LiveActive security incident?Get immediate response
MITRE ATT&CK® Tool

S0378: PoshC2

PoshC2 is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in PowerShell. Although PoshC2 is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.[1]

EnterpriseS0378ToolObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

PoshC2 matters because it is a publicly available remote administration and post-exploitation framework with PowerShell-based implants and cross-platform elements. For leaders, the risk is not the tool name alone; it is the range of behaviors ATT&CK associates with it: credential access, discovery, privilege escalation, collection, command-and-control over web protocols, and proxying. Its presence or suspected use should trigger validation of endpoint, identity, and network visibility across Windows first, with Linux and macOS considered where relevant.

Executive priority

Prioritize PoshC2 as a readiness and resilience issue: can the organization rapidly confirm whether credential material, local/domain account information, network topology, and sensitive files were accessed after an endpoint compromise? Because ATT&CK links this tool to use by Sandworm Team, APT33, and HEXANE, it is relevant for threat-informed defense programs, especially in sectors or geographies that track those groups. Budget and control decisions should focus on credential protection, PowerShell and process behavior visibility, network egress monitoring, and incident response evidence retention rather than relying on tool-name detections.

Technical view

ATT&CK does not provide a dedicated detection section for PoshC2, so SOC and IR teams should validate coverage through the techniques mapped to the tool. On Windows, focus on PowerShell execution, LSASS memory access, WMI execution, token manipulation, process injection, local/domain account and group enumeration, service discovery, file and directory discovery, and web-based command-and-control. Across Linux and macOS, validate telemetry for service, account, network configuration, network connection, file, and system discovery, plus signs of network sniffing, proxy use, brute force activity, and automated collection. Treat detections as behavior chains rather than single alerts: discovery followed by credential access, privilege escalation, collection, and web/proxy C2 is more decision-useful than any one event in isolation.

Likely telemetry

  • Endpoint process creation and command-line telemetry, especially PowerShell on Windows
  • PowerShell script block/module logging or equivalent PowerShell activity records where enabled
  • Windows security events and endpoint telemetry for LSASS access, token use, privilege changes, and suspicious child processes
  • WMI activity logs and process lineage for local or remote command execution
  • Account and group enumeration evidence from host logs, identity logs, and command execution records

Detection direction

  • Build detections around ATT&CK-mapped behaviors rather than the PoshC2 name, because the official object provides no detection guidance.
  • Correlate PowerShell activity with follow-on discovery, credential access, WMI execution, token manipulation, process injection, collection, and outbound web/proxy communications.
  • Tune discovery detections carefully: commands that enumerate services, accounts, files, and network settings can be legitimate administrative activity, so prioritize unusual users, hosts, timing, parent processes, and sequences.
  • Validate whether LSASS access and credential dumping controls generate actionable telemetry, not just prevention events.
  • Review HTTP/S and proxy egress for unusual destinations, uncommon clients, abnormal beacon-like patterns, or endpoint-to-endpoint proxy behavior, while accounting for normal enterprise web traffic volume.

Mitigation priorities

  • Harden credential exposure first: restrict administrative privileges, protect LSASS where applicable, and monitor privileged account use.
  • Improve PowerShell governance and logging on Windows, including visibility into script execution and suspicious process lineage.
  • Reduce lateral movement and remote execution opportunity by tightening WMI and administrative access paths to only required users and systems.
  • Apply least privilege and strong authentication controls to reduce the value of account discovery and brute force attempts.
  • Maintain vulnerability and patch management discipline to reduce opportunities for exploitation-based privilege escalation.
Additional notes and limits

The official description identifies PoshC2 as an open source remote administration and post-exploitation framework with Python server-side components, PowerShell implants, primary Windows focus, and a basic Python dropper for Linux/macOS. ATT&CK relationships map it to multiple techniques across credential access, discovery, execution, privilege escalation, stealth, collection, and command-and-control, and to use by Sandworm Team, APT33, and HEXANE. These relationships support threat-informed detection engineering but should not be treated as automatic attribution.

ATT&CK provides no official detection text for this software object, and the supplied fields do not include indicators, default infrastructure, specific commands, or confirmed active exploitation. Defensive conclusions must be validated against the organization’s actual platforms, logging configuration, administrative baselines, and incident evidence.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

PoshC2

PoshC2 is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in PowerShell. Although PoshC2 is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

32 rows
DomainIDNameRelationship / procedure
EnterpriseT1016System Network Configuration Discovery

PoshC2 can enumerate network adapter information.[1]

EnterpriseT1552.001Credentials In FilesSub-technique

PoshC2 contains modules for searching for passwords in local and remote files.[1]

EnterpriseT1557.001Name Resolution Poisoning and SMB RelaySub-technique

PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

PoshC2 can use protocols like HTTP/HTTPS for command and control traffic.[1]

EnterpriseT1047Windows Management Instrumentation

PoshC2 has a number of modules that use WMI to execute tasks.[1]

EnterpriseT1049System Network Connections Discovery

PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.[1]

EnterpriseT1068Exploitation for Privilege Escalation

PoshC2 contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099.[1]

EnterpriseT1007System Service Discovery

PoshC2 can enumerate service and service permission information.[1]

EnterpriseT1134.002Create Process with TokenSub-technique

PoshC2 can use Invoke-RunAs to make tokens.[1]

EnterpriseT1548.002Bypass User Account ControlSub-technique

PoshC2 can utilize multiple methods to bypass UAC.[1]

EnterpriseT1569.002Service ExecutionSub-technique

PoshC2 contains an implementation of PsExec for remote execution.[1]

EnterpriseT1087.001Local AccountSub-technique

PoshC2 can enumerate local and domain user account information.[1]

EnterpriseT1119Automated Collection

PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.[1]

EnterpriseT1082System Information Discovery

PoshC2 contains modules, such as Get-ComputerInfo, for enumerating common system information.[1]

EnterpriseT1056.001KeyloggingSub-technique

PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.[1]

EnterpriseT1087.002Domain AccountSub-technique

PoshC2 can enumerate local and domain user account information.[1]

EnterpriseT1560.001Archive via UtilitySub-technique

PoshC2 contains a module for compressing data using ZIP.[1]

EnterpriseT1550.002Pass the HashSub-technique

PoshC2 has a number of modules that leverage pass the hash for lateral movement.[1]

EnterpriseT1069.001Local GroupsSub-technique

PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.[1]

EnterpriseT1083File and Directory Discovery

PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.[1]

EnterpriseT1090Proxy

PoshC2 contains modules that allow for use of proxies in command and control.[1]

EnterpriseT1110Brute Force

PoshC2 has modules for brute forcing local administrator and AD user accounts.[1]

EnterpriseT1003.001LSASS MemorySub-technique

PoshC2 contains an implementation of Mimikatz to gather credentials from memory.[1]

EnterpriseT1055Process Injection

PoshC2 contains multiple modules for injecting into processes, such as Invoke-PSInject.[1]

EnterpriseT1210Exploitation of Remote Services

PoshC2 contains a module for exploiting SMB via EternalBlue.[1]

EnterpriseT1482Domain Trust Discovery

PoshC2 has modules for enumerating domain trusts.[1]

EnterpriseT1134Access Token Manipulation

PoshC2 can use Invoke-TokenManipulation for manipulating tokens.[1]

EnterpriseT1046Network Service Discovery

PoshC2 can perform port scans from an infected host.[1]

EnterpriseT1555Credentials from Password Stores

PoshC2 can decrypt passwords stored in the RDCMan configuration file.[5]

EnterpriseT1040Network Sniffing

PoshC2 contains a module for taking packet captures on compromised hosts.[1]

EnterpriseT1546.003Windows Management Instrumentation Event SubscriptionSub-technique

PoshC2 has the ability to persist on a system using WMI events.[1]

EnterpriseT1201Password Policy Discovery

PoshC2 can use Get-PassPol to enumerate the domain password policy.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0064: APT33

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.[1][2]

GroupEnterprise

G0034: Sandworm Team

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.[1][2] This group has been active since at least 2009.[3][4][5][6]

In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.[1][2] Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.[7]

GroupEnterprise

G1001: HEXANE

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1552.001: Credentials In FilesEnterpriseuses · TechniqueT1557.001: Name Resolution Poisoning and SMB RelayEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1068: Exploitation for Privilege EscalationEnterpriseuses · GroupG0064: APT33Enterpriseuses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1134.002: Create Process with TokenEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1569.002: Service ExecutionEnterpriseuses · TechniqueT1087.001: Local AccountEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1087.002: Domain AccountEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · TechniqueT1550.002: Pass the HashEnterpriseuses · TechniqueT1069.001: Local GroupsEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1110: Brute ForceEnterpriseuses · TechniqueT1003.001: LSASS MemoryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
44d6967fd5a7d9ca...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.3Current bundle44d6967fd5a7…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  2. [2]
    FireEye APT33 Guardrail

    Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.

    Open source URL
  3. [3]
    Symantec Elfin Mar 2019

    Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.

    Open source URL
  4. [4]
    mandiant_apt44_unearthing_sandworm

    Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.

    Open source URL
  5. [5]
    SecureWorks August 2019

    SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19

    Open source URL
  6. [6]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  7. [7]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  8. [8]
    mitre-attackS0378
    Open source URL
  9. [9]
    mitre-attackS0378
    Open source URL
  10. [10]
    mitre-attackS0378
    Open source URL
  11. [11]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  12. [12]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  13. [13]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  14. [14]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  15. [15]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  16. [16]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  17. [17]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  18. [18]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  19. [19]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  20. [20]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  21. [21]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  22. [22]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  23. [23]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  24. [24]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  25. [25]
    FireEye APT33 Guardrail

    Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.

    Open source URL
  26. [26]
    Symantec Elfin Mar 2019

    Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.

    Open source URL
  27. [27]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  28. [28]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  29. [29]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  30. [30]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  31. [31]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  32. [32]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  33. [33]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  34. [34]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  35. [35]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  36. [36]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  37. [37]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  38. [38]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  39. [39]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  40. [40]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  41. [41]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  42. [42]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  43. [43]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  44. [44]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  45. [45]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  46. [46]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  47. [47]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  48. [48]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  49. [49]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  50. [50]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  51. [51]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  52. [52]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  53. [53]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  54. [54]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  55. [55]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  56. [56]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  57. [57]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  58. [58]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  59. [59]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  60. [60]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  61. [61]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  62. [62]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  63. [63]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  64. [64]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  65. [65]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  66. [66]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  67. [67]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  68. [68]
    SecureWorks August 2019

    SecureWorks 2019, August 27 LYCEUM Takes Center Stage in Middle East Campaign Retrieved. 2019/11/19

    Open source URL
  69. [69]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  70. [70]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
  71. [71]
    GitHub PoshC2

    Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use