LiveActive security incident?Get immediate response
MITRE ATT&CK® Tool

S0250: Koadic

Koadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub. Koadic has several options for staging payloads and creating implants, and performs most of its operations using Windows Script Host.[1][2][3]

EnterpriseS0250ToolObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Koadic matters because it is a publicly available Windows post-exploitation framework that can stage payloads, create implants, and operate heavily through Windows Script Host. For leaders, the risk is not the tool name itself; it is whether the organization can see and control script-driven activity after a Windows host is compromised, especially when it leads to credential access, discovery, lateral movement, collection, and command-and-control behaviors mapped by ATT&CK.

Executive priority

Prioritize Koadic as a validation case for Windows endpoint readiness, identity protection, and incident response depth. The ATT&CK relationships connect it to credential access against SAM and NTDS, RDP lateral movement, WMI, scheduled tasks, PowerShell, cmd, Visual Basic, mshta, web-based command and control, tool transfer, and local/share discovery. Executives should ask whether SOC coverage proves these behaviors are logged, triaged, and escalated quickly enough to protect domain credentials, business-critical file shares, and continuity of Windows operations.

Technical view

Koadic is described by MITRE as a Windows post-exploitation and penetration testing framework available on GitHub, with multiple staging and implant options and operations using Windows Script Host. ATT&CK does not provide a dedicated detection section, so detection engineering should be behavior-led across the related techniques: script interpreter execution, mshta abuse, PowerShell/cmd/VB activity, WMI execution, scheduled task creation, DLL injection indicators, credential access attempts against SAM/NTDS, discovery commands, RDP activity, tool transfer, clipboard access, and HTTP/S-style command-and-control patterns. Treat the named group relationships as context for threat intelligence enrichment, not as proof of current activity in any environment.

Likely telemetry

  • Windows process creation and command-line logging for wscript/cscript, mshta, powershell, cmd, scheduled task utilities, and WMI-related processes
  • PowerShell script block, module, and transcript logs where enabled
  • Windows Script Host execution evidence and parent-child process relationships
  • WMI operational logs and remote execution indicators
  • Task Scheduler operational logs and new or modified scheduled task events

Detection direction

  • Build detections around chained behavior rather than the tool name: script host or mshta execution followed by discovery, credential access, tool transfer, or persistence is higher value than isolated script execution.
  • Validate coverage for Windows Script Host because MITRE specifically notes Koadic performs most operations using it.
  • Tune PowerShell, cmd, VB, WMI, and scheduled task analytics for administrative false positives; require context such as unusual parent process, rare user/host, remote execution, encoded or scripted content, or follow-on discovery.
  • Correlate credential access signals involving SAM or NTDS with preceding script execution and subsequent RDP or network share activity.
  • Use web command-and-control analytics cautiously: HTTP/S alone is common, so prioritize unusual destinations, rare user agents, beacon-like patterns, or process-to-network relationships tied to script interpreters.

Mitigation priorities

  • Harden and monitor Windows Script Host, mshta, PowerShell, WMI, scheduled tasks, and command shell usage according to business need and administrative workflows.
  • Reduce credential exposure by protecting domain controllers, restricting access to SAM/NTDS-related material, and monitoring privileged account use.
  • Limit lateral movement paths by controlling RDP access, enforcing least privilege, and reviewing where valid accounts can initiate remote sessions.
  • Restrict unnecessary script execution and tool transfer from untrusted locations while preserving approved administration use cases.
  • Ensure incident response playbooks include rapid scoping for discovery, credential access, persistence through scheduled tasks, and movement to file shares or domain controllers.
Additional notes and limits

The relationship set is useful because it shows Koadic can be associated with a broad post-exploitation sequence: execution through Windows scripting and command interpreters, discovery, credential access, lateral movement, collection, persistence, and command-and-control. Group relationships include APT28, MuddyWater, Sidewinder, and LazyScripter, but this should be used for intelligence context only unless local evidence supports attribution.

ATT&CK provides no official detection text for this object and no tactics are specified directly on the tool record. The object platform is Windows, so environment-specific validation is required for Windows logging, endpoint controls, and administrative baselines. This take does not infer active exploitation, customer exposure, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Koadic

Koadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub. Koadic has several options for staging payloads and creating implants, and performs most of its operations using Windows Script Host.[1][2][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

27 rows
DomainIDNameRelationship / procedure
EnterpriseT1016System Network Configuration Discovery

Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain.[1][3]

EnterpriseT1082System Information Discovery

Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host.[3]

EnterpriseT1059.005Visual BasicSub-technique

Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .[1]

EnterpriseT1218.005MshtaSub-technique

Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.[1][3]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

Koadic can perform process injection by using a reflective DLL.[1]

EnterpriseT1218.010Regsvr32Sub-technique

Koadic can use Regsvr32 to execute additional payloads.[1]

EnterpriseT1033System Owner/User Discovery

Koadic can identify logged in users across the domain and views user sessions.[1][3]

EnterpriseT1564.003Hidden WindowSub-technique

Koadic has used the command Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden to hide its window.[3]

EnterpriseT1003.002Security Account ManagerSub-technique

Koadic can gather hashed passwords by dumping SAM/SECURITY hive.[1]

EnterpriseT1105Ingress Tool Transfer

Koadic can download additional files and tools.[1][3]

EnterpriseT1071.001Web ProtocolsSub-technique

Koadic has used HTTP for C2 communications.[3]

EnterpriseT1047Windows Management Instrumentation

Koadic can use WMI to execute commands.[1]

EnterpriseT1059.001PowerShellSub-technique

Koadic has used PowerShell to establish persistence.[3]

EnterpriseT1115Clipboard Data

Koadic can retrieve the current content of the user clipboard.[1]

EnterpriseT1548.002Bypass User Account ControlSub-technique

Koadic has 2 methods for elevating integrity. It can bypass UAC through `eventvwr.exe` and `sdclt.exe`.[1]

EnterpriseT1046Network Service Discovery

Koadic can scan for open TCP ports on the target network.[1]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

Koadic can enable remote desktop on the victim's machine.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.[1][3]

EnterpriseT1083File and Directory Discovery

Koadic can obtain a list of directories.[3]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Koadic has added persistence to the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` Registry key.[3]

EnterpriseT1003.003NTDSSub-technique

Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.[1]

EnterpriseT1569.002Service ExecutionSub-technique

Koadic can run a command on another machine using PsExec.[1]

EnterpriseT1005Data from Local System

Koadic can download files off the target system to send back to the server.[1][3]

EnterpriseT1573.002Asymmetric CryptographySub-technique

Koadic can use SSL and TLS for communications.[1]

EnterpriseT1135Network Share Discovery

Koadic can scan local network for open SMB.[1]

EnterpriseT1218.011Rundll32Sub-technique

Koadic can use Rundll32 to execute additional payloads.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

Koadic has used scheduled tasks to add persistence.[3]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

GroupEnterprise

G0121: Sidewinder

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.[1][2][3]

GroupEnterprise

G0069: MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1218.005: MshtaEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1003.002: Security Account ManagerEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1115: Clipboard DataEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1046: Network Service DiscoveryEnterpriseuses · GroupG0007: APT28Enterpriseuses · TechniqueT1021.001: Remote Desktop ProtocolEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1003.003: NTDSEnterpriseuses · TechniqueT1569.002: Service ExecutionEnterpriseuses · GroupG0140: LazyScripterEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
17f5b11450491da1...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.0Current bundle17f5b1145049…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  2. [2]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  3. [3]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  4. [4]
    ATT Sidewinder January 2021

    Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.

    Open source URL
  5. [5]
    Reaqta MuddyWater November 2017

    Reaqta. (2017, November 22). A dive into MuddyWater APT targeting Middle-East. Retrieved May 18, 2020.

    Open source URL
  6. [6]
    TrendMicro POWERSTATS V3 June 2019

    Lunghi, D. and Horejsi, J.. (2019, June 10). MuddyWater Resurfaces, Uses Multi-Stage Backdoor POWERSTATS V3 and New Post-Exploitation Tools. Retrieved May 14, 2020.

    Open source URL
  7. [7]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  8. [8]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  9. [9]
    Koadic

    (Citation: Github Koadic)(Citation: MalwareBytes LazyScripter Feb 2021)

  10. [10]
    Koadic

    (Citation: Github Koadic)(Citation: MalwareBytes LazyScripter Feb 2021)

  11. [11]
    Koadic

    (Citation: Github Koadic)(Citation: MalwareBytes LazyScripter Feb 2021)

  12. [12]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  13. [13]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  14. [14]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  15. [15]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  16. [16]
    mitre-attackS0250
    Open source URL
  17. [17]
    mitre-attackS0250
    Open source URL
  18. [18]
    mitre-attackS0250
    Open source URL
  19. [19]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  20. [20]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  21. [21]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  22. [22]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  23. [23]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  24. [24]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  25. [25]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  26. [26]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  27. [27]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  28. [28]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  29. [29]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  30. [30]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  31. [31]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  32. [32]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  33. [33]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  34. [34]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  35. [35]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  36. [36]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  37. [37]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  38. [38]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  39. [39]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  40. [40]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  41. [41]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  42. [42]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  43. [43]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  44. [44]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  45. [45]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  46. [46]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  47. [47]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  48. [48]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  49. [49]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  50. [50]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  51. [51]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  52. [52]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  53. [53]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  54. [54]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  55. [55]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  56. [56]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  57. [57]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  58. [58]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  59. [59]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  60. [60]
    Palo Alto Sofacy 06-2018

    Lee, B., Falcone, R. (2018, June 06). Sofacy Group’s Parallel Attacks. Retrieved June 18, 2018.

    Open source URL
  61. [61]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  62. [62]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  63. [63]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  64. [64]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  65. [65]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  66. [66]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  67. [67]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  68. [68]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  69. [69]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  70. [70]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  71. [71]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  72. [72]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  73. [73]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  74. [74]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  75. [75]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  76. [76]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  77. [77]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  78. [78]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  79. [79]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  80. [80]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
  81. [81]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  82. [82]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  83. [83]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  84. [84]
    Github Koadic

    Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.

    Open source URL
  85. [85]
    MalwareBytes LazyScripter Feb 2021

    Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use