Reports, blog posts and papers that MITRE cites as evidence.
3865 references
| Citation | Description |
|---|---|
| EclecticIQ Mustang Panda PlugX | EclecticIQ Threat Research Team. (2023, February 2). Mustang Panda APT Group Uses European Commission-Themed Lure to Deliver PlugX Malware. Retrieved September 9, 2025. |
| EclecticLightChecksonEXECodeSigning | Howard Oakley. (2020, November 16). Checks on executable code in Catalina and Big Sur: a first draft. Retrieved September 21, 2022. |
| Eclypsium Trickboot December 2020 | Eclypsium, Advanced Intelligence. (2020, December 1). TRICKBOT NOW OFFERS ‘TRICKBOOT’: PERSIST, BRICK, PROFIT. Retrieved March 15, 2021. |
| EduardosBlog SIPs July 2008 | Navarro, E. (2008, July 11). SIP’s (Subject Interface Package) and Authenticode. Retrieved January 31, 2018. |
| Elastic Binary Executed from Shared Memory Directory | Elastic. (n.d.). Binary Executed from Shared Memory Directory. Retrieved September 24, 2024. |
| Elastic CUBA Ransomware 2022 | Daniel Stepanic, Derek Ditch, Seth Goodwin, Salim Bitam, Andrew Pease. (2022, September 7). CUBA Ransomware Campaign Analysis. Retrieved August 5, 2024. |
| Elastic HuntingNMemory June 2017 | Desimone, J. (2017, June 13). Hunting in Memory. Retrieved December 7, 2017. |
| Elastic Latrodectus May 2024 | Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024. |
| Elastic Linux Persistence 2024 | Ruben Groenewoud. (2024, August 29). Linux Detection Engineering - A Sequel on Persistence Mechanisms. Retrieved October 16, 2024. |
| Elastic Masquerade Ball | Ewing, P. (2016, October 31). How to Hunt: The Masquerade Ball. Retrieved October 31, 2016. |
| Elastic Pikabot 2024 | Daniel Stepanic & Salim Bitam. (2024, February 23). PIKABOT, I choose you!. Retrieved July 12, 2024. |
| Elastic Process Injection July 2017 | Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017. |
| Elastic Rules macOS launchctl 2022 | Elastic Security 7.17. (2022, February 1). Modification of Environment Variable via Launchctl. Retrieved September 28, 2023. |
| Elastic Security Labs | Joe Desimone. (2024, August 5). Dismantling Smart App Control. Retrieved March 21, 2025. |
| Elastic Security Labs GOSAR 2024 | Jia Yu Chan, Salim Bitam, Daniel Stepanic, and Seth Goodwin. (2024, December 12). Under the SADBRIDGE with GOSAR: QUASAR Gets a Golang Rewrite. Retrieved May 22, 2025. |
| Elastic Security Labs Linux Persistence 2024 | Ruben Groenewoud. (2024, August 20). Linux Detection Engineering - A primer on persistence mechanisms. Retrieved March 18, 2025. |
| Elastic Security Labs Pumakit 2024 | Remco Sprooten and Ruben Groenewoud. (2024, December 11). Declawing PUMAKIT. Retrieved March 24, 2025. |
| EldoS RawDisk ITpro | Edwards, M. (2007, March 14). EldoS Provides Raw Disk Access for Vista and XP. Retrieved March 26, 2019. |
| ElecticIQ Buyukkaya_ShinyHunters_Sept2025 | Büyükkaya, A. (2025, September 22). ShinyHunters Calling: Financially Motivated Data Extortion Group Targeting Enterprise Cloud Applications. Retrieved May 18, 2026. |
| Electron 1 | TOM ABAI. (2023, August 10). There’s a New Stealer Variant in Town, and It’s Using Electron to Stay Fully Undetected. Retrieved March 7, 2024. |
| Electron 2 | Trend Micro. (2023, June 6). Abusing Electronbased applications in targeted attacks. Retrieved March 7, 2024. |
| Electron 3 | Alanna Titterington. (2023, September 14). Security of Electron-based desktop applications. Retrieved March 7, 2024. |
| Electron 6-8 | Kosayev, U. (2023, June 15). One Electron to Rule Them All. Retrieved March 7, 2024. |
| Electron Security | ElectronJS.org. (n.d.). Retrieved March 7, 2024. |
| Emissary Trojan Feb 2016 | Falcone, R. and Miller-Osborn, J. (2016, February 3). Emissary Trojan Changelog: Did Operation Lotus Blossom Cause It to Evolve?. Retrieved February 15, 2016. |
| Emotet Deploys TrickBot | Cybereason Nocturnus. (n.d.). Triple Threat: Emotet Deploys TrickBot to Steal Data & Spread Ryuk. Retrieved November 28, 2023. |
| Empire InvokeKerberoast Oct 2016 | EmpireProject. (2016, October 31). Invoke-Kerberoast.ps1. Retrieved March 22, 2018. |
| Empire Keychain Decrypt | Empire. (2018, March 8). Empire keychaindump_decrypt Module. Retrieved April 14, 2022. |
| Endurant CMSTP July 2018 | Seetharaman, N. (2018, July 7). Detecting CMSTP-Enabled Code Execution and UAC Bypass With Sysmon.. Retrieved November 17, 2024. |
| Enigma DCOM Lateral Movement Jan 2017 | Nelson, M. (2017, January 23). Lateral Movement via DCOM: Round 2. Retrieved November 21, 2017. |
| Enigma Excel DCOM Sept 2017 | Nelson, M. (2017, September 11). Lateral Movement using Excel.Application and DCOM. Retrieved November 21, 2017. |
| Enigma MMC20 COM Jan 2017 | Nelson, M. (2017, January 5). Lateral Movement using the MMC20 Application COM Object. Retrieved November 21, 2017. |
| Enigma Outlook DCOM Lateral Movement Nov 2017 | Nelson, M. (2017, November 16). Lateral Movement using Outlook's CreateObject Method and DotNetToJScript. Retrieved November 21, 2017. |
| Enigma Phishing for Credentials Jan 2015 | Nelson, M. (2015, January 21). Phishing for Credentials: If you want it, just ask!. Retrieved December 17, 2018. |
| Enigma Reviving DDE Jan 2018 | Nelson, M. (2018, January 29). Reviving DDE: Using OneNote and Excel for Code Execution. Retrieved February 3, 2018. |
| Enigma0x3 PubPrn Bypass | Nelson, M. (2017, August 3). WSH INJECTION: A CASE STUDY. Retrieved April 9, 2018. |
| EnkiWhiteHat_KimsukyDOCSWAP_Dec2025 | EnkiWhiteHat. (2025, December 16). Kimsuky Distributing Malicious Mobile App via QR Code. Retrieved January 8, 2026. |
| Ensilo Darkgate 2018 | Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024. |
| Entra Managed Identities 2025 | Microsoft Entra. (2025, February 27). How to use managed identities for Azure resources on an Azure VM to acquire an access token. Retrieved March 18, 2025. |
| Environmental Keyed HTA | Warren, R. (2017, August 8). Smuggling HTA files in Internet Explorer/Edge. Retrieved November 17, 2024. |
| Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 | eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025. |
| Eset PlugX Korplug Mustang Panda March 2022 | Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025. |
| Eset Ramsay May 2020 | Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020. |
| Establishing persistence using extended attributes on Linux | Irem Kuyucu. (2024, August 6). Establishing persistence using extended attributes on Linux. Retrieved March 27, 2025. |
| Europol Cobalt Mar 2018 | Europol. (2018, March 26). Mastermind Behind EUR 1 Billion Cyber Bank Robbery Arrested in Spain. Retrieved October 10, 2018. |
| Europol Deepfakes | Europol. (2022). FACING REALITY? LAW ENFORCEMENT AND THE CHALLENGE OF DEEPFAKES. Retrieved April 17, 2026. |
| EventLog_Core_Technologies | Core Technologies. (2021, May 24). Essential Windows Services: EventLog / Windows Event Log. Retrieved September 14, 2021. |
| Evi1cg Forfiles Nov 2017 | Evi1cg. (2017, November 26). block cmd.exe ? try this :. Retrieved September 12, 2024. |
| Evil Clippy May 2019 | Hegt, S. (2019, May 5). Evil Clippy: MS Office maldoc assistant. Retrieved September 17, 2020. |
| Evilginx 2 July 2018 | Gretzky, K.. (2018, July 26). Evilginx 2 - Next Generation of Phishing 2FA Tokens. Retrieved October 14, 2019. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
