auren-research/cyber-sec huggingface dataset:
modified: 2023-10-03T19:35:03.646Z
name: Imminent Monitor
description: [Imminent Monitor](https://attack.mitre.org/software/S0434) was a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an operation was conducted to take down the Imminent Monitor infrastructure. Various cracked versions and variations of this RAT are still in circulation.(Citation: Imminent Unit42 Dec2019)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_contributors: Jose Luis Sánchez Martinez
x_mitre_aliases: Imminent Monitor
type: tool
spec_version: 2.1
id: tool--8f8cd191-902c-4e83-bf20-b57c8c4640e9
created: 2020-05-05T18:45:36.358Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0434
external_id: S0434
source_name: Imminent Unit42 Dec2019
description: Unit 42. (2019, December 2). Imminent Monitor – a RAT Down Under. Retrieved May 5, 2020.
url: https://unit42.paloaltonetworks.com/imminent-monitor-a-rat-down-under/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: tool
spec_version: 2.1
id: tool--90ac9266-68ce-46f2-b24f-5eb3b2a8ea38
created: 2019-02-04T18:27:00.501Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0358
external_id: S0358
source_name: SensePost Ruler GitHub
description: SensePost. (2016, August 18). Ruler: A tool to abuse Exchange services. Retrieved February 4, 2019.
url: https://github.com/sensepost/ruler
source_name: SensePost NotRuler
description: SensePost. (2017, September 21). NotRuler - The opposite of Ruler, provides blue teams with the ability to detect Ruler usage against Exchange. Retrieved February 4, 2019.
url: https://github.com/sensepost/notruler
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:22.953Z
name: Ruler
description: [Ruler](https://attack.mitre.org/software/S0358) is a tool to abuse Microsoft Exchange services. It is publicly available on GitHub and the tool is executed via the command line. The creators of [Ruler](https://attack.mitre.org/software/S0358) have also released a defensive tool, NotRuler, to detect its usage.(Citation: SensePost Ruler GitHub)(Citation: SensePost NotRuler)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
Office Suite
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Ruler
type: tool
spec_version: 2.1
id: tool--90ec2b22-7061-4469-b539-0989ec4f96c2
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0193
external_id: S0193
source_name: Microsoft Forfiles Aug 2016
description: Microsoft. (2016, August 31). Forfiles. Retrieved January 22, 2018.
url: https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc753551(v=ws.11)
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:23.318Z
name: Forfiles
description: [Forfiles](https://attack.mitre.org/software/S0193) is a Windows utility commonly used in batch jobs to execute commands on one or more selected files or directories (ex: list all directories in a drive, read the first line of all files created yesterday, etc.). Forfiles can be executed from either the command line, Run window, or batch files/scripts. (Citation: Microsoft Forfiles Aug 2016)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
modified: 2024-09-04T21:09:10.255Z
name: Winexe
description: [Winexe](https://attack.mitre.org/software/S0191) is a lightweight, open source tool similar to [PsExec](https://attack.mitre.org/software/S0029) designed to allow system administrators to execute commands on remote servers. (Citation: Winexe Github Sept 2013) [Winexe](https://attack.mitre.org/software/S0191) is unique in that it is a GNU/Linux based client. (Citation: Überwachung APT28 Forfiles June 2015)
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_aliases: Winexe
type: tool
spec_version: 2.1
id: tool--96fd6cc4-a693-4118-83ec-619e5352d07d
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0191
external_id: S0191
source_name: Überwachung APT28 Forfiles June 2015
description: Guarnieri, C. (2015, June 19). Digital Attack on German Parliament: Investigative Report on the Hack of the Left Party Infrastructure in Bundestag. Retrieved January 22, 2018.
url: https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/
source_name: Winexe Github Sept 2013
description: Skalkotos, N. (2013, September 20). WinExe. Retrieved January 22, 2018.
url: https://github.com/skalkoto/winexe/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: tool
spec_version: 2.1
id: tool--975737f1-b10d-476f-8bda-3ec26ea57172
created: 2020-08-13T17:15:25.702Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0500
external_id: S0500
source_name: Secureworks MCMD July 2019
description: Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.
url: https://www.secureworks.com/research/mcmd-malware-analysis
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:54.178Z
name: MCMD
description: [MCMD](https://attack.mitre.org/software/S0500) is a remote access tool that provides remote command shell capability used by [Dragonfly 2.0](https://attack.mitre.org/groups/G0074).(Citation: Secureworks MCMD July 2019)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: MCMD
modified: 2024-09-25T20:27:04.356Z
name: Nltest
description: [Nltest](https://attack.mitre.org/software/S0359) is a Windows command-line utility used to list domain controllers and enumerate domain trusts.(Citation: Nltest Manual)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_aliases: Nltest
type: tool
spec_version: 2.1
id: tool--981acc4c-2ede-4b56-be6e-fa1a75f37acf
created: 2019-02-14T17:08:55.176Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0359
external_id: S0359
source_name: Nltest Manual
description: ss64. (n.d.). NLTEST.exe - Network Location Test. Retrieved February 14, 2019.
url: https://ss64.com/nt/nltest.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-10-14T22:11:30.271Z
name: MailSniper
description: MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain.(Citation: GitHub MailSniper)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
Office Suite
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: MailSniper
type: tool
spec_version: 2.1
id: tool--999c4e6e-b8dc-4b4f-8d6e-1b829f29997e
created: 2019-10-05T02:34:01.189Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0413
external_id: S0413
source_name: GitHub MailSniper
description: Bullock, B., . (2018, November 20). MailSniper. Retrieved October 4, 2019.
url: https://github.com/dafthack/MailSniper
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
type: tool
spec_version: 2.1
id: tool--9a2640c2-9f43-46fe-b13f-bde881e55555
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0225
external_id: S0225
source_name: sqlmap Introduction
description: Damele, B., Stampar, M. (n.d.). sqlmap. Retrieved March 19, 2018.
url: http://sqlmap.org/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:24.383Z
name: sqlmap
description: [sqlmap](https://attack.mitre.org/software/S0225) is an open source penetration testing tool that can be used to automate the process of detecting and exploiting SQL injection flaws. (Citation: sqlmap Introduction)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: tool
spec_version: 2.1
id: tool--9de2308e-7bed-43a3-8e58-f194b3586700
created: 2017-05-31T21:32:13.051Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0006
external_id: S0006
source_name: Wikipedia pwdump
description: Wikipedia. (2007, August 9). pwdump. Retrieved June 22, 2016.
url: https://en.wikipedia.org/wiki/Pwdump
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:24.744Z
name: pwdump
description: [pwdump](https://attack.mitre.org/software/S0006) is a credential dumper. (Citation: Wikipedia pwdump)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: pwdump
type: tool
spec_version: 2.1
id: tool--a1dd2dbd-1550-44bf-abcc-1a4c52e97719
created: 2018-01-16T16:13:52.465Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0174
external_id: S0174
source_name: GitHub Responder
description: Gaffie, L. (2016, August 25). Responder. Retrieved November 17, 2017.
url: https://github.com/SpiderLabs/Responder
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:54.639Z
name: Responder
description: Responder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. (Citation: GitHub Responder)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Responder
type: tool
spec_version: 2.1
id: tool--a52edc76-328d-4596-85e7-d56ef5a9eb69
created: 2017-05-31T21:33:11.426Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0122
external_id: S0122
source_name: Mandiant APT1
description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:25.272Z
name: Pass-The-Hash Toolkit
description: [Pass-The-Hash Toolkit](https://attack.mitre.org/software/S0122) is a toolkit that allows an adversary to "pass" a password hash (without knowing the original password) to log in to systems. (Citation: Mandiant APT1)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: tool
spec_version: 2.1
id: tool--a7b5df47-73bb-4d47-b701-869f185633a6
created: 2022-03-25T13:35:46.781Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0695
external_id: S0695
source_name: NCC Group WastedLocker June 2020
description: Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021.
url: https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
source_name: Introducing Donut
description: The Wover. (2019, May 9). Donut - Injecting .NET Assemblies as Shellcode. Retrieved October 4, 2021.
url: https://thewover.github.io/Introducing-Donut/
source_name: Donut Github
description: TheWover. (2019, May 9). donut. Retrieved March 25, 2022.
url: https://github.com/TheWover/donut
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:54.932Z
name: Donut
description: [Donut](https://attack.mitre.org/software/S0695) is an open source framework used to generate position-independent shellcode.(Citation: Donut Github)(Citation: Introducing Donut) [Donut](https://attack.mitre.org/software/S0695) generated code has been used by multiple threat actors to inject and load malicious payloads into memory.(Citation: NCC Group WastedLocker June 2020)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: The Wover, @TheRealWover
x_mitre_aliases: Donut
modified: 2024-11-27T21:53:57.705Z
name: Mimikatz
description: [Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. (Citation: Deply Mimikatz) (Citation: Adsecurity Mimikatz Guide)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.10
x_mitre_contributors: Vincent Le Toux
x_mitre_aliases: Mimikatz
type: tool
spec_version: 2.1
id: tool--afc079f3-c0ea-4096-b75d-3f05338b7f60
created: 2017-05-31T21:32:11.544Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0002
external_id: S0002
source_name: Deply Mimikatz
description: Deply, B. (n.d.). Mimikatz. Retrieved September 29, 2015.
url: https://github.com/gentilkiwi/mimikatz
source_name: Adsecurity Mimikatz Guide
description: Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz & Command Reference. Retrieved December 23, 2015.
url: https://adsecurity.org/?page_id=1821
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-11-17T23:49:27.288Z
name: gsecdump
description: [gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. (Citation: TrueSec Gsecdump)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_aliases: gsecdump
type: tool
spec_version: 2.1
id: tool--b07c2c47-fefb-4d7c-a69e-6a3296171f54
created: 2017-05-31T21:32:13.755Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0008
external_id: S0008
source_name: TrueSec Gsecdump
description: TrueSec. (n.d.). gsecdump v2.0b5. Retrieved November 17, 2024.
url: https://web.archive.org/web/20140328102838/https://www.truesec.se/sakerhet/verktyg/saakerhet/gsecdump_v2.0b5
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-04-11T02:14:36.791Z
name: IronNetInjector
description: [IronNetInjector](https://attack.mitre.org/software/S0581) is a [Turla](https://attack.mitre.org/groups/G0010) toolchain that utilizes scripts from the open-source IronPython implementation of Python with a .NET injector to drop one or more payloads including [ComRAT](https://attack.mitre.org/software/S0126).(Citation: Unit 42 IronNetInjector February 2021 )
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: IronNetInjector
type: tool
spec_version: 2.1
id: tool--b1595ddd-a783-482a-90e1-8afc8d48467e
created: 2021-02-24T21:28:44.175Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0581
external_id: S0581
source_name: Unit 42 IronNetInjector February 2021 
description: Reichel, D. (2021, February 19). IronNetInjector: Turla’s New Malware Loading Tool. Retrieved February 24, 2021.
url: https://unit42.paloaltonetworks.com/ironnetinjector/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: tool
spec_version: 2.1
id: tool--b35068ec-107a-4266-bda8-eb7036267aea
created: 2017-05-31T21:33:03.773Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0102
external_id: S0102
source_name: TechNet Nbtstat
description: Microsoft. (n.d.). Nbtstat. Retrieved April 17, 2016.
url: https://technet.microsoft.com/en-us/library/cc940106.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:26.343Z
name: nbtstat
description: [nbtstat](https://attack.mitre.org/software/S0102) is a utility used to troubleshoot NetBIOS name resolution. (Citation: TechNet Nbtstat)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
type: tool
spec_version: 2.1
id: tool--b52d6583-14a2-4ddc-8527-87fd2142558f
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0231
external_id: S0231
source_name: GitHub Invoke-PSImage
description: Adams, B. (2017, December 17). Invoke-PSImage. Retrieved April 10, 2018.
url: https://github.com/peewpw/Invoke-PSImage
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:55.222Z
name: Invoke-PSImage
description: [Invoke-PSImage](https://attack.mitre.org/software/S0231) takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a one liner for executing either from a file of from the web. Example of usage is embedding the PowerShell code from the Invoke-Mimikatz module and embed it into an image file. By calling the image file from a macro for example, the macro will download the picture and execute the PowerShell code, which in this case will dump the passwords. (Citation: GitHub Invoke-PSImage)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Invoke-PSImage
type: tool
spec_version: 2.1
id: tool--b63970b7-ddfb-4aee-97b1-80d335e033a8
created: 2021-03-17T15:26:20.015Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0590
external_id: S0590
source_name: Debian nbtscan Nov 2019
description: Bezroutchko, A. (2019, November 19). NBTscan man page. Retrieved March 17, 2021.
url: https://manpages.debian.org/testing/nbtscan/nbtscan.1.en.html
source_name: FireEye APT39 Jan 2019
description: Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.
url: https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html
source_name: SecTools nbtscan June 2003
description: SecTools. (2003, June 11). NBTscan. Retrieved March 17, 2021.
url: https://sectools.org/tool/nbtscan/
source_name: Symantec Waterbug Jun 2019
description: Symantec DeepSight Adversary Intelligence Team. (2019, June 20). Waterbug: Espionage Group Rolls Out Brand-New Toolset in Attacks Against Governments. Retrieved July 8, 2019.
url: https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:26.872Z
name: NBTscan
description: [NBTscan](https://attack.mitre.org/software/S0590) is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)(Citation: Symantec Waterbug Jun 2019)(Citation: FireEye APT39 Jan 2019)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
Linux
macOS
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Daniyal Naeem, BT Security
x_mitre_aliases: NBTscan
revoked: no
modified: 2024-04-04T03:49:27.035Z
name: LaZagne
description: [LaZagne](https://attack.mitre.org/software/S0349) is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. [LaZagne](https://attack.mitre.org/software/S0349) is publicly available on GitHub.(Citation: GitHub LaZagne Dec 2018)
x_mitre_platforms: Linux
macOS
Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.6
x_mitre_aliases: LaZagne
type: tool
spec_version: 2.1
id: tool--b76b2d94-60e4-4107-a903-4a3a7622fb3b
created: 2019-01-30T16:44:59.887Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0349
external_id: S0349
source_name: LaZagne
description: (Citation: GitHub LaZange Dec 2018)
source_name: GitHub LaZagne Dec 2018
description: Zanni, A. (n.d.). The LaZagne Project !!!. Retrieved December 14, 2018.
url: https://github.com/AlessandroZ/LaZagne
source_name: GitHub LaZange Dec 2018
description: Zanni, A. (n.d.). The LaZagne Project !!!. Retrieved December 14, 2018.
url: https://github.com/AlessandroZ/LaZagne
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5