Live Active security incident? Get immediate response
MITRE ATT&CK® Malware

S0331: Agent Tesla

Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.[1][2][3]

EnterpriseS0331MalwareObject v1.3 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Agent Tesla matters because it is a Windows .NET spyware Trojan associated in ATT&CK with credential and user activity collection behaviors such as keylogging, screen capture, clipboard access, video capture, discovery, command-and-control, and exfiltration techniques. For leaders, the practical issue is not the malware name alone; it is whether Windows endpoint, identity, email, and network controls can prove they would expose credential theft and data collection before stolen access creates wider business risk.

Executive priority

Prioritize this as a validation case for endpoint visibility, credential protection, phishing-driven malware response, and incident evidence quality. ATT&CK links Agent Tesla to groups including SilverTerrier and TA2541, with TA2541 described as using high-volume campaigns and commodity remote access tools in aviation, aerospace, transportation, manufacturing, and defense contexts. Executives should ask whether the organization can rapidly determine which users, credentials, hosts, and outbound channels were exposed if spyware is found on a Windows endpoint.

Technical view

SOC and IR teams should validate coverage against the ATT&CK-linked behaviors rather than relying on a malware family signature. Confirm visibility for Windows process creation, .NET execution artifacts, WMI activity, scheduled task creation, registry modification, process injection or hollowing indicators, local account and system discovery, Wi-Fi discovery, keylogging-related suspicious access patterns, screen or clipboard capture, outbound web and mail protocol communications, ingress tool transfer, and possible unencrypted exfiltration. Because MITRE provides no official detection text for this object, detection engineering should map local analytics to the related techniques and test whether telemetry is retained long enough for credential-exposure scoping.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • EDR events for process injection, process hollowing, and suspicious child processes
  • Windows Scheduled Task and Task Scheduler operational logs
  • Windows Registry modification events
  • WMI activity and related process execution records

Detection direction

  • Build detections around behavior chains: discovery followed by persistence, collection, outbound communications, or exfiltration is more meaningful than any single generic command.
  • Tune WMI, scheduled task, and registry alerts for unusual parent processes, user context, file paths, recurrence, and proximity to suspicious executable or .NET activity.
  • Correlate keylogging, screen capture, clipboard access, or video capture signals with outbound web or mail protocol traffic to reduce false positives from legitimate administration or collaboration software.
  • Monitor for suspicious use of mail protocols and web protocols from endpoints that do not normally initiate such traffic directly.
  • Treat process injection and process hollowing detections as high-value triage pivots, but validate against legitimate security, management, and software update tools that may create noise.

Mitigation priorities

  • Harden Windows endpoints first: maintain endpoint protection, application control where feasible, least privilege, and controls that restrict unauthorized persistence through scheduled tasks and registry changes.
  • Reduce credential exposure by enforcing MFA, monitoring risky sign-ins, rotating credentials when spyware exposure is confirmed, and limiting local account reuse.
  • Improve egress control by restricting unnecessary direct outbound web and mail protocol use from workstations and logging allowed paths.
  • Limit abuse of administrative features such as WMI through least privilege, administrative segmentation, and monitoring of remote or unusual use.
  • Strengthen email and attachment defenses as part of readiness, while recognizing this object’s supplied ATT&CK fields do not define a specific delivery method.
Analyst notes and limits

Agent Tesla is represented here as a Windows .NET spyware Trojan observed since at least 2014. ATT&CK relationships provide the main defensive value: they connect the malware to discovery, credential access, collection, persistence, defense evasion, command-and-control, ingress transfer, and exfiltration techniques. The SilverTerrier and TA2541 relationships are useful threat-intelligence context but should not be treated as proof of attribution in any local incident without supporting evidence.

The supplied ATT&CK object has no official detection section, no object-level tactics, no aliases, and limited platform detail beyond Windows. Several related techniques list broader platforms, but Agent Tesla should not be treated as supported on those platforms based only on this object. Local telemetry, malware samples, delivery evidence, and environment-specific baselines are required to make detection, exposure, or attribution claims.

Official MITRE ATT&CK definition

Agent Tesla

Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

37 rows
Domain ID Name Relationship / procedure
Enterprise T1055 Process Injection

Agent Tesla can inject into known, vulnerable binaries on targeted hosts.CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1497 Virtualization/Sandbox Evasion

Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks.CitationMalwarebytes Agent Tesla April 2020
Enterprise T1115 Clipboard Data

Agent Tesla can steal data from the victim’s clipboard.CitationTalos Agent Tesla Oct 2018CitationFortinet Agent Tesla April 2018CitationFortinet Agent Tesla June 2017CitationBitdefender Agent Tesla April 2020
Enterprise T1566.001 Spearphishing Attachment Sub-technique

The primary delivered mechanism for Agent Tesla is through email phishing messages.CitationBitdefender Agent Tesla April 2020
Enterprise T1113 Screen Capture

Agent Tesla can capture screenshots of the victim’s desktop.CitationTalos Agent Tesla Oct 2018CitationDigiTrust Agent Tesla Jan 2017CitationFortinet Agent Tesla April 2018CitationFortinet Agent Tesla June 2017CitationBitdefender Agent Tesla April 2020
Enterprise T1087.001 Local Account Sub-technique

Agent Tesla can collect account information from the victim’s machine.CitationDigiTrust Agent Tesla Jan 2017
Enterprise T1547.001 Registry Run Keys / Startup Folder Sub-technique

Agent Tesla can add itself to the Registry as a startup program to establish persistence.CitationFortinet Agent Tesla April 2018CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1552.001 Credentials In Files Sub-technique

Agent Tesla has the ability to extract credentials from configuration or support files.CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1047 Windows Management Instrumentation

Agent Tesla has used wmi queries to gather information from the system.CitationBitdefender Agent Tesla April 2020
Enterprise T1204.002 Malicious File Sub-technique

Agent Tesla has been executed through malicious e-mail attachments CitationBitdefender Agent Tesla April 2020
Enterprise T1203 Exploitation for Client Execution

Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1016 System Network Configuration Discovery

Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.CitationDigiTrust Agent Tesla Jan 2017CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1218.009 Regsvcs/Regasm Sub-technique

Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1124 System Time Discovery

Agent Tesla can collect the timestamp from the victim’s machine.CitationDigiTrust Agent Tesla Jan 2017
Enterprise T1033 System Owner/User Discovery

Agent Tesla can collect the username from the victim’s machine.CitationDigiTrust Agent Tesla Jan 2017CitationFortinet Agent Tesla April 2018CitationMalwarebytes Agent Tesla April 2020
Enterprise T1105 Ingress Tool Transfer

Agent Tesla can download additional files for execution on the victim’s machine.CitationTalos Agent Tesla Oct 2018CitationDigiTrust Agent Tesla Jan 2017
Enterprise T1057 Process Discovery

Agent Tesla can list the current running processes on the system.CitationFortinet Agent Tesla June 2017
Enterprise T1555.003 Credentials from Web Browsers Sub-technique

Agent Tesla can gather credentials from a number of browsers.CitationBitdefender Agent Tesla April 2020
Enterprise T1125 Video Capture

Agent Tesla can access the victim’s webcam and record video.CitationDigiTrust Agent Tesla Jan 2017CitationTalos Agent Tesla Oct 2018
Enterprise T1027 Obfuscated Files or Information

Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult.CitationFortinet Agent Tesla April 2018 Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.CitationMalwarebytes Agent Tesla April 2020
Enterprise T1185 Browser Session Hijacking

Agent Tesla has the ability to use form-grabbing to extract data from web data forms.CitationBitdefender Agent Tesla April 2020
Enterprise T1071.001 Web Protocols Sub-technique

Agent Tesla has used HTTP for C2 communications.CitationDigiTrust Agent Tesla Jan 2017CitationFortinet Agent Tesla June 2017
Enterprise T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol Sub-technique

Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.CitationTalos Agent Tesla Oct 2018CitationBitdefender Agent Tesla April 2020CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1564.003 Hidden Window Sub-technique

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows.CitationMalwarebytes Agent Tesla April 2020
Enterprise T1056.001 Keylogging Sub-technique

Agent Tesla can log keystrokes on the victim’s machine.CitationTalos Agent Tesla Oct 2018CitationDigiTrust Agent Tesla Jan 2017CitationFortinet Agent Tesla June 2017CitationBitdefender Agent Tesla April 2020CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1053.005 Scheduled Task Sub-technique

Agent Tesla has achieved persistence via scheduled tasks.CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1564.001 Hidden Files and Directories Sub-technique

Agent Tesla has created hidden folders.CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1140 Deobfuscate/Decode Files or Information

Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.CitationMalwarebytes Agent Tesla April 2020
Enterprise T1555 Credentials from Password Stores

Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.CitationMalwarebytes Agent Tesla April 2020
Enterprise T1685 Disable or Modify Tools

Agent Tesla has the capability to kill any running analysis processes and AV software.CitationFortinet Agent Tesla June 2017
Enterprise T1082 System Information Discovery

Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.CitationFortinet Agent Tesla April 2018CitationFortinet Agent Tesla June 2017CitationMalwarebytes Agent Tesla April 2020
Enterprise T1560 Archive Collected Data

Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.CitationTalos Agent Tesla Oct 2018
Enterprise T1071.003 Mail Protocols Sub-technique

Agent Tesla has used SMTP for C2 communications.CitationCofense Agent TeslaCitationFortinet Agent Tesla June 2017CitationBitdefender Agent Tesla April 2020
Enterprise T1112 Modify Registry

Agent Tesla can achieve persistence by modifying Registry key entries.CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1055.012 Process Hollowing Sub-technique

Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1552.002 Credentials in Registry Sub-technique

Agent Tesla has the ability to extract credentials from the Registry.CitationSentinelLabs Agent Tesla Aug 2020
Enterprise T1016.002 Wi-Fi Discovery Sub-technique

Agent Tesla can collect names and passwords of all Wi-Fi networks to which a device has previously connected.CitationMalwarebytes Agent Tesla April 2020
Associated objects

Groups, software, and campaigns

Group Enterprise

G1018: TA2541

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]

Relationship explorer

All related ATT&CK context

uses · Technique T1055: Process Injection Enterprise uses · Technique T1497: Virtualization/Sandbox Evasion Enterprise uses · Technique T1115: Clipboard Data Enterprise uses · Technique T1566.001: Spearphishing Attachment Enterprise uses · Technique T1113: Screen Capture Enterprise uses · Technique T1087.001: Local Account Enterprise uses · Technique T1547.001: Registry Run Keys / Startup Folder Enterprise uses · Technique T1552.001: Credentials In Files Enterprise uses · Technique T1047: Windows Management Instrumentation Enterprise uses · Technique T1204.002: Malicious File Enterprise uses · Technique T1203: Exploitation for Client Execution Enterprise uses · Technique T1016: System Network Configuration Discovery Enterprise uses · Technique T1218.009: Regsvcs/Regasm Enterprise uses · Technique T1124: System Time Discovery Enterprise uses · Technique T1033: System Owner/User Discovery Enterprise uses · Technique T1105: Ingress Tool Transfer Enterprise uses · Technique T1057: Process Discovery Enterprise uses · Technique T1555.003: Credentials from Web Browsers Enterprise uses · Technique T1125: Video Capture Enterprise uses · Technique T1027: Obfuscated Files or Information Enterprise uses · Technique T1185: Browser Session Hijacking Enterprise uses · Technique T1071.001: Web Protocols Enterprise uses · Technique T1048.003: Exfiltration Over Unencrypted Non-C2 Protocol Enterprise uses · Technique T1564.003: Hidden Window Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
83691898ec4c722b...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.3 Current bundle 83691898ec4c…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Fortinet Agent Tesla April 2018

    Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.

    Open source URL
  2. [2]
    Bitdefender Agent Tesla April 2020

    Arsene, L. (2020, April 21). Oil & Gas Spearphishing Campaigns Drop Agent Tesla Spyware in Advance of Historic OPEC+ Deal. Retrieved May 19, 2020.

    Open source URL
  3. [3]
    Malwarebytes Agent Tesla April 2020

    Jazi, H. (2020, April 16). New AgentTesla variant steals WiFi credentials. Retrieved May 19, 2020.

    Open source URL
  4. [4]
    Agent Tesla

    (Citation: Fortinet Agent Tesla April 2018)(Citation: Talos Agent Tesla Oct 2018)(Citation: DigiTrust Agent Tesla Jan 2017)

  5. [5]
    DigiTrust Agent Tesla Jan 2017

    The DigiTrust Group. (2017, January 12). The Rise of Agent Tesla. Retrieved November 5, 2018.

    Open source URL
  6. [6]
    Talos Agent Tesla Oct 2018

    Brumaghin, E., et al. (2018, October 15). Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox. Retrieved November 5, 2018.

    Open source URL
  7. [7]
    mitre-attack S0331
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use