Reports, blog posts and papers that MITRE cites as evidence.
3865 references
| Citation | Description |
|---|---|
| Dark Reading | Kelly Sheridan. (2021, August 5). Retrieved April 15, 2026. |
| Dark Reading Code Spaces Cyber Attack | Brian Prince. (2014, June 20). Code Hosting Service Shuts Down After Cyber Attack. Retrieved March 21, 2023. |
| Dark Vortex Brute Ratel C4 | Dark Vortex. (n.d.). A Customized Command and Control Center for Red Team and Adversary Simulation. Retrieved February 7, 2023. |
| DarkReading FireEye FIN5 Oct 2015 | Higgins, K. (2015, October 13). Prolific Cybercrime Gang Favors Legit Login Credentials. Retrieved October 4, 2017. |
| DarkReading FireEye SolarWinds | Kelly Jackson Higgins. (2021, January 7). FireEye's Mandia: 'Severity-Zero Alert' Led to Discovery of SolarWinds Attack. Retrieved April 18, 2022. |
| DarkSide Ransomware Gang | Ramarcus Baylor. (2021, May 12). DarkSide Ransomware Gang: An Overview. Retrieved August 30, 2022. |
| Darkside Ransomware Cybereason | Cybereason Nocturnus. (2021, April 1). Cybereason vs. Darkside Ransomware. Retrieved August 18, 2021. |
| Data Destruction - Threat Post | Mimoso, M.. (2014, June 18). Hacker Puts Hosting Service Code Spaces Out of Business. Retrieved December 15, 2020. |
| Datadog Contagious Interview Tenacious Pungsan October 2024 | Ian Kretz, Sebastian Obregoso, Datadog Security Research Team. (2024, October 24). Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview. Retrieved October 20, 2025. |
| Datadog S3 Lifecycle CloudTrail Logs | Stratus Red Team. (n.d.). CloudTrail Logs Impairment Through S3 Lifecycle Rule. Retrieved September 25, 2024. |
| Datadog Security Labs Cloud Persistence 2025 | Martin McCloskey. (2025, May 13). Tales from the cloud trenches: The Attacker doth persist too much, methinks. Retrieved May 22, 2025. |
| Datadog Security Labs Malicious PyPi Packages 2024 | Sebastian Obregoso and Christophe Tafani-Dereeper. (2024, May 23). Malicious PyPI packages targeting highly specific MacOS machines. Retrieved May 22, 2025. |
| Daveshell sRDI GitHub shell code loader | Nick Landers (monoxgas). (2022, June 18). GitHub monoxgas sRDI (DAVESHELL). Retrieved October 1, 2025. |
| Davidson Windows | Davidson, L. (n.d.). Windows 7 UAC whitelist. Retrieved November 12, 2014. |
| Death by 1000 installers; it's all broken! | Patrick Wardle. (2017). Death by 1000 installers; it's all broken!. Retrieved August 8, 2019. |
| Debian Manual Maintainer Scripts | Debian Policy Manual v4.6.1.1. (2022, August 14). Package maintainer scripts and installation procedure. Retrieved September 27, 2022. |
| Debian nbtscan Nov 2019 | Bezroutchko, A. (2019, November 19). NBTscan man page. Retrieved March 17, 2021. |
| Deep Instinct BPFDoor 2023 | Shaul Vilkomir-Preisman and Eliran Nissan. (2023, May 10). BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game. Retrieved September 19, 2024. |
| Deep Instinct Black Basta August 2022 | Vilkomir-Preisman, S. (2022, August 18). Beating Black Basta Ransomware. Retrieved March 8, 2023. |
| Deep Instinct LSASS | Gilboa, A. (2021, February 16). LSASS Memory Dumps are Stealthier than Ever Before - Part 2. Retrieved December 27, 2023. |
| Deep Instinct TA505 Apr 2019 | Vilkomir-Preisman, S. (2019, April 2). New ServHelper Variant Employs Excel 4.0 Macro to Drop Signed Payload. Retrieved September 16, 2024.. |
| Default VBS macros Blocking | Kellie Eickmeyer. (2022, February 7). Helping users stay safe: Blocking internet macros by default in Office. Retrieved February 7, 2022. |
| Defending Against Scheduled Task Attacks in Windows Environments | Harshal Tupsamudre. (2022, June 20). Defending Against Scheduled Tasks. Retrieved July 5, 2022. |
| Dell Dridex Oct 2015 | Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019. |
| Dell Lateral Movement | Carvey, H.. (2014, September 2). Where you AT?: Indicators of lateral movement using at.exe on Windows 7 systems. Retrieved January 25, 2016. |
| Dell P2P ZeuS | SecureWorks. (2012). The Lifecycle of Peer-to-Peer (Gameover) ZeuS. Retrieved August 19, 2015. |
| Dell Sakula | Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, July 30). Sakula Malware Family. Retrieved January 26, 2016. |
| Dell Skeleton | Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis. Retrieved April 8, 2019. |
| Dell TG-1314 | Dell SecureWorks Counter Threat Unit Special Operations Team. (2015, May 28). Living off the Land. Retrieved January 26, 2016. |
| Dell TG-3390 | Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018. |
| Dell Threat Group 2889 | Dell SecureWorks. (2015, October 7). Suspected Iran-Based Hacker Group Creates Network of Fake LinkedIn Profiles. Retrieved January 14, 2016. |
| Dell WMI Persistence | Dell SecureWorks Counter Threat Unit™ (CTU) Research Team. (2016, March 28). A Novel WMI Persistence Implementation. Retrieved March 30, 2016. |
| Dell Wiper | Dell SecureWorks. (2013, March 21). Wiper Malware Analysis Attacking Korean Financial Sector. Retrieved May 13, 2015. |
| Deloitte Environment Awareness | Torello, A. & Guibernau, F. (n.d.). Environment Awareness. Retrieved September 13, 2024. |
| Delpy Mimikatz Crendential Manager | Delpy, B. (2017, December 12). howto ~ credential manager saved credentials. Retrieved November 23, 2020. |
| Demaske Netsh Persistence | Demaske, M. (2016, September 23). USING NETSHELL TO EXECUTE EVIL DLLS AND PERSIST ON A HOST. Retrieved April 8, 2017. |
| Demiguise Guardrail Router Logo | Warren, R. (2017, August 2). Demiguise: virginkey.js. Retrieved January 17, 2019. |
| Demystifying Azure AD Service Principals | Bellavance, Ned. (2019, July 16). Demystifying Azure AD Service Principals. Retrieved January 19, 2020. |
| Deply Mimikatz | Deply, B. (n.d.). Mimikatz. Retrieved September 29, 2015. |
| Dept. of Treasury Iran Sanctions September 2020 | Dept. of Treasury. (2020, September 17). Treasury Sanctions Cyber Actors Backed by Iranian Intelligence. Retrieved December 10, 2020. |
| Designing Daemons Apple Dev | Apple. (n.d.). Retrieved October 12, 2021. |
| Detectify Slack Tokens | Detectify. (2016, April 28). Slack bot token leakage exposing business critical information. Retrieved November 17, 2024. |
| Detecting Command & Control in the Cloud | Gary Golomb. (n.d.). Threat Hunting Series: Detecting Command & Control in the Cloud. Retrieved July 8, 2022. |
| Detecting Rclone | Aaron Greetham. (2021, May 27). Detecting Rclone – An Effective Tool for Exfiltration. Retrieved August 30, 2022. |
| Didier Stevens WebDAV Traffic | Stevens, D. (2017, November 13). WebDAV Traffic To Malicious Sites. Retrieved December 21, 2017. |
| DidierStevens SelectMyParent Nov 2009 | Stevens, D. (2009, November 22). Quickpost: SelectMyParent or Playing With the Windows Process Tree. Retrieved June 3, 2019. |
| DieNet Bash | die.net. (n.d.). bash(1) - Linux man page. Retrieved June 12, 2020. |
| DigiCert Install SSL Cert | DigiCert. (n.d.). How to Install an SSL Certificate. Retrieved April 19, 2021. |
| DigiTrust Agent Tesla Jan 2017 | The DigiTrust Group. (2017, January 12). The Rise of Agent Tesla. Retrieved November 5, 2018. |
| DigiTrust NanoCore Jan 2017 | The DigiTrust Group. (2017, January 01). NanoCore Is Not Your Average RAT. Retrieved November 9, 2018. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
