mitre-tool.json

{
  "authors": [
    "MITRE"
  ],
  "category": "tool",
  "description": "Name of ATT&CK software",
  "name": "Tool",
  "source": "https://github.com/mitre/cti",
  "type": "mitre-tool",
  "uuid": "d700dc5c-78f6-11e7-a476-5f748c8e4fe0",
  "values": [
    {
      "description": "[Windows Credential Editor](https://attack.mitre.org/software/S0005) is a password dumping tool. (Citation: Amplia WCE)",
      "meta": {
        "external_id": "S0005",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0005",
          "http://www.ampliasecurity.com/research/wcefaq.html"
        ],
        "synonyms": [
          "Windows Credential Editor",
          "WCE"
        ]
      },
      "related": [
        {
          "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "242f3da3-4425-4d11-8f5c-b842886da966",
      "value": "Windows Credential Editor - S0005"
    },
    {
      "description": "[Pass-The-Hash Toolkit](https://attack.mitre.org/software/S0122) is a toolkit that allows an adversary to \"pass\" a password hash (without knowing the original password) to log in to systems. (Citation: Mandiant APT1)",
      "meta": {
        "external_id": "S0122",
        "mitre_platforms": [
          "Linux",
          "Windows",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0122",
          "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
        ],
        "synonyms": [
          "Pass-The-Hash Toolkit"
        ]
      },
      "related": [
        {
          "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "a52edc76-328d-4596-85e7-d56ef5a9eb69",
      "value": "Pass-The-Hash Toolkit - S0122"
    },
    {
      "description": "[Cobalt Strike](https://attack.mitre.org/software/S0154) is a commercial, full-featured, penetration testing tool which bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system. (Citation: cobaltstrike manual)\n\nIn addition to its own capabilities, [Cobalt Strike](https://attack.mitre.org/software/S0154) leverages the capabilities of other well-known tools such as Metasploit and [Mimikatz](https://attack.mitre.org/software/S0002). (Citation: cobaltstrike manual)",
      "meta": {
        "external_id": "S0154",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0154",
          "https://cobaltstrike.com/downloads/csmanual38.pdf"
        ],
        "synonyms": [
          "Cobalt Strike"
        ]
      },
      "related": [
        {
          "dest-uuid": "ca44dd5e-fd9e-48b5-99cb-0b2629b9265f",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "1a1d3ea4-972e-4c48-8d85-08d9db8f1550",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "4eeaf8a9-c86b-4954-a663-9555fb406466",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "99709758-2b96-48f2-a68a-ad7fbd828091",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "fdc47f44-dd32-4b99-af5f-209f556f63c2",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f72eb8a8-cd4c-461d-a814-3f862befbf00",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "544b0346-29ad-41e1-a808-501bb4193f47",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "c8e87b83-edbb-48d4-9295-4974897525b7",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "68a0c5ed-bee2-4513-830d-5b0d650139bd",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "93591901-3172-4e94-abf8-6034ab26f44a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "8cdeb020-e31e-4f88-a582-f53dcfbda819",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "aafea02e-ece5-4bb2-91a6-3bf8c7f38a39",
      "value": "Cobalt Strike - S0154"
    },
    {
      "description": "[Imminent Monitor](https://attack.mitre.org/software/S0434) was a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an operation was conducted to take down the Imminent Monitor infrastructure. Various cracked versions and variations of this RAT are still in circulation.(Citation: Imminent Unit42 Dec2019)",
      "meta": {
        "external_id": "S0434",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0434",
          "https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/"
        ],
        "synonyms": [
          "Imminent Monitor"
        ]
      },
      "related": [
        {
          "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "cd25c1b4-935c-4f0e-ba8d-552f28bc4783",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "8f8cd191-902c-4e83-bf20-b57c8c4640e9",
      "value": "Imminent Monitor - S0434"
    },
    {
      "description": "[Invoke-PSImage](https://attack.mitre.org/software/S0231) takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a one liner for executing either from a file of from the web. Example of usage is embedding the PowerShell code from the Invoke-Mimikatz module and embed it into an image file. By calling the image file from a macro for example, the macro will download the picture and execute the PowerShell code, which in this case will dump the passwords. (Citation: GitHub Invoke-PSImage)",
      "meta": {
        "external_id": "S0231",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0231",
          "https://github.com/peewpw/Invoke-PSImage"
        ],
        "synonyms": [
          "Invoke-PSImage"
        ]
      },
      "related": [
        {
          "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "b52d6583-14a2-4ddc-8527-87fd2142558f",
      "value": "Invoke-PSImage - S0231"
    },
    {
      "description": "[ipconfig](https://attack.mitre.org/software/S0100) is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration. (Citation: TechNet Ipconfig)",
      "meta": {
        "external_id": "S0100",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0100",
          "https://technet.microsoft.com/en-us/library/bb490921.aspx"
        ],
        "synonyms": [
          "ipconfig",
          "ipconfig.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "294e2560-bd48-44b2-9da2-833b5588ad11",
      "value": "ipconfig - S0100"
    },
    {
      "description": "[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. (Citation: Deply Mimikatz) (Citation: Adsecurity Mimikatz Guide)",
      "meta": {
        "external_id": "S0002",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0002",
          "https://github.com/gentilkiwi/mimikatz",
          "https://adsecurity.org/?page_id=1821"
        ],
        "synonyms": [
          "Mimikatz"
        ]
      },
      "related": [
        {
          "dest-uuid": "7f3a035d-d83a-45b8-8111-412aa8ade802",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b7dc639b-24cd-482d-a7f1-8897eda21023",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "564998d8-ab3e-4123-93fb-eccaa6b9714a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d273434a-448e-4598-8e14-607f4a0d5e27",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "768dce68-8d0d-477a-b01d-0eea98b963a1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f303a39a-6255-4b89-aecc-18c4d8ca7163",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60",
      "value": "Mimikatz - S0002"
    },
    {
      "description": "[HTRAN](https://attack.mitre.org/software/S0040) is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their location when interacting with the victim networks. (Citation: Operation Quantum Entanglement)(Citation: NCSC Joint Report Public Tools)",
      "meta": {
        "external_id": "S0040",
        "mitre_platforms": [
          "Linux",
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0040",
          "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf",
          "https://s3.eu-west-1.amazonaws.com/ncsc-content/files/Joint%20report%20on%20publicly%20available%20hacking%20tools%20%28NCSC%29.pdf"
        ],
        "synonyms": [
          "HTRAN",
          "HUC Packet Transmit Tool"
        ]
      },
      "related": [
        {
          "dest-uuid": "3fb18a77-91ef-4c68-a9a9-fa6bdbea38e8",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "d5e96a35-7b0b-4c6a-9533-d63ecbda563e",
      "value": "HTRAN - S0040"
    },
    {
      "description": "[pwdump](https://attack.mitre.org/software/S0006) is a credential dumper. (Citation: Wikipedia pwdump)",
      "meta": {
        "external_id": "S0006",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0006",
          "https://en.wikipedia.org/wiki/Pwdump"
        ],
        "synonyms": [
          "pwdump"
        ]
      },
      "related": [
        {
          "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "9de2308e-7bed-43a3-8e58-f194b3586700",
      "value": "pwdump - S0006"
    },
    {
      "description": "[gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. (Citation: TrueSec Gsecdump)",
      "meta": {
        "external_id": "S0008",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0008",
          "https://www.truesec.se/sakerhet/verktyg/saakerhet/gsecdump_v2.0b5"
        ],
        "synonyms": [
          "gsecdump"
        ]
      },
      "related": [
        {
          "dest-uuid": "8410d208-7450-407d-b56c-e5c1ced19632",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "b07c2c47-fefb-4d7c-a69e-6a3296171f54",
      "value": "gsecdump - S0008"
    },
    {
      "description": "[at](https://attack.mitre.org/software/S0110) is used to schedule tasks on a system to run at a specified date or time. (Citation: TechNet At)",
      "meta": {
        "external_id": "S0110",
        "mitre_platforms": [
          "Linux",
          "Windows",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0110",
          "https://technet.microsoft.com/en-us/library/bb490866.aspx"
        ],
        "synonyms": [
          "at",
          "at.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "f3d95a1f-bba2-44ce-9af7-37866cd63fd0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "0c8465c0-d0b4-4670-992e-4eee8d7ff952",
      "value": "at - S0110"
    },
    {
      "description": "[ifconfig](https://attack.mitre.org/software/S0101) is a Unix-based utility used to gather information about and interact with the TCP/IP settings on a system. (Citation: Wikipedia Ifconfig)",
      "meta": {
        "external_id": "S0101",
        "mitre_platforms": [
          "Linux"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0101",
          "https://en.wikipedia.org/wiki/Ifconfig"
        ],
        "synonyms": [
          "ifconfig"
        ]
      },
      "related": [
        {
          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "362dc67f-4e85-4562-9dac-1b6b7f3ec4b5",
      "value": "ifconfig - S0101"
    },
    {
      "description": "[Fgdump](https://attack.mitre.org/software/S0120) is a Windows password hash dumper. (Citation: Mandiant APT1)",
      "meta": {
        "external_id": "S0120",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0120",
          "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
        ],
        "synonyms": [
          "Fgdump"
        ]
      },
      "related": [
        {
          "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "4f45dfeb-fe51-4df0-8db3-edf7dd0513fe",
      "value": "Fgdump - S0120"
    },
    {
      "description": "[nbtstat](https://attack.mitre.org/software/S0102) is a utility used to troubleshoot NetBIOS name resolution. (Citation: TechNet Nbtstat)",
      "meta": {
        "external_id": "S0102",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0102",
          "https://technet.microsoft.com/en-us/library/cc940106.aspx"
        ],
        "synonyms": [
          "nbtstat",
          "nbtstat.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "b35068ec-107a-4266-bda8-eb7036267aea",
      "value": "nbtstat - S0102"
    },
    {
      "description": "[route](https://attack.mitre.org/software/S0103) can be used to find or change information within the local system IP routing table. (Citation: TechNet Route)",
      "meta": {
        "external_id": "S0103",
        "mitre_platforms": [
          "Linux",
          "Windows",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0103",
          "https://technet.microsoft.com/en-us/library/bb490991.aspx"
        ],
        "synonyms": [
          "route",
          "route.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "c11ac61d-50f4-444f-85d8-6f006067f0de",
      "value": "route - S0103"
    },
    {
      "description": "[netstat](https://attack.mitre.org/software/S0104) is an operating system utility that displays active TCP connections, listening ports, and network statistics. (Citation: TechNet Netstat)",
      "meta": {
        "external_id": "S0104",
        "mitre_platforms": [
          "Windows",
          "Linux",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0104",
          "https://technet.microsoft.com/en-us/library/bb490947.aspx"
        ],
        "synonyms": [
          "netstat",
          "netstat.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "4664b683-f578-434f-919b-1c1aad2a1111",
      "value": "netstat - S0104"
    },
    {
      "description": "[dsquery](https://attack.mitre.org/software/S0105) is a command-line utility that can be used to query Active Directory for information from a system within a domain. (Citation: TechNet Dsquery) It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.",
      "meta": {
        "external_id": "S0105",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0105",
          "https://technet.microsoft.com/en-us/library/cc732952.aspx"
        ],
        "synonyms": [
          "dsquery",
          "dsquery.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "38952eac-cb1b-4a71-bad2-ee8223a1c8fe",
      "value": "dsquery - S0105"
    },
    {
      "description": "[cmd](https://attack.mitre.org/software/S0106) is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. (Citation: TechNet Cmd)\n\nCmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., <code>dir</code> (Citation: TechNet Dir)), deleting files (e.g., <code>del</code> (Citation: TechNet Del)), and copying files (e.g., <code>copy</code> (Citation: TechNet Copy)).",
      "meta": {
        "external_id": "S0106",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0106",
          "https://technet.microsoft.com/en-us/library/bb490880.aspx",
          "https://technet.microsoft.com/en-us/library/cc755121.aspx",
          "https://technet.microsoft.com/en-us/library/cc771049.aspx",
          "https://technet.microsoft.com/en-us/library/bb490886.aspx"
        ],
        "synonyms": [
          "cmd",
          "cmd.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "bba595da-b73a-4354-aa6c-224d4de7cb4e",
      "value": "cmd - S0106"
    },
    {
      "description": "[certutil](https://attack.mitre.org/software/S0160) is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. (Citation: TechNet Certutil)",
      "meta": {
        "external_id": "S0160",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0160",
          "https://technet.microsoft.com/library/cc732443.aspx"
        ],
        "synonyms": [
          "certutil",
          "certutil.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "c615231b-f253-4f58-9d47-d5b4cbdb6839",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "0a68f1f1-da74-4d28-8d9a-696c082706cc",
      "value": "certutil - S0160"
    },
    {
      "description": "[netsh](https://attack.mitre.org/software/S0108) is a scripting utility used to interact with networking components on local or remote systems. (Citation: TechNet Netsh)",
      "meta": {
        "external_id": "S0108",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0108",
          "https://technet.microsoft.com/library/bb490939.aspx"
        ],
        "synonyms": [
          "netsh",
          "netsh.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f63fe421-b1d1-45c0-b8a7-02cd16ff2bed",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "5a63f900-5e7e-4928-a746-dd4558e1df71",
      "value": "netsh - S0108"
    },
    {
      "description": "[BITSAdmin](https://attack.mitre.org/software/S0190) is a command line tool used to create and manage [BITS Jobs](https://attack.mitre.org/techniques/T1197). (Citation: Microsoft BITSAdmin)",
      "meta": {
        "external_id": "S0190",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0190",
          "https://msdn.microsoft.com/library/aa362813.aspx"
        ],
        "synonyms": [
          "BITSAdmin"
        ]
      },
      "related": [
        {
          "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "c8e87b83-edbb-48d4-9295-4974897525b7",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "64764dc6-a032-495f-8250-1e4c06bdc163",
      "value": "BITSAdmin - S0190"
    },
    {
      "description": "[Koadic](https://attack.mitre.org/software/S0250) is a Windows post-exploitation framework and penetration testing tool. [Koadic](https://attack.mitre.org/software/S0250) is publicly available on GitHub and the tool is executed via the command-line. [Koadic](https://attack.mitre.org/software/S0250) has several options for staging payloads and creating implants. [Koadic](https://attack.mitre.org/software/S0250) performs most of its operations using Windows Script Host. (Citation: Github Koadic) (Citation: Palo Alto Sofacy 06-2018)",
      "meta": {
        "external_id": "S0250",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0250",
          "https://github.com/zerosum0x0/koadic",
          "https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"
        ],
        "synonyms": [
          "Koadic"
        ]
      },
      "related": [
        {
          "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "c8655260-9f4b-44e3-85e1-6538a5f6e4f4",
      "value": "Koadic - S0250"
    },
    {
      "description": "[PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers. (Citation: Russinovich Sysinternals) (Citation: SANS PsExec)",
      "meta": {
        "external_id": "S0029",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0029",
          "https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx",
          "https://digital-forensics.sans.org/blog/2012/12/17/protecting-privileged-domain-accounts-psexec-deep-dive"
        ],
        "synonyms": [
          "PsExec"
        ]
      },
      "related": [
        {
          "dest-uuid": "6dd05630-9bd8-11e8-a8b9-47ce338a4367",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "ff6caf67-ea1f-4895-b80e-4bb0fc31c6db",
      "value": "PsExec - S0029"
    },
    {
      "description": "The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft Net Utility)\n\n[Net](https://attack.mitre.org/software/S0039) has a great deal of functionality, (Citation: Savill 1999) much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through [Windows Admin Shares](https://attack.mitre.org/techniques/T1077) using <code>net use</code> commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as <code>net1 user</code>.",
      "meta": {
        "external_id": "S0039",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0039",
          "https://msdn.microsoft.com/en-us/library/aa939914",
          "http://windowsitpro.com/windows/netexe-reference"
        ],
        "synonyms": [
          "Net",
          "net.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "a750a9f6-0bde-4bb3-9aae-1e2786e9780c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "03342581-f790-4f03-ba41-e82e67392e23",
      "value": "Net - S0039"
    },
    {
      "description": "[esentutl](https://attack.mitre.org/software/S0404) is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.(Citation: Microsoft Esentutl)",
      "meta": {
        "external_id": "S0404",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0404",
          "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh875546(v=ws.11)"
        ],
        "synonyms": [
          "esentutl",
          "esentutl.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "c256da91-6dd5-40b2-beeb-ee3b22ab3d27",
      "value": "esentutl - S0404"
    },
    {
      "description": "[FlexiSpy](https://attack.mitre.org/software/S0408) is sophisticated surveillanceware for iOS and Android. Publicly-available, comprehensive analysis has only been found for the Android version.(Citation: FortiGuard-FlexiSpy)(Citation: CyberMerchants-FlexiSpy)\n\n[FlexiSpy](https://attack.mitre.org/software/S0408) markets itself as a parental control and employee monitoring application.(Citation: FlexiSpy-Website)",
      "meta": {
        "external_id": "S0408",
        "mitre_platforms": [
          "Android"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0408",
          "https://d3gpjj9d20n0p3.cloudfront.net/fortiguard/research/Dig%20Deep%20into%20FlexiSpy%20for%20Android%28white%20paper%29_KaiLu.pdf",
          "http://www.cybermerchantsofdeath.com/blog/2017/04/22/FlexiSpy.html",
          "https://www.flexispy.com/"
        ],
        "synonyms": [
          "FlexiSpy"
        ]
      },
      "related": [
        {
          "dest-uuid": "948a447c-d783-4ba0-8516-a64140fcacd5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d13fa042-8f26-44e1-a2a8-af0bf8e2ac9a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "fd658820-cbba-4c95-8ac9-0fac6b1099e2",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "c5089859-b21f-40a3-8be4-63e381b8b1c0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bd4d32f5-eed4-4018-a649-40b229dd1d69",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "8e27551a-5080-4148-a584-c64348212e4f",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "4e6620ac-c30c-4f6d-918e-fa20cae7c1ce",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "62adb627-f647-498e-b4cc-41499361bacb",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e4c347e9-fb91-4bc5-83b8-391e389131e2",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "1622fd3d-fcfc-4d02-ac49-f2d786f79b81",
      "value": "FlexiSpy - S0408"
    },
    {
      "description": "[Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: Microsoft Reg)\n\nUtilities such as [Reg](https://attack.mitre.org/software/S0075) are known to be used by persistent threats. (Citation: Windows Commands JPCERT)",
      "meta": {
        "external_id": "S0075",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0075",
          "https://technet.microsoft.com/en-us/library/cc732643.aspx",
          "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"
        ],
        "synonyms": [
          "Reg",
          "reg.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "cde2d700-9ed1-46cf-9bce-07364fe8b24f",
      "value": "Reg - S0075"
    },
    {
      "description": "The [Tasklist](https://attack.mitre.org/software/S0057) utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating systems and can be executed from the command-line interface. (Citation: Microsoft Tasklist)",
      "meta": {
        "external_id": "S0057",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0057",
          "https://technet.microsoft.com/en-us/library/bb491010.aspx"
        ],
        "synonyms": [
          "Tasklist"
        ]
      },
      "related": [
        {
          "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "2e45723a-31da-4a7e-aaa6-e01998a6788f",
      "value": "Tasklist - S0057"
    },
    {
      "description": "[FTP](https://attack.mitre.org/software/S0095) is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a system or to exfiltrate data. (Citation: Wikipedia FTP)",
      "meta": {
        "external_id": "S0095",
        "mitre_platforms": [
          "Linux",
          "Windows",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0095",
          "https://en.wikipedia.org/wiki/File_Transfer_Protocol"
        ],
        "synonyms": [
          "FTP",
          "ftp.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "cf23bf4a-e003-4116-bbae-1ea6c558d565",
      "value": "FTP - S0095"
    },
    {
      "description": "[Systeminfo](https://attack.mitre.org/software/S0096) is a Windows utility that can be used to gather detailed information about a computer. (Citation: TechNet Systeminfo)",
      "meta": {
        "external_id": "S0096",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0096",
          "https://technet.microsoft.com/en-us/library/bb491007.aspx"
        ],
        "synonyms": [
          "systeminfo.exe",
          "Systeminfo"
        ]
      },
      "related": [
        {
          "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "7fcbc4e8-1989-441f-9ac5-e7b6ff5806f1",
      "value": "Systeminfo - S0096"
    },
    {
      "description": "[Ping](https://attack.mitre.org/software/S0097) is an operating system utility commonly used to troubleshoot and verify network connections. (Citation: TechNet Ping)",
      "meta": {
        "external_id": "S0097",
        "mitre_platforms": [
          "Linux",
          "Windows",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0097",
          "https://technet.microsoft.com/en-us/library/bb490968.aspx"
        ],
        "synonyms": [
          "ping.exe",
          "Ping"
        ]
      },
      "related": [
        {
          "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "b77b563c-34bb-4fb8-86a3-3694338f7b47",
      "value": "Ping - S0097"
    },
    {
      "description": "[Arp](https://attack.mitre.org/software/S0099) displays information about a system's Address Resolution Protocol (ARP) cache. (Citation: TechNet Arp)",
      "meta": {
        "external_id": "S0099",
        "mitre_platforms": [
          "Linux",
          "Windows",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0099",
          "https://technet.microsoft.com/en-us/library/bb490864.aspx"
        ],
        "synonyms": [
          "Arp",
          "arp.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "30489451-5886-4c46-90c9-0dff9adc5252",
      "value": "Arp - S0099"
    },
    {
      "description": "[schtasks](https://attack.mitre.org/software/S0111) is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. (Citation: TechNet Schtasks)",
      "meta": {
        "external_id": "S0111",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0111",
          "https://technet.microsoft.com/en-us/library/bb490996.aspx"
        ],
        "synonyms": [
          "schtasks",
          "schtasks.exe"
        ]
      },
      "related": [
        {
          "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "c9703cd3-141c-43a0-a926-380082be5d04",
      "value": "schtasks - S0111"
    },
    {
      "description": "[Lslsass](https://attack.mitre.org/software/S0121) is a publicly-available tool that can dump active logon session password hashes from the lsass process. (Citation: Mandiant APT1)",
      "meta": {
        "external_id": "S0121",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0121",
          "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
        ],
        "synonyms": [
          "Lslsass"
        ]
      },
      "related": [
        {
          "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "2fab555f-7664-4623-b4e0-1675ae38190b",
      "value": "Lslsass - S0121"
    },
    {
      "description": "[UACMe](https://attack.mitre.org/software/S0116) is an open source assessment tool that contains many methods for bypassing Windows User Account Control on multiple versions of the operating system. (Citation: Github UACMe)",
      "meta": {
        "external_id": "S0116",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0116",
          "https://github.com/hfiref0x/UACME"
        ],
        "synonyms": [
          "UACMe"
        ]
      },
      "related": [
        {
          "dest-uuid": "ccde5b0d-fe13-48e6-a6f4-4e434ce29371",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "102c3898-85e0-43ee-ae28-62a0a3ed9507",
      "value": "UACMe - S0116"
    },
    {
      "description": "[Cachedump](https://attack.mitre.org/software/S0119) is a publicly-available tool that program extracts cached password hashes from a system’s registry. (Citation: Mandiant APT1)",
      "meta": {
        "external_id": "S0119",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0119",
          "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"
        ],
        "synonyms": [
          "Cachedump"
        ]
      },
      "related": [
        {
          "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "c9cd7ec9-40b7-49db-80be-1399eddd9c52",
      "value": "Cachedump - S0119"
    },
    {
      "description": "[Winexe](https://attack.mitre.org/software/S0191) is a lightweight, open source tool similar to [PsExec](https://attack.mitre.org/software/S0029) designed to allow system administrators to execute commands on remote servers. (Citation: Winexe Github Sept 2013) [Winexe](https://attack.mitre.org/software/S0191) is unique in that it is a GNU/Linux based client. (Citation: Überwachung APT28 Forfiles June 2015)",
      "meta": {
        "external_id": "S0191",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0191",
          "https://github.com/skalkoto/winexe/",
          "https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/"
        ],
        "synonyms": [
          "Winexe"
        ]
      },
      "related": [
        {
          "dest-uuid": "811bdec0-e236-48ae-b27c-1a8fe0bfc3a9",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "96fd6cc4-a693-4118-83ec-619e5352d07d",
      "value": "Winexe - S0191"
    },
    {
      "description": "[xCmd](https://attack.mitre.org/software/S0123) is an open source tool that is similar to [PsExec](https://attack.mitre.org/software/S0029) and allows the user to execute applications on remote systems. (Citation: xCmd)",
      "meta": {
        "external_id": "S0123",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0123",
          "https://ashwinrayaprolu.wordpress.com/2011/04/12/xcmd-an-alternative-to-psexec/"
        ],
        "synonyms": [
          "xCmd"
        ]
      },
      "related": [
        {
          "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "4fa49fc0-9162-4bdb-a37e-7aa3dcb6d38b",
      "value": "xCmd - S0123"
    },
    {
      "description": "[Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). (Citation: GitHub Pupy) [Pupy](https://attack.mitre.org/software/S0192) is publicly available on GitHub. (Citation: GitHub Pupy)",
      "meta": {
        "external_id": "S0192",
        "mitre_platforms": [
          "Linux",
          "Windows",
          "macOS",
          "Android"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0192",
          "https://github.com/n1nj4sec/pupy"
        ],
        "synonyms": [
          "Pupy"
        ]
      },
      "related": [
        {
          "dest-uuid": "bdb420be-5882-41c8-b439-02bbef69d83f",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "6495ae23-3ab4-43c5-a94f-5638a2c31fd2",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7b211ac6-c815-4189-93a9-ab415deca926",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "cb69b20d-56d0-41ab-8440-4a4b251614d4",
      "value": "Pupy - S0192"
    },
    {
      "description": "MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain.(Citation: GitHub MailSniper)",
      "meta": {
        "external_id": "S0413",
        "mitre_platforms": [
          "Office 365",
          "Windows",
          "Azure AD"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0413",
          "https://github.com/dafthack/MailSniper"
        ],
        "synonyms": [
          "MailSniper"
        ]
      },
      "related": [
        {
          "dest-uuid": "692074ae-bb62-4a5e-a735-02cb6bde458c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b4694861-542c-48ea-9eb1-10d356e7140a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "999c4e6e-b8dc-4b4f-8d6e-1b829f29997e",
      "value": "MailSniper - S0413"
    },
    {
      "description": "[Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)",
      "meta": {
        "external_id": "S0361",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0361",
          "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/expand",
          "http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"
        ],
        "synonyms": [
          "Expand"
        ]
      },
      "related": [
        {
          "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "ca656c25-44f1-471b-9d9f-e2a3bbb84973",
      "value": "Expand - S0361"
    },
    {
      "description": "[Tor](https://attack.mitre.org/software/S0183) is a software suite and network that provides increased anonymity on the Internet. It creates a multi-hop proxy network and utilizes multilayer encryption to protect both the message and routing information. [Tor](https://attack.mitre.org/software/S0183) utilizes \"Onion Routing,\" in which messages are encrypted with multiple layers of encryption; at each step in the proxy network, the topmost layer is decrypted and the contents forwarded on to the next node until it reaches its destination. (Citation: Dingledine Tor The Second-Generation Onion Router)",
      "meta": {
        "external_id": "S0183",
        "mitre_platforms": [
          "Linux",
          "Windows",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0183",
          "http://www.dtic.mil/dtic/tr/fulltext/u2/a465464.pdf"
        ],
        "synonyms": [
          "Tor"
        ]
      },
      "related": [
        {
          "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "ed7d0cb1-87a6-43b4-9f46-ef1bc56d6c68",
      "value": "Tor - S0183"
    },
    {
      "description": "[Forfiles](https://attack.mitre.org/software/S0193) is a Windows utility commonly used in batch jobs to execute commands on one or more selected files or directories (ex: list all directories in a drive, read the first line of all files created yesterday, etc.). Forfiles can be executed from either the command line, Run window, or batch files/scripts. (Citation: Microsoft Forfiles Aug 2016)",
      "meta": {
        "external_id": "S0193",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0193",
          "https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753551(v=ws.11)"
        ],
        "synonyms": [
          "Forfiles"
        ]
      },
      "related": [
        {
          "dest-uuid": "3b0e52ce-517a-4614-a523-1bd5deef6c5e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "90ec2b22-7061-4469-b539-0989ec4f96c2",
      "value": "Forfiles - S0193"
    },
    {
      "description": "Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. (Citation: GitHub Responder)",
      "meta": {
        "external_id": "S0174",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0174",
          "https://github.com/SpiderLabs/Responder"
        ],
        "synonyms": [
          "Responder"
        ]
      },
      "related": [
        {
          "dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "a1dd2dbd-1550-44bf-abcc-1a4c52e97719",
      "value": "Responder - S0174"
    },
    {
      "description": "[PowerSploit](https://attack.mitre.org/software/S0194) is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.org/techniques/T1086) modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. (Citation: GitHub PowerSploit May 2012) (Citation: PowerShellMagazine PowerSploit July 2014) (Citation: PowerSploit Documentation)",
      "meta": {
        "external_id": "S0194",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0194",
          "https://github.com/PowerShellMafia/PowerSploit",
          "http://www.powershellmagazine.com/2014/07/08/powersploit/",
          "http://powersploit.readthedocs.io"
        ],
        "synonyms": [
          "PowerSploit"
        ]
      },
      "related": [
        {
          "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "806a49c4-970d-43f9-9acc-ac0ee11e6662",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "341e222a-a6e3-4f6f-b69c-831d792b1580",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "8d7bd4f5-3a89-4453-9c82-2c8894d5655e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "c4ad009b-6e13-4419-8d21-918a1652de02",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b0533c6e-8fea-4788-874f-b799cacc4b92",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "0c2d00da-7742-49e7-9928-4514e5075d32",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "58af3705-8740-4c68-9329-ec015a7013c2",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf96a5a3-3bce-43b7-8597-88545984c07b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "13cd9151-83b7-410d-9f98-25d0f0d1d80d",
      "value": "PowerSploit - S0194"
    },
    {
      "description": "[meek](https://attack.mitre.org/software/S0175) is an open-source Tor plugin that tunnels Tor traffic through HTTPS connections.",
      "meta": {
        "external_id": "S0175",
        "mitre_platforms": [
          "Linux",
          "Windows",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0175"
        ],
        "synonyms": [
          "meek"
        ]
      },
      "related": [
        {
          "dest-uuid": "ca9d3402-ada3-484d-876a-d717bd6e05f2",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "65370d0b-3bd4-4653-8cf9-daf56f6be830",
      "value": "meek - S0175"
    },
    {
      "description": "[SDelete](https://attack.mitre.org/software/S0195) is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. (Citation: Microsoft SDelete July 2016)",
      "meta": {
        "external_id": "S0195",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0195",
          "https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete"
        ],
        "synonyms": [
          "SDelete"
        ]
      },
      "related": [
        {
          "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "d8d19e33-94fd-4aa3-b94a-08ee801a2153",
      "value": "SDelete - S0195"
    },
    {
      "description": "[MimiPenguin](https://attack.mitre.org/software/S0179) is a credential dumper, similar to [Mimikatz](https://attack.mitre.org/software/S0002), designed specifically for Linux platforms. (Citation: MimiPenguin GitHub May 2017)",
      "meta": {
        "external_id": "S0179",
        "mitre_platforms": [
          "Linux"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0179",
          "https://github.com/huntergregal/mimipenguin"
        ],
        "synonyms": [
          "MimiPenguin"
        ]
      },
      "related": [
        {
          "dest-uuid": "3120b9fa-23b8-4500-ae73-09494f607b7d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "5a33468d-844d-4b1f-98c9-0e786c556b27",
      "value": "MimiPenguin - S0179"
    },
    {
      "description": "[Havij](https://attack.mitre.org/software/S0224) is an automatic SQL Injection tool distributed by the Iranian ITSecTeam security company. Havij has been used by penetration testers and adversaries. (Citation: Check Point Havij Analysis)",
      "meta": {
        "external_id": "S0224",
        "mitre_platforms": [
          "Linux",
          "Windows",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0224",
          "https://blog.checkpoint.com/2015/05/14/analysis-havij-sql-injection-tool/"
        ],
        "synonyms": [
          "Havij"
        ]
      },
      "related": [
        {
          "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "fbd727ea-c0dc-42a9-8448-9e12962d1ab5",
      "value": "Havij - S0224"
    },
    {
      "description": "[sqlmap](https://attack.mitre.org/software/S0225) is an open source penetration testing tool that can be used to automate the process of detecting and exploiting SQL injection flaws. (Citation: sqlmap Introduction)",
      "meta": {
        "external_id": "S0225",
        "mitre_platforms": [
          "Linux",
          "Windows",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0225",
          "http://sqlmap.org/"
        ],
        "synonyms": [
          "sqlmap"
        ]
      },
      "related": [
        {
          "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "9a2640c2-9f43-46fe-b13f-bde881e55555",
      "value": "sqlmap - S0225"
    },
    {
      "description": "[QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that is publicly available on GitHub. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language. (Citation: GitHub QuasarRAT) (Citation: Volexity Patchwork June 2018)",
      "meta": {
        "external_id": "S0262",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0262",
          "https://github.com/quasar/QuasarRAT",
          "https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/",
          "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
        ],
        "synonyms": [
          "QuasarRAT",
          "xRAT"
        ]
      },
      "related": [
        {
          "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "da04ac30-27da-4959-a67d-450ce47d9470",
      "value": "QuasarRAT - S0262"
    },
    {
      "description": "[spwebmember](https://attack.mitre.org/software/S0227) is a Microsoft SharePoint enumeration and data dumping tool written in .NET. (Citation: NCC Group APT15 Alive and Strong)",
      "meta": {
        "external_id": "S0227",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0227",
          "https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"
        ],
        "synonyms": [
          "spwebmember"
        ]
      },
      "related": [
        {
          "dest-uuid": "0c4b4fda-9062-47da-98b9-ceae2dcf052a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "33b9e38f-103c-412d-bdcf-904a91fff1e4",
      "value": "spwebmember - S0227"
    },
    {
      "description": "[Remcos](https://attack.mitre.org/software/S0332) is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. [Remcos](https://attack.mitre.org/software/S0332) has been observed being used in malware campaigns.(Citation: Riskiq Remcos Jan 2018)(Citation: Talos Remcos Aug 2018)",
      "meta": {
        "external_id": "S0332",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0332",
          "https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/",
          "https://blog.talosintelligence.com/2018/08/picking-apart-remcos.html",
          "https://www.fortinet.com/blog/threat-research/remcos-a-new-rat-in-the-wild-2.html"
        ],
        "synonyms": [
          "Remcos"
        ]
      },
      "related": [
        {
          "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "7cd0bc75-055b-4098-a00e-83dc8beaff14",
      "value": "Remcos - S0332"
    },
    {
      "description": "[PoshC2](https://attack.mitre.org/software/S0378) is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in [PowerShell](https://attack.mitre.org/techniques/T1086). Although [PoshC2](https://attack.mitre.org/software/S0378) is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.(Citation: GitHub PoshC2)",
      "meta": {
        "external_id": "S0378",
        "mitre_platforms": [
          "Windows",
          "Linux",
          "macOS"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0378",
          "https://github.com/nettitude/PoshC2_Python"
        ],
        "synonyms": [
          "PoshC2"
        ]
      },
      "related": [
        {
          "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b6075259-dba3-44e9-87c7-e954f37ec0d5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "4b57c098-f043-4da2-83ef-7588a6d426bc",
      "value": "PoshC2 - S0378"
    },
    {
      "description": "[Xbot](https://attack.mitre.org/software/S0298) is an Android malware family that was observed in 2016 primarily targeting Android users in Russia and Australia. (Citation: PaloAlto-Xbot)",
      "meta": {
        "external_id": "S0298",
        "mitre_platforms": [
          "Android"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0298",
          "http://researchcenter.paloaltonetworks.com/2016/02/new-android-trojan-xbot-phishes-credit-cards-and-bank-accounts-encrypts-devices-for-ransom/"
        ],
        "synonyms": [
          "Xbot"
        ]
      },
      "related": [
        {
          "dest-uuid": "e683cd91-40b4-4e1c-be25-34a27610a22e",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "4cfa42a3-71d9-43e2-bf23-daa79f326387",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "5a78ec38-8b93-4dde-a99e-0c9b77674838",
          "tags": [
            "estimative-language:likelihood-probability=\"likely\""
          ],
          "type": "similar"
        },
        {
          "dest-uuid": "e8b4e1ec-8e3b-484c-9038-4459b1ed8060",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "9d7c32f4-ab39-49dc-8055-8106bc2294a1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3dd58c80-4c2e-458c-9503-1b2cd273c4d2",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d9e88203-2b5d-405f-a406-2933b1e3d7e4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "da21929e-40c0-443d-bdf4-6b60d15448b4",
      "value": "Xbot - S0298"
    },
    {
      "description": "[Empire](https://attack.mitre.org/software/S0363) is an open source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure [PowerShell](https://attack.mitre.org/techniques/T1086) for Windows and Python for Linux/macOS. [Empire](https://attack.mitre.org/software/S0363) was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.(Citation: NCSC Joint Report Public Tools)(Citation: Github PowerShell Empire)(Citation: GitHub ATTACK Empire)",
      "meta": {
        "external_id": "S0363",
        "mitre_platforms": [
          "Linux",
          "macOS",
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0363",
          "https://s3.eu-west-1.amazonaws.com/ncsc-content/files/Joint%20report%20on%20publicly%20available%20hacking%20tools%20%28NCSC%29.pdf",
          "https://github.com/PowerShellEmpire/Empire",
          "https://github.com/dstepanic/attck_empire"
        ],
        "synonyms": [
          "Empire",
          "EmPyre",
          "PowerShell Empire"
        ]
      },
      "related": [
        {
          "dest-uuid": "5e4a2073-9643-44cb-a0b5-e7f4048446c7",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "30973a08-aed9-4edf-8604-9084ce1b5c4f",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "768dce68-8d0d-477a-b01d-0eea98b963a1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "60b508a1-6a5e-46b1-821a-9f7b78752abf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f5946b5e-9408-485f-a7f7-b5efc88909b6",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "68a0c5ed-bee2-4513-830d-5b0d650139bd",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "70e52b04-2a0c-4cea-9d18-7149f1df9dc5",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "2fee9321-3e71-4cf4-af24-d4d40d355b34",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "5095a853-299c-4876-abd7-ac0050fb5462",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b7dc639b-24cd-482d-a7f1-8897eda21023",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f879d51c-5476-431c-aedf-f14d207e4d1e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "ebb42bbe-62d7-47d7-a55f-3b08b61d792d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "86a96bf6-cf8b-411c-aaeb-8959944d64f7",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "dcaa092b-7de9-4a21-977f-7fcb77e89c48",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d273434a-448e-4598-8e14-607f4a0d5e27",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "25659dd6-ea12-45c4-97e6-381e3e4b593e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "0c2d00da-7742-49e7-9928-4514e5075d32",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "58af3705-8740-4c68-9329-ec015a7013c2",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf96a5a3-3bce-43b7-8597-88545984c07b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "c92e3d68-2349-49e4-a341-7edca2deff96",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3",
      "value": "Empire - S0363"
    },
    {
      "description": "[RawDisk](https://attack.mitre.org/software/S0364) is a legitimate commercial driver from the EldoS Corporation that is used for interacting with files, disks, and partitions. The driver allows for direct modification of data on a local computer's hard drive. In some cases, the tool can enact these raw disk modifications from user-mode processes, circumventing Windows operating system security features.(Citation: EldoS RawDisk ITpro)(Citation: Novetta Blockbuster Destructive Malware)",
      "meta": {
        "external_id": "S0364",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0364",
          "https://www.itprotoday.com/windows-78/eldos-provides-raw-disk-access-vista-and-xp",
          "https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"
        ],
        "synonyms": [
          "RawDisk"
        ]
      },
      "related": [
        {
          "dest-uuid": "0af0ca99-357d-4ba1-805f-674fdfb7bef9",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "fb640c43-aa6b-431e-a961-a279010424ac",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "3ffbdc1f-d2bf-41ab-91a2-c7b857e98079",
      "value": "RawDisk - S0364"
    },
    {
      "description": "[LaZagne](https://attack.mitre.org/software/S0349) is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. [LaZagne](https://attack.mitre.org/software/S0349) is publicly available on GitHub.(Citation: GitHub LaZagne Dec 2018)",
      "meta": {
        "external_id": "S0349",
        "mitre_platforms": [
          "Linux",
          "macOS",
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0349",
          "https://github.com/AlessandroZ/LaZagne"
        ],
        "synonyms": [
          "LaZagne"
        ]
      },
      "related": [
        {
          "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "58a3e6aa-4453-4cc8-a51f-4befe80b31a8",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1eaebf46-e361-4437-bc23-d5d65a3b92e3",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3120b9fa-23b8-4500-ae73-09494f607b7d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "d0b4fcdb-d67d-4ed2-99ce-788b12f8c0f4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "b76b2d94-60e4-4107-a903-4a3a7622fb3b",
      "value": "LaZagne - S0349"
    },
    {
      "description": "[Impacket](https://attack.mitre.org/software/S0357) is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. [Impacket](https://attack.mitre.org/software/S0357) contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.(Citation: Impacket Tools)",
      "meta": {
        "external_id": "S0357",
        "mitre_platforms": [
          "Linux",
          "macOS",
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0357",
          "https://www.secureauth.com/labs/open-source-tools/impacket"
        ],
        "synonyms": [
          "Impacket"
        ]
      },
      "related": [
        {
          "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f2877f7f-9a4c-4251-879f-1224e3006bee",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "f1951e8a-500e-4a26-8803-76d95c4554b4",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "26c87906-d750-42c5-946c-d4162c73fc7b",
      "value": "Impacket - S0357"
    },
    {
      "description": "[Ruler](https://attack.mitre.org/software/S0358) is a tool to abuse Microsoft Exchange services. It is publicly available on GitHub and the tool is executed via the command line. The creators of [Ruler](https://attack.mitre.org/software/S0358) have also released a defensive tool, NotRuler, to detect its usage.(Citation: SensePost Ruler GitHub)(Citation: SensePost NotRuler)",
      "meta": {
        "external_id": "S0358",
        "mitre_platforms": [
          "Windows",
          "Office 365"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0358",
          "https://github.com/sensepost/ruler",
          "https://github.com/sensepost/notruler"
        ],
        "synonyms": [
          "Ruler"
        ]
      },
      "related": [
        {
          "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "bf147104-abf9-4221-95d1-e81585859441",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "3d1b9d7e-3921-4d25-845a-7d9f15c0da44",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "a9e2cea0-c805-4bf8-9e31-f5f0513a3634",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "90ac9266-68ce-46f2-b24f-5eb3b2a8ea38",
      "value": "Ruler - S0358"
    },
    {
      "description": "[Nltest](https://attack.mitre.org/software/S0359) is a Windows command-line utility used to list domain controllers and enumerate domain trusts.(Citation: Nltest Manual)",
      "meta": {
        "external_id": "S0359",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0359",
          "https://ss64.com/nt/nltest.html"
        ],
        "synonyms": [
          "Nltest"
        ]
      },
      "related": [
        {
          "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "981acc4c-2ede-4b56-be6e-fa1a75f37acf",
      "value": "Nltest - S0359"
    },
    {
      "description": "[ShimRatReporter](https://attack.mitre.org/software/S0445) is a tool used by suspected Chinese adversary [Mofang](https://attack.mitre.org/groups/G0103) to automatically conduct initial discovery. The details from this discovery are used to customize follow-on payloads (such as [ShimRat](https://attack.mitre.org/software/S0444)) as well as set up faux infrastructure which mimics the adversary's targets. [ShimRatReporter](https://attack.mitre.org/software/S0445) has been used in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development.(Citation: FOX-IT May 2016 Mofang)",
      "meta": {
        "external_id": "S0445",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0445",
          "https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"
        ],
        "synonyms": [
          "ShimRatReporter"
        ]
      },
      "related": [
        {
          "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "774a3188-6ba9-4dc4-879d-d54ee48a5ce9",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "115f88dd-0618-4389-83cb-98d33ae81848",
      "value": "ShimRatReporter - S0445"
    },
    {
      "description": "[CARROTBALL](https://attack.mitre.org/software/S0465) is an FTP downloader utility that has been in use since at least 2019. [CARROTBALL](https://attack.mitre.org/software/S0465) has been used as a downloader to install [SYSCON](https://attack.mitre.org/software/S0464).(Citation: Unit 42 CARROTBAT January 2020)",
      "meta": {
        "external_id": "S0465",
        "mitre_platforms": [
          "Windows"
        ],
        "refs": [
          "https://attack.mitre.org/software/S0465",
          "https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/"
        ],
        "synonyms": [
          "CARROTBALL"
        ]
      },
      "related": [
        {
          "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        },
        {
          "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a",
          "tags": [
            "estimative-language:likelihood-probability=\"almost-certain\""
          ],
          "type": "uses"
        }
      ],
      "uuid": "5fc81b43-62b5-41b1-9113-c79ae5f030c4",
      "value": "CARROTBALL - S0465"
    }
  ],
  "version": 18
}