Forensia CTI Core

About

Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec). Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors. Tools may also be leveraged for testing – for example, evaluating malware against commercial antivirus or endpoint detection and response (EDR) applications. Tool acquisition may involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike. In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries). Threat actors may also crack trial versions of software.

Platforms: PREParent: T1588 Obtain CapabilitiesMITRE ATT&CK ↗

Used by actors

81 known groups

G0003 Cleaver G0004 Ke3chang G0006 APT1 G0007 APT28 G0008 Carbanak G0010 Turla G0011 PittyTiger G0016 APT29 G0027 Threat Group-3390 G0030 Lotus Blossom G0032 Lazarus Group G0034 Sandworm Team G0035 Dragonfly G0037 FIN6 G0040 Patchwork G0045 menuPass G0046 FIN7 G0047 Gamaredon Group G0049 OilRig G0050 APT32 G0051 FIN10 G0052 CopyKittens G0053 FIN5 G0059 Magic Hound G0060 BRONZE BUTLER G0061 FIN8 G0064 APT33 G0069 MuddyWater G0073 APT19 G0076 Thrip G0077 Leafminer G0078 Gorgon Group G0079 DarkHydrus G0080 Cobalt Group G0082 APT38 G0087 APT39 G0090 WIRTE G0091 Silence G0092 TA505 G0093 GALLIUM G0094 Kimsuky G0096 APT41 G0098 BlackTech G0099 APT-C-36 G0100 Inception G0102 Wizard Spider G0105 DarkVishnya G0107 Whitefly G0108 Blue Mockingbird G0114 Chimera G0122 Silent Librarian G0129 Mustang Panda G0135 BackdoorDiplomacy G0136 IndigoZebra G0137 Ferocious Kitten G0143 Aquatic Panda G1001 HEXANE G1002 BITTER G1004 LAPSUS$G1005 POLONIUM G1006 Earth Lusca G1007 Aoqin Dragon G1009 Moses Staff G1013 Metador G1014 LuminousMoth G1015 Scattered Spider G1016 FIN13 G1017 Volt Typhoon G1018 TA2541 G1021 Cinnamon Tempest G1032 INC Ransom G1033 Star Blizzard G1040 Play G1041 Sea Turtle G1044 APT42 G1045 Salt Typhoon G1046 Storm-1811 G1051 Medusa Group G1052 Contagious Interview G1054 MirrorFace G1055 VOID MANTICORE

Software

1 malware/tools implement this

Lizar

Corpus indicators tagged with this technique

579 indicators in the corpus carry T1588.002.

Indicator	Type	Family	Sev	Src
293814692f1c814205e99a50162d8db36b8b69378c1e56309bdca87ae41c6d07	sha256	phishing	80	1
223785a6fdd9d77758ee9c28874419ac3289f830b8c57ba3b361b5b868f8fba6	sha256	phishing	80	1
25d305f969d02d6e4317edef3e59aa3d9dba14eb054dfe5de6b2d101bb5331c1	sha256	phishing	80	1
288f7170251fed0c67e17ea3f865e95e2ef8829512d4e90606977266fb911a7d	sha256	phishing	80	1
19c2f1069f50a390d18b873b2a8c267014131ab945724836cda470d1aad714a2	sha256	phishing	80	1
21cad6385ffe3d0981a9ac73a83d605e20331a3d1b7649c1dc5daa401da55bc7	sha256	phishing	80	1
189a3fe5085f5426107ec0d7395719bc3c974217e591c01728529377fa7982a9	sha256	phishing	80	1
24fa269ad2f8cc2eb9b71465a80a0856ed5d0ceb43d7c2a341d2e45fb3fed51e	sha256	phishing	80	1
0683b208fa3cf96e355ded36455491e3664bf2d4523253ee6dee2476dd6e774a	sha256	phishing	80	1
0528706a4e2fbcc58dfe476c4fa1b863e054b7af46ceb309c340a45140f7be14	sha256	phishing	80	1
151f9d488e1479d67e5e1561aa79b1cdf29e2cd6626b04ed897fbf5bc4d2150f	sha256	phishing	80	1
0c2edbcf0aca28290cea238fe9c11d2174aa567c5b085cae43e94c2747c2fd49	sha256	phishing	80	1
1a5276bafbf007f33daf93d5272df25214607bd6407906408c8e308165a6b61e	sha256	phishing	80	1
2052302dca8ec7c594d898a4dc56dd1735816db88dc323b3235fe1436b431dfa	sha256	phishing	80	1
11d838bf89f0c6b803455daa94888100a53d605f563bb6f853a049abadc5085f	sha256	phishing	80	1
0713b460e85c28d59078e00317dff192d2976c41692cbc46e240c038dae0d67e	sha256	phishing	80	1
1900068a5188a239af2a4319700b1642041ab3d7b3ee9865abe73059164c4431	sha256	phishing	80	1
2409b8faf363e25fda6c8a165d396225b2937a45ca11a6ec806dd4a8bb986959	sha256	phishing	80	1
238df253ffd9f45faf5f503210116abad556fbbfd27c7584e9ad040201acb553	sha256	phishing	80	1
01ecb631280cbfaaac33f9cb829d0d93f58aeb5b33513e3a320e4d1cd0e10a03	sha256	phishing	80	1
0274104d21dfb3f035b980d03f9d750924f6c24367177c9b20c863c2ffd777f1	sha256	phishing	80	1
0fed75220d0d5eb4e98c4962734fd9acc2df1e3d328874915a2161a59fccef45	sha256	phishing	80	1
08c73750aa50c53174613e70ff17fdbd9b1e2965490f871141a085f365f7acd6	sha256	phishing	80	1
0d6b8bfcd5017927e511329f2abad2a944ea59c9074771c1f73ca84c2e558347	sha256	phishing	80	1
0a2c3bf5422867f5204b8853f3b4d8383b014dbaedb624d7f774d9191f641697	sha256	phishing	80	1
11891ddcf6e2f14ab9bda83da5cbad5e401c69b9e88810efeafa65d6f9e1d88b	sha256	phishing	80	1
0f49587d33d8090f097418ceb0361c9351714c599b3acd7d98603dcfcfef37d1	sha256	phishing	80	1
128fdd44526c4e3102421425c23e3c5a5bf49f38eb13a98eea8b08817df2a47e	sha256	phishing	80	1
1c36f24ca62a4165d9ed531bc95f3556f39a3e543034cb8ad0f10a0595a3fd14	sha256	phishing	80	1
2a546dc2a96b73aeeec9fef036c620291e480251d3735707ff87a3baf164b86e	sha256	phishing	80	1

Showing the top 30 by severity of 579.