LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0532: Lucifer

Lucifer is a crypto miner and DDoS hybrid malware that leverages well-known exploits to spread laterally on Windows platforms.[1]

EnterpriseS0532MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Lucifer matters because ATT&CK describes it as Windows malware combining cryptomining with DDoS capability and lateral spread through well-known exploits. For leaders, the practical risk is not just malware cleanup: it can consume compute, degrade services, move across Windows environments, and create incident-response pressure where vulnerability management, endpoint visibility, SMB/WMI controls, and log retention are weak.

Executive priority

Prioritize Lucifer-style behavior as a resilience and control-validation issue for Windows environments. Ask whether critical Windows systems are patched against known remote-service vulnerabilities, whether lateral movement over SMB and WMI is monitored, whether abnormal compute/network consumption would trigger response, and whether Windows event logs are protected from clearing. This object has no official ATT&CK detection guidance, so confidence should come from local telemetry validation, not from assuming named-malware coverage.

Technical view

SOC and IR teams should validate coverage across the related ATT&CK behaviors: discovery of registry, users, processes, system/network configuration, services, and connections; execution via Windows command shell and WMI; persistence through Scheduled Tasks and Registry Run Keys/Startup Folder; lateral movement and transfer via SMB/Windows Admin Shares, exploitation of remote services, and lateral tool transfer; command-and-control using application-layer protocols and symmetric cryptography; defense impairment through Windows event log clearing; and impact patterns consistent with compute hijacking and network DoS. Because the malware object is Windows-scoped and detection text is not provided, detections should be behavior-led and correlated rather than dependent on a single signature.

Likely telemetry

  • Windows process creation and command-line telemetry, especially cmd.exe, schtasks, reg, WMI-related execution, discovery commands, and file transfer utilities
  • Windows Registry auditing for Run Keys, startup persistence, and registry queries where available
  • Scheduled Task creation, modification, and execution events
  • WMI activity, including local and remote execution indicators
  • SMB and Windows Admin Share access logs, file copy events, and authentication records

Detection direction

  • Build detections around sequences: discovery commands followed by tool transfer, SMB/WMI execution, persistence creation, and abnormal compute or network usage.
  • Tune for administrative false positives by baselining legitimate WMI, scheduled task, registry, SMB admin share, and service-discovery activity by host role and admin identity.
  • Correlate password guessing and failed authentication patterns with subsequent SMB or remote-service access attempts where telemetry exists.
  • Validate that event-log clearing is detected quickly and that downstream logging preserves evidence when endpoint logs are deleted.
  • Account for software packing and deobfuscation by combining static file signals with runtime behavior, child processes, network activity, and persistence artifacts.

Mitigation priorities

  • Maintain a vulnerability-management priority lane for high-risk Windows remote services and externally or broadly reachable internal services.
  • Restrict and monitor SMB/Windows Admin Shares and WMI remote execution to approved administrative paths and identities.
  • Harden credential controls against password guessing, including account policy, monitoring, and response workflows appropriate to the environment.
  • Limit unnecessary lateral movement paths through segmentation and least-privilege administration.
  • Control persistence opportunities by monitoring and governing Scheduled Tasks, Registry Run Keys, and startup locations.
Additional notes and limits

The strongest decision value from this ATT&CK object is the combination of Windows malware, exploitation-enabled spread, discovery-heavy behavior, persistence, lateral movement, command-and-control, compute hijacking, and network DoS-related impact. This supports a control validation exercise across endpoint, identity, network, vulnerability management, and incident response rather than a narrow malware-family lookup.

The supplied ATT&CK object does not provide official detection guidance, aliases, labels, or malware-level tactics. Several related techniques list broader platforms, but the Lucifer malware object itself is scoped to Windows; do not infer Lucifer coverage on other platforms from those relationships alone. Local environment evidence is required to determine exposure, detection coverage, and prioritization.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Lucifer

Lucifer is a crypto miner and DDoS hybrid malware that leverages well-known exploits to spread laterally on Windows platforms.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

24 rows
DomainIDNameRelationship / procedure
EnterpriseT1496.001Compute HijackingSub-technique

Lucifer can use system resources to mine cryptocurrency, dropping XMRig to mine Monero.[1]

EnterpriseT1016System Network Configuration Discovery

Lucifer can collect the IP address of a compromised host.[1]

EnterpriseT1049System Network Connections Discovery

Lucifer can identify the IP and port numbers for all remote connections from the compromised host.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Lucifer can decrypt its C2 address upon execution.[1]

EnterpriseT1057Process Discovery

Lucifer can identify the process that owns remote connections.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

Lucifer can persist by setting Registry key values HKLM\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic.[1]

EnterpriseT1105Ingress Tool Transfer

Lucifer can download and execute a replica of itself using certutil.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.[1]

EnterpriseT1033System Owner/User Discovery

Lucifer has the ability to identify the username on a compromised host.[1]

EnterpriseT1570Lateral Tool Transfer

Lucifer can use certutil for propagation on Windows hosts within intranets.[1]

EnterpriseT1497.001System ChecksSub-technique

Lucifer can check for specific usernames, computer names, device drivers, DLL's, and virtual devices associated with sandboxed environments and can enter an infinite loop and stop itself if any are detected.[1]

EnterpriseT1027.002Software PackingSub-technique

Lucifer has used UPX packed binaries.[1]

EnterpriseT1053.005Scheduled TaskSub-technique

Lucifer has established persistence by creating the following scheduled task schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F.[1]

EnterpriseT1082System Information Discovery

Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.[1]

EnterpriseT1110.001Password GuessingSub-technique

Lucifer has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and passwords.[1]

EnterpriseT1498Network Denial of Service

Lucifer can execute TCP, UDP, and HTTP denial of service (DoS) attacks.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Lucifer can issue shell commands to download and execute additional payloads.[1]

EnterpriseT1071Application Layer Protocol

Lucifer can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server.[1]

EnterpriseT1210Exploitation of Remote Services

Lucifer can exploit multiple vulnerabilities including EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0144).[1]

EnterpriseT1685.005Clear Windows Event LogsSub-technique

Lucifer can clear and remove event logs.[1]

EnterpriseT1046Network Service Discovery

Lucifer can scan for open ports including TCP ports 135 and 1433.[1]

EnterpriseT1021.002SMB/Windows Admin SharesSub-technique

Lucifer can infect victims by brute forcing SMB.[1]

EnterpriseT1012Query Registry

Lucifer can check for existing stratum cryptomining information in HKLM\Software\Microsoft\Windows\CurrentVersion\spreadCpuXmr – %stratum info%.[1]

EnterpriseT1047Windows Management Instrumentation

Lucifer can use WMI to log into remote machines for propagation.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1496.001: Compute HijackingEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1570: Lateral Tool TransferEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1110.001: Password GuessingEnterpriseuses · TechniqueT1498: Network Denial of ServiceEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1071: Application Layer ProtocolEnterpriseuses · TechniqueT1210: Exploitation of Remote ServicesEnterpriseuses · TechniqueT1685.005: Clear Windows Event LogsEnterpriseuses · TechniqueT1046: Network Service DiscoveryEnterpriseuses · TechniqueT1021.002: SMB/Windows Admin SharesEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1047: Windows Management InstrumentationEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
13c892239ec165cf...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle13c892239ec1…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  2. [2]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  3. [3]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  4. [4]
    mitre-attackS0532
    Open source URL
  5. [5]
    mitre-attackS0532
    Open source URL
  6. [6]
    mitre-attackS0532
    Open source URL
  7. [7]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  8. [8]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  9. [9]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  10. [10]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  11. [11]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  12. [12]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  13. [13]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  14. [14]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  15. [15]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  16. [16]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  17. [17]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  18. [18]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  19. [19]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  20. [20]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  21. [21]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  22. [22]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  23. [23]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  24. [24]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  25. [25]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  26. [26]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  27. [27]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  28. [28]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  29. [29]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  30. [30]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  31. [31]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  32. [32]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  33. [33]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  34. [34]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  35. [35]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  36. [36]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  37. [37]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  38. [38]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  39. [39]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  40. [40]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  41. [41]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  42. [42]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  43. [43]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  44. [44]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  45. [45]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  46. [46]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  47. [47]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  48. [48]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  49. [49]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
  50. [50]
    Unit 42 Lucifer June 2020

    Hsu, K. et al. (2020, June 24). Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices. Retrieved November 16, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use