auren-research/cyber-sec huggingface dataset:
type: tool
spec_version: 2.1
id: tool--b77b563c-34bb-4fb8-86a3-3694338f7b47
created: 2017-05-31T21:33:01.483Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0097
external_id: S0097
source_name: TechNet Ping
description: Microsoft. (n.d.). Ping. Retrieved April 8, 2016.
url: https://technet.microsoft.com/en-us/library/bb490968.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:55.518Z
name: Ping
description: [Ping](https://attack.mitre.org/software/S0097) is an operating system utility commonly used to troubleshoot and verify network connections. (Citation: TechNet Ping)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.4
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Ping
type: tool
spec_version: 2.1
id: tool--bba595da-b73a-4354-aa6c-224d4de7cb4e
created: 2017-05-31T21:33:05.319Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0106
external_id: S0106
source_name: TechNet Cmd
description: Microsoft. (n.d.). Cmd. Retrieved April 18, 2016.
url: https://technet.microsoft.com/en-us/library/bb490880.aspx
source_name: TechNet Copy
description: Microsoft. (n.d.). Copy. Retrieved April 26, 2016.
url: https://technet.microsoft.com/en-us/library/bb490886.aspx
source_name: TechNet Del
description: Microsoft. (n.d.). Del. Retrieved April 22, 2016.
url: https://technet.microsoft.com/en-us/library/cc771049.aspx
source_name: TechNet Dir
description: Microsoft. (n.d.). Dir. Retrieved April 18, 2016.
url: https://technet.microsoft.com/en-us/library/cc755121.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:55.702Z
name: cmd
description: [cmd](https://attack.mitre.org/software/S0106) is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. (Citation: TechNet Cmd)

Cmd.exe contains native functionality to perform many operations to interact with the system, including listing files in a directory (e.g., dir (Citation: TechNet Dir)), deleting files (e.g., del (Citation: TechNet Del)), and copying files (e.g., copy (Citation: TechNet Copy)).
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: cmd
cmd.exe
type: tool
spec_version: 2.1
id: tool--c11ac61d-50f4-444f-85d8-6f006067f0de
created: 2017-05-31T21:33:04.151Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0103
external_id: S0103
source_name: TechNet Route
description: Microsoft. (n.d.). Route. Retrieved April 17, 2016.
url: https://technet.microsoft.com/en-us/library/bb490991.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:55.853Z
name: route
description: [route](https://attack.mitre.org/software/S0103) can be used to find or change information within the local system IP routing table. (Citation: TechNet Route)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
modified: 2023-09-28T03:45:36.045Z
name: esentutl
description: [esentutl](https://attack.mitre.org/software/S0404) is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.(Citation: Microsoft Esentutl)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_contributors: Edward Millington
Matthew Demaske, Adaptforward
x_mitre_aliases: esentutl
esentutl.exe
type: tool
spec_version: 2.1
id: tool--c256da91-6dd5-40b2-beeb-ee3b22ab3d27
created: 2019-09-03T18:25:36.963Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0404
external_id: S0404
source_name: Microsoft Esentutl
description: Microsoft. (2016, August 30). Esentutl. Retrieved September 3, 2019.
url: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh875546(v=ws.11)
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-03-14T17:29:49.200Z
name: CrackMapExec
description: [CrackMapExec](https://attack.mitre.org/software/S0488), or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. [CrackMapExec](https://attack.mitre.org/software/S0488) collects Active Directory information to conduct lateral movement through targeted networks.(Citation: CME Github September 2018)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_aliases: CrackMapExec
type: tool
spec_version: 2.1
id: tool--c4810609-7da6-48ec-8057-1b70a7814db0
created: 2020-07-17T14:23:05.958Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0488
external_id: S0488
source_name: CME Github September 2018
description: byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.
url: https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2024-11-17T14:12:07.296Z
name: Koadic
description: [Koadic](https://attack.mitre.org/software/S0250) is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub. [Koadic](https://attack.mitre.org/software/S0250) has several options for staging payloads and creating implants, and performs most of its operations using Windows Script Host.(Citation: Github Koadic)(Citation: Palo Alto Sofacy 06-2018)(Citation: MalwareBytes LazyScripter Feb 2021)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_aliases: Koadic
type: tool
spec_version: 2.1
id: tool--c8655260-9f4b-44e3-85e1-6538a5f6e4f4
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0250
external_id: S0250
source_name: Koadic
description: (Citation: Github Koadic)(Citation: MalwareBytes LazyScripter Feb 2021)
source_name: MalwareBytes LazyScripter Feb 2021
description: Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.
url: https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf
source_name: Palo Alto Sofacy 06-2018
description: Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.
url: https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/
source_name: Github Koadic
description: Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.
url: https://github.com/offsecginger/koadic
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: tool
spec_version: 2.1
id: tool--c9703cd3-141c-43a0-a926-380082be5d04
created: 2017-05-31T21:33:07.218Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0111
external_id: S0111
source_name: TechNet Schtasks
description: Microsoft. (n.d.). Schtasks. Retrieved April 28, 2016.
url: https://technet.microsoft.com/en-us/library/bb490996.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:56.004Z
name: schtasks
description: [schtasks](https://attack.mitre.org/software/S0111) is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. (Citation: TechNet Schtasks)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: schtasks
schtasks.exe
type: tool
spec_version: 2.1
id: tool--c9cd7ec9-40b7-49db-80be-1399eddd9c52
created: 2017-05-31T21:33:10.197Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0119
external_id: S0119
source_name: Mandiant APT1
description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:28.653Z
name: Cachedump
description: [Cachedump](https://attack.mitre.org/software/S0119) is a publicly-available tool that program extracts cached password hashes from a system’s registry. (Citation: Mandiant APT1)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Cachedump
type: tool
spec_version: 2.1
id: tool--ca656c25-44f1-471b-9d9f-e2a3bbb84973
created: 2019-02-19T19:17:14.971Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0361
external_id: S0361
source_name: Microsoft Expand Utility
description: Microsoft. (2017, October 15). Expand. Retrieved February 19, 2019.
url: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/expand
source_name: Palo Alto Networks BBSRAT
description: Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.
url: http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:29.018Z
name: Expand
description: [Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Matthew Demaske, Adaptforward
x_mitre_aliases: Expand
modified: 2023-09-28T21:08:47.128Z
name: Pupy
description: [Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). (Citation: GitHub Pupy) [Pupy](https://attack.mitre.org/software/S0192) is publicly available on GitHub. (Citation: GitHub Pupy)
x_mitre_platforms: Linux
Windows
macOS
Android
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.3
x_mitre_aliases: Pupy
type: tool
spec_version: 2.1
id: tool--cb69b20d-56d0-41ab-8440-4a4b251614d4
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0192
external_id: S0192
source_name: GitHub Pupy
description: Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
url: https://github.com/n1nj4sec/pupy
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: tool
spec_version: 2.1
id: tool--cde2d700-9ed1-46cf-9bce-07364fe8b24f
created: 2017-05-31T21:32:49.000Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0075
external_id: S0075
source_name: Microsoft Reg
description: Microsoft. (2012, April 17). Reg. Retrieved May 1, 2015.
url: https://technet.microsoft.com/en-us/library/cc732643.aspx
source_name: Windows Commands JPCERT
description: Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
url: https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:56.474Z
name: Reg
description: [Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: Microsoft Reg)

Utilities such as [Reg](https://attack.mitre.org/software/S0075) are known to be used by persistent threats. (Citation: Windows Commands JPCERT)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: Reg
reg.exe
type: tool
spec_version: 2.1
id: tool--cf23bf4a-e003-4116-bbae-1ea6c558d565
created: 2017-05-31T21:33:00.565Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0095
external_id: S0095
source_name: Microsoft FTP
description: Microsoft. (2021, July 21). ftp. Retrieved February 25, 2022.
url: https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/ftp
source_name: Linux FTP
description: N/A. (n.d.). ftp(1) - Linux man page. Retrieved February 25, 2022.
url: https://linux.die.net/man/1/ftp
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-06-04T16:11:23.752Z
name: ftp
description: [ftp](https://attack.mitre.org/software/S0095) is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a system or to exfiltrate data.(Citation: Microsoft FTP)(Citation: Linux FTP)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: ftp
ftp.exe
type: tool
spec_version: 2.1
id: tool--d505fc8b-2e64-46eb-96d6-9ef7ffca5b66
created: 2022-03-26T01:38:12.966Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0699
external_id: S0699
source_name: RecordedFuture 2021 Ad Infra
description: Insikt Group. (2022, January 18). 2021 Adversary Infrastructure Report. Retrieved March 25, 2022.
url: https://go.recordedfuture.com/hubfs/reports/cta-2022-0118.pdf
source_name: Mythic Github
description: Thomas, C. (2018, July 4). Mythic. Retrieved March 25, 2022.
url: https://github.com/its-a-feature/Mythic
source_name: Mythic SpecterOps
description: Thomas, C. (2020, August 13). A Change of Mythic Proportions. Retrieved March 25, 2022.
url: https://posts.specterops.io/a-change-of-mythic-proportions-21debeb03617
source_name: Mythc Documentation
description: Thomas, C. (n.d.). Mythc Documentation. Retrieved March 25, 2022.
url: https://docs.mythic-c2.net/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:38:56.653Z
name: Mythic
description: [Mythic](https://attack.mitre.org/software/S0699) is an open source, cross-platform post-exploitation/command and control platform. [Mythic](https://attack.mitre.org/software/S0699) is designed to "plug-n-play" with various agents and communication channels.(Citation: Mythic Github)(Citation: Mythic SpecterOps)(Citation: Mythc Documentation) Deployed [Mythic](https://attack.mitre.org/software/S0699) C2 servers have been observed as part of potentially malicious infrastructure.(Citation: RecordedFuture 2021 Ad Infra)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
Linux
macOS
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Cody Thomas, SpecterOps
x_mitre_aliases: Mythic
modified: 2024-11-17T16:27:34.671Z
name: HTRAN
description: [HTRAN](https://attack.mitre.org/software/S0040) is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their location when interacting with the victim networks. (Citation: Operation Quantum Entanglement)(Citation: NCSC Joint Report Public Tools)
x_mitre_platforms: Linux
Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_aliases: HTRAN
HUC Packet Transmit Tool
type: tool
spec_version: 2.1
id: tool--d5e96a35-7b0b-4c6a-9533-d63ecbda563e
created: 2017-05-31T21:32:32.011Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0040
external_id: S0040
source_name: HUC Packet Transmit Tool
description: (Citation: Operation Quantum Entanglement)
source_name: Operation Quantum Entanglement
description: Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 17, 2024.
url: https://web.archive.org/web/20210920193513/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-operation-quantum-entanglement.pdf
source_name: NCSC Joint Report Public Tools
description: The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
url: https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
type: tool
spec_version: 2.1
id: tool--d8d19e33-94fd-4aa3-b94a-08ee801a2153
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0195
external_id: S0195
source_name: SDelete
description: (Citation: Microsoft SDelete July 2016)
source_name: Microsoft SDelete July 2016
description: Russinovich, M. (2016, July 4). SDelete v2.0. Retrieved February 8, 2018.
url: https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-25T14:45:30.257Z
name: SDelete
description: [SDelete](https://attack.mitre.org/software/S0195) is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. (Citation: Microsoft SDelete July 2016)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_aliases: SDelete
modified: 2024-05-07T19:10:03.843Z
name: QuasarRAT
description: [QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that has been publicly available on GitHub since at least 2014. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language.(Citation: GitHub QuasarRAT)(Citation: Volexity Patchwork June 2018)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.1
x_mitre_contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet
x_mitre_aliases: QuasarRAT
xRAT
type: tool
spec_version: 2.1
id: tool--da04ac30-27da-4959-a67d-450ce47d9470
created: 2018-10-17T00:14:20.652Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S0262
external_id: S0262
source_name: QuasarRAT
description: (Citation: GitHub QuasarRAT) (Citation: Volexity Patchwork June 2018) (Citation: TrendMicro Patchwork Dec 2017)
source_name: xRAT
description: (Citation: TrendMicro Patchwork Dec 2017)(Citation: Securelist APT10 March 2021)
source_name: Securelist APT10 March 2021
description: GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.
url: https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/
source_name: TrendMicro Patchwork Dec 2017
description: Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
url: https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf
source_name: GitHub QuasarRAT
description: MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018.
url: https://github.com/quasar/QuasarRAT
source_name: Volexity Patchwork June 2018
description: Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.
url: https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
modified: 2025-03-10T19:48:40.412Z
name: cipher.exe
description: [cipher.exe](https://attack.mitre.org/software/S1205) is a native Microsoft utility that manages encryption of directories and files on NTFS (New Technology File System) partitions by using the Encrypting File System (EFS).(Citation: cipher.exe)
x_mitre_platforms: Windows
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_aliases: cipher.exe
type: tool
spec_version: 2.1
id: tool--da66959d-9875-4fde-bfed-11111a55895e
created: 2025-02-25T17:31:00.202Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/software/S1205
external_id: S1205
source_name: cipher.exe
description: Microsoft Support. (n.d.). Cipher.exe Security Tool for the Encrypting File System. Retrieved February 25, 2025.
url: https://support.microsoft.com/en-us/topic/cipher-exe-security-tool-for-the-encrypting-file-system-56c85edd-85cf-ac07-f2f7-ca2d35dab7e4
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
x_mitre_attack_spec_version: 3.2.0
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5