Reports, blog posts and papers that MITRE cites as evidence.
3865 references
| Citation | Description |
|---|---|
| ExchangePowerShell Module | Microsoft. (2017, September 25). ExchangePowerShell. Retrieved June 10, 2022. |
| Executable Installers are Vulnerable | Stefan Kanthak. (2015, December 8). Executable installers are vulnerable^WEVIL (case 7): 7z*.exe allows remote code execution with escalation of privilege. Retrieved December 4, 2014. |
| Expel AWS | Anthony Randazzo, Britton Manahan, Sam Lipton. (2020, April 28). Managed Detection & Response for AWS. Retrieved April 15, 2026. |
| Expel AWS Attacker | Brian Bahtiarian, David Blanton, Britton Manahan and Kyle Pellett. (2022, April 5). Incident report: From CLI to console, chasing an attacker in AWS. Retrieved April 7, 2022. |
| Expel Atlas Lion 2025 | Ben Nahorney and Jennifer Maynard. (2025, April 10). Observing Atlas Lion (part one): Why take control when you can enroll?. Retrieved May 22, 2025. |
| Expel Behind the Scenes | S. Lipton, L. Easterly, A. Randazzo and J. Hencinski. (2020, July 28). Behind the scenes in the Expel SOC: Alert-to-fix in AWS. Retrieved October 1, 2020. |
| Expel IO Evil in AWS | A. Randazzo, B. Manahan and S. Lipton. (2020, April 28). Finding Evil in AWS. Retrieved June 25, 2020. |
| Exploit Database | Offensive Security. (n.d.). Exploit Database. Retrieved October 15, 2020. |
| Exploit Monday WinDbg | Graeber, M. (2016, August 15). Bypassing Application Whitelisting by using WinDbg/CDB as a Shellcode Runner. Retrieved November 17, 2024. |
| ExploitDB GoogleHacking | Offensive Security. (n.d.). Google Hacking Database. Retrieved October 23, 2020. |
| Exploiting Smartphone USB | Zhaohui Wang & Angelos Stavrou. (n.d.). Exploiting Smart-Phone USB Connectivity For Fun And Profit. Retrieved May 25, 2022. |
| ExpressVPN PATH env Windows 2021 | ExpressVPN Security Team. (2021, November 16). Cybersecurity lessons: A PATH vulnerability in Windows. Retrieved September 28, 2023. |
| ExtensionTotal VSCode Extensions 2025 | Yuval Ronen. (2025, April 4). Mining in Plain Sight: The VS Code Extension Cryptojacking Campaign. Retrieved April 8, 2025. |
| External to DA, the OS X Way | Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to DA, the OS X Way. Retrieved September 12, 2024. |
| Eye Research ToolShell JUL 2025 | Eye Security. (2025, July 19). SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704). Retrieved October 15, 2025. |
| F-Secure BlackEnergy 2014 | F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016. |
| F-Secure Cosmicduke | F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014. |
| F-Secure CozyDuke | F-Secure Labs. (2015, April 22). CozyDuke: Malware Analysis. Retrieved December 10, 2015. |
| F-Secure Lazarus Cryptocurrency Aug 2020 | F-Secure Labs. (2020, August 18). Lazarus Group Campaign Targeting the Cryptocurrency Vertical. Retrieved September 1, 2020. |
| F-Secure Sofacy 2015 | F-Secure. (2015, September 8). Sofacy Recycles Carberp and Metasploit Code. Retrieved August 3, 2016. |
| F-Secure The Dukes | F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015. |
| FBI 2025 AI Generate Content | Internet Crime Complaint Center, FBI. (2025). Federal Bureau of Investigation Internet Crime Report, 2025. Retrieved April 17, 2026. |
| FBI BlackByte 2022 | US Federal Bureau of Investigation & US Secret Service. (2022, February 11). Indicators of Compromise Associated with BlackByte Ransomware. Retrieved December 16, 2024. |
| FBI FLASH APT39 September 2020 | FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020. |
| FBI Flash Diavol January 2022 | FBI. (2022, January 19). Indicators of Compromise Associated with Diavol. Retrieved November 17, 2024. |
| FBI Flash FIN7 USB | The Record. (2022, January 7). FBI: FIN7 hackers target US companies with BadUSB devices to install ransomware. Retrieved January 14, 2022. |
| FBI IC3 Alert I-052126 Kali365 May 2026 | Federal Bureau of Investigation. (2026, May 21). Alert Number: I-052126-PSA: Kali365 Phishing-as-a-Service Kit Hijacks Microsoft 365 Access Tokens. Retrieved July 30, 2026. |
| FBI IC3 Flash VOID MANTICORE Handala Hack March 2026 | FBI. (2026, March 20). FBI Flash: FLASH-20260320-001:Government of Iran Cyber Actors Deploy Telegram C2 to Push Malware to Identified Targets. Retrieved April 20, 2026. |
| FBI Lockbit 2.0 FEB 2022 | FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025. |
| FBI Proxies Credential Stuffing | FBI. (2022, August 18). Proxies and Configurations Used for Credential Stuffing Attacks on Online Customer Accounts . Retrieved July 6, 2023. |
| FBI Ragnar Locker 2020 | FBI. (2020, November 19). Indicators of Compromise Associated with Ragnar Locker Ransomware. Retrieved September 12, 2024. |
| FBI Salesforce Data Theft SEP 2025 | FBI Cyber Division. (2025, September 12). Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and Extortion. Retrieved October 22, 2025. |
| FBI TeamPCP JUL 2026 | FBI. (2026, July 2). Cyber Criminal Group TeamPCP. Retrieved July 7, 2026. |
| FBI-BEC | FBI. (2022). FBI 2022 Congressional Report on BEC and Real Estate Wire Fraud. Retrieved August 18, 2023. |
| FBI-ransomware | FBI. (n.d.). Ransomware. Retrieved August 18, 2023. |
| FBI-search | FBI. (2022, December 21). Cyber Criminals Impersonating Brands Using Search Engine Advertisement Services to Defraud Users. Retrieved February 21, 2023. |
| FBI_KimsukyQR_Jan2026 | FBI. (2026, January 8). FBI Flash AC-000001-MW North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities. Retrieved April 18, 2026. |
| FBI_SHLMS_May2026 | Federal Bureau of Investigation. (2026, May 15). ShinyHunters: Cyber Criminal Group Attacks Learning Management System. Retrieved July 1, 2026. |
| FOX-IT May 2016 Mofang | Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020. |
| FRP GitHub | fatedier. (n.d.). What is frp?. Retrieved July 10, 2024. |
| FSI Andariel Campaign Rifle July 2017 | FSI. (2017, July 27). Campaign Rifle - Andariel, the Maiden of Anguish. Retrieved September 12, 2024. |
| FSISAC FraudNetDoS September 2012 | FS-ISAC. (2012, September 17). Fraud Alert – Cyber Criminals Targeting Financial Institution Employee Credentials to Conduct Wire Transfer Fraud. Retrieved September 23, 2024. |
| FSecure Hupigon | FSecure. (n.d.). Backdoor - W32/Hupigon.EMV - Threat Description. Retrieved December 18, 2017. |
| FSecure Lokibot November 2019 | Kazem, M. (2019, November 25). Trojan:W32/Lokibot. Retrieved May 15, 2020. |
| Facad1ng | Spyboy. (2023). Facad1ng. Retrieved February 13, 2024. |
| Falcon Sandbox smp: 28553b3a9d | Hybrid Analysis. (2018, July 11). HybridAnalsysis of sample 28553b3a9d2ad4361d33d29ac4bf771d008e0073cec01b5561c6348a608f8dd7. Retrieved September 8, 2023. |
| FalconFeeds_Iran_Mar2026 | FalconFeeds.io. (2026, March 5). The Digital Redoubt: Iran’s National Information Network and the Asymmetry of Modern Cyber Conflict. Retrieved March 9, 2026. |
| FalconFeeds_MuddyWaterPSRust_Mar2026 | FalconFeeds.io. (2026, March 6). MuddyWater in the Iran–Israel Cyber War: From PowerShell Scripts to Rust Implants. Retrieved March 12, 2026. |
| Fast Flux - Welivesecurity | Albors, Josep. (2017, January 12). Fast Flux networks: What are they and how do they work?. Retrieved March 11, 2020. |
| Fidelis Hi-Zor | Fidelis Threat Research Team. (2016, January 27). Introducing Hi-Zor RAT. Retrieved March 24, 2016. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
