Real-world descriptions of how a group, tool or campaign used a technique.
10 examples
| Technique | Used by | Procedure example |
|---|---|---|
| T1546.003 Windows Management Instrumentation Event Subscription |
GroupMustang Panda | Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence. |
| T1546.003 Windows Management Instrumentation Event Subscription |
GroupLeviathan | Leviathan has used WMI for persistence. |
| T1546.003 Windows Management Instrumentation Event Subscription |
GroupBlue Mockingbird | Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file. |
| T1546.003 Windows Management Instrumentation Event Subscription |
GroupTurla | Turla has used WMI event filters and consumers to establish persistence. |
| T1546.003 Windows Management Instrumentation Event Subscription |
GroupAPT29 | APT29 has used WMI event subscriptions for persistence. |
| T1546.003 Windows Management Instrumentation Event Subscription |
GroupMetador | Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as `cdb.exe`. |
| T1546.003 Windows Management Instrumentation Event Subscription |
GroupHEXANE | HEXANE has used WMI event subscriptions for persistence. |
| T1546.003 Windows Management Instrumentation Event Subscription |
GroupRancor | Rancor has complied VBScript-generated MOF files into WMI event subscriptions for persistence. |
| T1546.003 Windows Management Instrumentation Event Subscription |
GroupAPT33 | APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts. |
| T1546.003 Windows Management Instrumentation Event Subscription |
GroupFIN8 | FIN8 has used WMI event subscriptions for persistence. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
