auren-research/cyber-sec huggingface dataset:
type: malware
spec_version: 2.1
id: malware--ff6840c9-4c87-4d07-bbb6-9f50aa33d498
created: 2017-05-31T21:33:21.973Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0143
external_id: S0143
source_name: Flame
description: (Citation: Kaspersky Flame)
source_name: sKyWIper
description: (Citation: Kaspersky Flame) (Citation: Crysys Skywiper)
source_name: Flamer
description: (Citation: Kaspersky Flame) (Citation: Symantec Beetlejuice)
source_name: Kaspersky Flame
description: Gostev, A. (2012, May 28). The Flame: Questions and Answers. Retrieved March 1, 2017.
url: https://securelist.com/the-flame-questions-and-answers-51/34344/
source_name: Crysys Skywiper
description: sKyWIper Analysis Team. (2012, May 31). sKyWIper (a.k.a. Flame a.k.a. Flamer): A complex malware for targeted attacks. Retrieved September 6, 2018.
url: https://www.crysys.hu/publications/files/skywiper.pdf
source_name: Symantec Beetlejuice
description: Symantec Security Response. (2012, May 31). Flamer: A Recipe for Bluetoothache. Retrieved February 25, 2017.
url: https://www.symantec.com/connect/blogs/flamer-recipe-bluetoothache
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:46.014Z
name: Flame
description: [Flame](https://attack.mitre.org/software/S0143) is a sophisticated toolkit that has been used to collect information since at least 2010, largely targeting Middle East countries. (Citation: Kaspersky Flame)
is_family: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
ics-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Flame
Flamer
sKyWIper
modified: 2024-04-11T02:21:28.830Z
name: HermeticWizard
description: [HermeticWizard](https://attack.mitre.org/software/S0698) is a worm that has been used to spread [HermeticWiper](https://attack.mitre.org/software/S0697) in attacks against organizations in Ukraine since at least 2022.(Citation: ESET Hermetic Wizard March 2022)
is_family: yes
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: HermeticWizard
type: malware
spec_version: 2.1
id: malware--ff7ed9c1-dca3-4e62-9da6-72c5d388b8fa
created: 2022-03-25T20:47:06.942Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0698
external_id: S0698
source_name: ESET Hermetic Wizard March 2022
description: ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.
url: https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-11-27T21:55:29.681Z
name: Net
description: The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft Net Utility)

[Net](https://attack.mitre.org/software/S0039) has a great deal of functionality, (Citation: Savill 1999) much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.7
x_mitre_contributors: David Ferguson, CyberSponse
x_mitre_aliases: Net
net.exe
type: tool
spec_version: 2.1
id: tool--03342581-f790-4f03-ba41-e82e67392e23
created: 2017-05-31T21:32:31.601Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0039
external_id: S0039
source_name: Microsoft Net Utility
description: Microsoft. (2006, October 18). Net.exe Utility. Retrieved September 22, 2015.
url: https://msdn.microsoft.com/en-us/library/aa939914
source_name: Savill 1999
description: Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
url: https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: tool
spec_version: 2.1
id: tool--03c6e0ea-96d3-4b23-9afb-05055663cf4b
created: 2021-03-18T14:57:34.628Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0592
external_id: S0592
source_name: Trend Micro Muddy Water March 2021
description: Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.
url: https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:11.980Z
name: RemoteUtilities
description: [RemoteUtilities](https://attack.mitre.org/software/S0592) is a legitimate remote administration tool that has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least 2021 for execution on target machines.(Citation: Trend Micro Muddy Water March 2021)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: RemoteUtilities
modified: 2024-09-06T18:11:55.619Z
name: Covenant
description: [Covenant](https://attack.mitre.org/software/S1155) is a multi-platform command and control framework written in .NET. While designed for penetration testing and security research, the tool has also been used by threat actors such as [HAFNIUM](https://attack.mitre.org/groups/G0125) during operations. [Covenant](https://attack.mitre.org/software/S1155) functions through a central listener managing multiple deployed "Grunts" that communicate back to the controller.(Citation: Github Covenant)(Citation: Microsoft HAFNIUM March 2020)
x_mitre_platforms: Linux
macOS
Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_contributors: Subhash Thapa
x_mitre_aliases: Covenant
type: tool
spec_version: 2.1
id: tool--05fb53c8-e2ac-4e17-a0c9-a0825e1198bf
created: 2024-09-04T17:08:08.985Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1155
external_id: S1155
source_name: Github Covenant
description: cobbr. (2021, April 21). Covenant. Retrieved September 4, 2024.
url: https://github.com/cobbr/Covenant
source_name: Microsoft HAFNIUM March 2020
description: MSTIC. (2021, March 2). HAFNIUM targeting Exchange Servers with 0-day exploits. Retrieved March 3, 2021.
url: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-10-28T19:00:14.732Z
name: NPPSPY
description: NPPSPY is an implementation of a theoretical mechanism first presented in 2004 for capturing credentials submitted to a Windows system via a rogue Network Provider API item. NPPSPY captures credentials following submission and writes them to a file on the victim system for follow-on exfiltration.(Citation: Huntress NPPSPY 2022)(Citation: Polak NPPSPY 2004)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_contributors: Dray Agha, @Purp1eW0lf, Huntress Labs
x_mitre_aliases: NPPSPY
type: tool
spec_version: 2.1
id: tool--0630d1a7-54da-4a48-a6af-eb8a62b13c17
created: 2024-05-17T18:49:15.318Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1131
external_id: S1131
source_name: Huntress NPPSPY 2022
description: Dray Agha. (2022, August 16). Cleartext Shenanigans: Gifting User Passwords to Adversaries With NPPSPY. Retrieved May 17, 2024.
url: https://www.huntress.com/blog/cleartext-shenanigans-gifting-user-passwords-to-adversaries-with-nppspy
source_name: Polak NPPSPY 2004
description: Sergey Polak. (2004, August). Capturing Windows Passwords using the Network Provider API. Retrieved May 17, 2024.
url: https://www.blackhat.com/presentations/win-usa-04/bh-win-04-polak/bh-win-04-polak2.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2025-03-12T20:27:03.654Z
name: BloodHound
description: [BloodHound](https://attack.mitre.org/software/S0521) is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.(Citation: GitHub Bloodhound)(Citation: CrowdStrike BloodHound April 2018)(Citation: FoxIT Wocao December 2019)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.7
x_mitre_aliases: BloodHound
type: tool
spec_version: 2.1
id: tool--066b057c-944e-4cfc-b654-e3dfba04b926
created: 2020-10-28T12:51:29.358Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0521
external_id: S0521
source_name: FoxIT Wocao December 2019
description: Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
url: https://www.fox-it.com/media/kadlze5c/201912_report_operation_wocao.pdf
source_name: CrowdStrike BloodHound April 2018
description: Red Team Labs. (2018, April 24). Hidden Administrative Accounts: BloodHound to the Rescue. Retrieved October 28, 2020.
url: https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/
source_name: GitHub Bloodhound
description: Robbins, A., Vazarkar, R., and Schroeder, W. (2016, April 17). Bloodhound: Six Degrees of Domain Admin. Retrieved March 5, 2019.
url: https://github.com/BloodHoundAD/BloodHound
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-11-27T21:56:15.800Z
name: certutil
description: [certutil](https://attack.mitre.org/software/S0160) is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. (Citation: TechNet Certutil)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.5
x_mitre_aliases: certutil
certutil.exe
type: tool
spec_version: 2.1
id: tool--0a68f1f1-da74-4d28-8d9a-696c082706cc
created: 2017-12-14T16:46:06.044Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0160
external_id: S0160
source_name: TechNet Certutil
description: Microsoft. (2012, November 14). Certutil. Retrieved July 3, 2017.
url: https://technet.microsoft.com/library/cc732443.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: tool
spec_version: 2.1
id: tool--0c8465c0-d0b4-4670-992e-4eee8d7ff952
created: 2017-05-31T21:33:06.824Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0110
external_id: S0110
source_name: Linux at
description: IEEE/The Open Group. (2017). at(1p) — Linux manual page. Retrieved February 25, 2022.
url: https://man7.org/linux/man-pages/man1/at.1p.html
source_name: TechNet At
description: Microsoft. (n.d.). At. Retrieved April 28, 2016.
url: https://technet.microsoft.com/en-us/library/bb490866.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:49.779Z
name: at
description: [at](https://attack.mitre.org/software/S0110) is used to schedule tasks on a system to run at a specified date or time.(Citation: TechNet At)(Citation: Linux at)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: at
at.exe
type: tool
spec_version: 2.1
id: tool--102c3898-85e0-43ee-ae28-62a0a3ed9507
created: 2017-05-31T21:33:09.047Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0116
external_id: S0116
source_name: Github UACMe
description: UACME Project. (2016, June 16). UACMe. Retrieved July 26, 2016.
url: https://github.com/hfiref0x/UACME
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:13.232Z
name: UACMe
description: [UACMe](https://attack.mitre.org/software/S0116) is an open source assessment tool that contains many methods for bypassing Windows User Account Control on multiple versions of the operating system. (Citation: Github UACMe)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: tool
spec_version: 2.1
id: tool--115f88dd-0618-4389-83cb-98d33ae81848
created: 2020-05-12T21:29:48.294Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0445
external_id: S0445
source_name: FOX-IT May 2016 Mofang
description: Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.
url: https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:13.595Z
name: ShimRatReporter
description: [ShimRatReporter](https://attack.mitre.org/software/S0445) is a tool used by suspected Chinese adversary [Mofang](https://attack.mitre.org/groups/G0103) to automatically conduct initial discovery. The details from this discovery are used to customize follow-on payloads (such as [ShimRat](https://attack.mitre.org/software/S0444)) as well as set up faux infrastructure which mimics the adversary's targets. [ShimRatReporter](https://attack.mitre.org/software/S0445) has been used in campaigns targeting multiple countries and sectors including government, military, critical infrastructure, automobile, and weapons development.(Citation: FOX-IT May 2016 Mofang)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: ShimRatReporter
modified: 2025-03-24T16:00:41.005Z
name: Sliver
description: [Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control (C2) framework written in Golang. [Sliver](https://attack.mitre.org/software/S0633) includes its own package manager, "armory," for staging and downloading additional tools and payloads to the primary C2 framework.(Citation: Bishop Fox Sliver Framework August 2019)(Citation: Cybereason Sliver Undated)
x_mitre_platforms: Windows
Linux
macOS
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_contributors: Achute Sharma, Keysight
Ayan Saha, Keysight
Kyaw Pyiyt Htet, @KyawPyiytHtet
x_mitre_aliases: Sliver
type: tool
spec_version: 2.1
id: tool--11f8d7eb-1927-4806-9267-3a11d4d4d6be
created: 2021-07-30T15:43:17.770Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0633
external_id: S0633
source_name: Cybereason Sliver Undated
description: Cybereason Global SOC and Incident Response Team. (n.d.). Sliver C2 Leveraged by Many Threat Actors. Retrieved March 24, 2025.
url: https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
source_name: Bishop Fox Sliver Framework August 2019
description: Kervella, R. (2019, August 4). Cross-platform General Purpose Implant Framework Written in Golang. Retrieved July 30, 2021.
url: https://labs.bishopfox.com/tech-blog/sliver
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: tool
spec_version: 2.1
id: tool--1244e058-fa10-48cb-b484-0bcf671107ae
created: 2022-03-23T19:34:30.486Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0692
external_id: S0692
source_name: SILENTTRINITY
description: (Citation: GitHub SILENTTRINITY March 2022)
source_name: Security Affairs SILENTTRINITY July 2019
description: Paganini, P. (2019, July 7). Croatia government agencies targeted with news SilentTrinity malware. Retrieved March 23, 2022.
url: https://securityaffairs.co/wordpress/88021/apt/croatia-government-silenttrinity-malware.html
source_name: GitHub SILENTTRINITY March 2022
description: Salvati, M (2019, August 6). SILENTTRINITY. Retrieved March 23, 2022.
url: https://github.com/byt3bl33d3r/SILENTTRINITY
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-30T13:26:45.728Z
name: SILENTTRINITY
description: [SILENTTRINITY](https://attack.mitre.org/software/S0692) is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. [SILENTTRINITY](https://attack.mitre.org/software/S0692) was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.(Citation: GitHub SILENTTRINITY March 2022)(Citation: Security Affairs SILENTTRINITY July 2019)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Daniel Acevedo, ARMADO
x_mitre_aliases: SILENTTRINITY
type: tool
spec_version: 2.1
id: tool--13cd9151-83b7-410d-9f98-25d0f0d1d80d
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0194
external_id: S0194
source_name: PowerShellMagazine PowerSploit July 2014
description: Graeber, M. (2014, July 8). PowerSploit. Retrieved February 6, 2018.
url: http://www.powershellmagazine.com/2014/07/08/powersploit/
source_name: GitHub PowerSploit May 2012
description: PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
url: https://github.com/PowerShellMafia/PowerSploit
source_name: PowerSploit Documentation
description: PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
url: http://powersploit.readthedocs.io
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:50.246Z
name: PowerSploit
description: [PowerSploit](https://attack.mitre.org/software/S0194) is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. (Citation: GitHub PowerSploit May 2012) (Citation: PowerShellMagazine PowerSploit July 2014) (Citation: PowerSploit Documentation)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.6
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: PowerSploit
modified: 2023-10-19T12:18:43.123Z
name: Pacu
description: Pacu is an open-source AWS exploitation framework. The tool is written in Python and publicly available on GitHub.(Citation: GitHub Pacu)
x_mitre_platforms: IaaS
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_contributors: Thanabodi Phrakhun, @naikordian
x_mitre_aliases: Pacu
type: tool
spec_version: 2.1
id: tool--1b3b8f96-43b1-4460-8e02-1f53d7802fb9
created: 2023-09-28T13:21:49.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1091
external_id: S1091
source_name: GitHub Pacu
description: Rhino Security Labs. (2019, August 22). Pacu. Retrieved October 17, 2019.
url: https://github.com/RhinoSecurityLabs/pacu
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-09-12T15:17:22.004Z
name: Windows Credential Editor
description: [Windows Credential Editor](https://attack.mitre.org/software/S0005) is a password dumping tool. (Citation: Amplia WCE)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: Windows Credential Editor
WCE
type: tool
spec_version: 2.1
id: tool--242f3da3-4425-4d11-8f5c-b842886da966
created: 2017-05-31T21:32:12.684Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0005
external_id: S0005
source_name: Amplia WCE
description: Amplia Security. (n.d.). Windows Credentials Editor (WCE) F.A.Q.. Retrieved September 12, 2024.
url: https://web.archive.org/web/20240904163410/https://www.ampliasecurity.com/research/wcefaq.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5