Real-world descriptions of how a group, tool or campaign used a technique.
53 examples
| Technique | Used by | Procedure example |
|---|---|---|
| T1602.002 Network Device Configuration Dump |
Campaign2025 Poland Wiper Attacks | During the 2025 Poland Wiper Attacks, the adversaries gathered and used the FortiGate bookmarks defined in the configuration file to include the statically defined credentials that facilitated RDP connections to jump hosts. |
| T1608.002 Upload Tool |
Campaign2025 Poland Wiper Attacks | During the 2025 Poland Wiper Attacks, the adversaries had staged tools and files for use on Dropbox and Pastebin. |
| T1686.002 Network Device Firewall |
Campaign2025 Poland Wiper Attacks | During the 2025 Poland Wiper Attacks, the adversaries modified security settings within the victims Fortigate device, utilizing the native CLI. During the 2025 Poland Wiper Attacks, the adversaries also disabled network traffic logging. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
