Real-world descriptions of how a group, tool or campaign used a technique.
203 examples
| Technique | Used by | Procedure example |
|---|---|---|
| T1106 Native API |
ToolImminent Monitor | Imminent Monitor has leveraged CreateProcessW() call to execute the debugger. |
| T1106 Native API |
ToolDonut | Donut code modules use various API functions to load and inject code. |
| T1106 Native API |
MalwareZeroCleare | ZeroCleare can call the `GetSystemDirectoryW` API to locate the system directory. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
