Reports, blog posts and papers that MITRE cites as evidence.
3865 references
| Citation | Description |
|---|---|
| Github Covenant | cobbr. (2021, April 21). Covenant. Retrieved September 4, 2024. |
| Github EmpireProject CreateHijacker Dylib | Wardle, P., Ross, C. (2018, April 8). EmpireProject Create Dylib Hijacker. Retrieved April 1, 2021. |
| Github EmpireProject HijackScanner | Wardle, P., Ross, C. (2017, September 21). Empire Project Dylib Hijack Vulnerability Scanner. Retrieved April 1, 2021. |
| Github KeeThief | Lee, C., Schoreder, W. (n.d.). KeeThief. Retrieved February 8, 2021. |
| Github Koadic | Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024. |
| Github Netsh Helper CS Beacon | Smeets, M. (2016, September 26). NetshHelperBeacon. Retrieved February 13, 2017. |
| Github NoRunDll | gtworek. (2019, December 17). NoRunDll. Retrieved August 23, 2021. |
| Github PSAttack | Haight, J. (2016, April 21). PS>Attack. Retrieved September 27, 2024. |
| Github PowerShell Empire | Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016. |
| Github PowerSploit Ninjacopy | Bialek, J. (2015, December 16). Invoke-NinjaCopy.ps1. Retrieved June 2, 2016. |
| Github Rapid7 Meterpreter Elevate | Rapid7. (2013, November 26). meterpreter/source/extensions/priv/server/elevate/. Retrieved July 8, 2018. |
| Github TruffleSecurity Trufflehog April 2025 | Trufflesecurity. (2026, April 8). TruffleHog Enterprise. Retrieved April 15, 2026. |
| Github UACMe | UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016. |
| Github W32Time Oct 2017 | Lundgren, S. (2017, October 28). w32time. Retrieved March 26, 2018. |
| Github evilginx2 | Gretzky, Kuba. (2019, April 10). Retrieved October 8, 2019. |
| Github_SILENTTRINITY | byt3bl33d3r. (n.d.). SILENTTRINITY. Retrieved September 12, 2024. |
| GlassWorm - Unicode | Idan Dardikman. (2025, October 18). GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace. Retrieved April 21, 2026. |
| Glitch-Cat Green Lambert ATTCK Oct 2021 | Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024. |
| GlobalDotName Jun 2019 | Shukrun, S. (2019, June 2). Office Templates and GlobalDotName - A Stealthy Office Persistence Technique. Retrieved August 26, 2019. |
| Gmail Delegation | Google. (n.d.). Turn Gmail delegation on or off. Retrieved April 1, 2022. |
| GoBotKR | Zuzana Hromcová. (2019, July 8). Malicious campaign targets South Korean users with backdoor‑laced torrents. Retrieved March 31, 2022. |
| Google - Restore Cloud Snapshot | Google. (2019, October 7). Restoring and deleting persistent disk snapshots. Retrieved October 8, 2019. |
| Google AI Threat Tracker MAY 2026 | Google Threat Intelligence Group. (2026, May 11). GTIG AI Threat Tracker: Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access. Retrieved July 7, 2026. |
| Google BRICKSTORM GRIMBOLT UNC5221 UNC6201 February 2026 | Peter Ukhanov, Daniel Sislo, Nick Harbour, John Scarbrough, Fernando Tomlinson Jr., Rich Reece. (2026, February 17). From BRICKSTORM to GRIMBOLT: UNC6201 Exploiting a Dell RecoverPoint for Virtual Machines Zero-Day. Retrieved April 16, 202… |
| Google BRICKSTORM September 2025 | Sarah Yoder, John Wolfram, Ashley Pearson, Doug Bienstock, Josh Madeley, Josh Murchie, Brad Slaybaugh, Matt Lin, Geoff Carstairs, Austin Larsen. (2025, September 24). Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and L… |
| Google Chrome Remote Desktop | Google. (n.d.). Retrieved March 14, 2024. |
| Google Cloud - IAM Servie Accounts List API | Google. (2020, June 23). gcloud iam service-accounts list. Retrieved August 4, 2020. |
| Google Cloud APT41 2022 | Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman & John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved September 16, 2024. |
| Google Cloud APT41 2024 | Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024. |
| Google Cloud Add Metadata | Google Cloud. (2022, March 31). gcloud compute instances add-metadata. Retrieved April 1, 2022. |
| Google Cloud BOLDMOVE 2023 | Scott Henderson, Cristiana Kittner, Sarah Hawley & Mark Lechtik, Google Cloud. (2023, January 19). Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475). Retrieved December 31, 2024. |
| Google Cloud IAM Policies | Google Cloud. (2022, March 31). Understanding policies. Retrieved April 1, 2022. |
| Google Cloud Identity API Documentation | Google. (n.d.). Retrieved March 16, 2021. |
| Google Cloud Just in Time Access 2023 | Google Cloud. (n.d.). Manage just-in-time privileged access to projects. Retrieved September 21, 2023. |
| Google Cloud Kubernetes IAM | Google Cloud. (n.d.). Create IAM policies. Retrieved July 14, 2023. |
| Google Cloud Mandiant UNC3886 2024 | Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024. |
| Google Cloud Privilege Escalation | Chris Moberly. (2020, February 12). Tutorial on privilege escalation and post exploitation tactics in Google Cloud Platform environments. Retrieved April 1, 2022. |
| Google Cloud Secrets | Google Cloud. (n.d.). List secrets and view secret details. Retrieved September 25, 2023. |
| Google Cloud Service Account Authentication Roles | Google Cloud. (n.d.). Roles for service account authentication. Retrieved July 10, 2023. |
| Google Cloud Service Account Credentials | Google Cloud. (2022, March 31). Creating short-lived service account credentials. Retrieved April 1, 2022. |
| Google Cloud Storage Best Practices, 2019 | Google. (2019, September 16). Best practices for Cloud Storage. Retrieved October 4, 2019. |
| Google Cloud Threat Intelligence COSCMICENERGY 2023 | COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises. (2023, May 25). Ken Proska, Daniel Kapellmann Zafra, Keith Lunden, Corey Hildebrandt, Rushikesh Nandedkar, Nathan Brubaker. Retrieved March 18, 2025. |
| Google Cloud Threat Intelligence DPRK IT Workers 2024 | Codi Starks, Michael Barnhart, Taylor Long, Mike Lombardi, Joseph Pisano, and Alice Revelli. (2024, September 23). Staying a Step Ahead: Mitigating the DPRK IT Worker Threat. Retrieved March 26, 2025. |
| Google Cloud Threat Intelligence ESXi VIBs 2022 | Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025. |
| Google Cloud Threat Intelligence UNC5537 Snowflake 2024 | Mandiant. (2024, June 10). UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion. Retrieved May 22, 2025. |
| Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 | Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025. |
| Google Cloud downgrade attack | Nathan Kirk. (2018, June 18). Bring Your Own Land (BYOL) — A Novel Red Teaming Technique. Retrieved April 15, 2026. |
| Google Command Center Dashboard | Google. (2019, October 3). Quickstart: Using the dashboard. Retrieved October 8, 2019. |
| Google Compute Instances | Google. (n.d.). gcloud compute instances list. Retrieved May 26, 2020. |
| Google EXOTIC LILY March 2022 | Stolyarov, V. (2022, March 17). Exposing initial access broker with ties to Conti. Retrieved August 18, 2022. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
