attack.mitre.org/software/S0095) is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a…

  • Reg
    The MITRE Corporation Confidence 100 3 MITREs 8 APTs 1 Campaign

    [Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation:…

  • Expand
    The MITRE Corporation Confidence 100 3 MITREs

    [Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file…

  • Pupy
    The MITRE Corporation Confidence 100 42 MITREs 2 APTs

    [Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as…

  • Cachedump
    The MITRE Corporation Confidence 100 1 MITRE 1 APT

    [Cachedump](https://attack.mitre.org/software/S0119) is a publicly-available tool that program extracts cached password hashes from a system’s registry. (Citation: Mandiant APT1)

  • schtasks
    The MITRE Corporation Confidence 100 1 MITRE 3 APTs

    [schtasks](https://attack.mitre.org/software/S0111) is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. (Citation: TechNet Schtasks)