MITRE ATT&CK® Reference

Software

Malware and tool entries linked to techniques, groups, and campaigns.

1,006 records · validated library

Software results

Results are validated against normalized ATT&CK source records when available; sample records are used only in development or empty-data environments.

Sort by ID Recently modified Include historical

S0227: spwebmember

spwebmember is a Microsoft SharePoint enumeration and data dumping tool written in .NET. [1]

Windows

S0225: sqlmap

sqlmap is an open source penetration testing tool that can be used to automate the process of detecting and exploiting SQL injection flaws. [1]

xCaon is an HTTP variant of the BoxCaon malware family that has used by IndigoZebra since at least 2014. xCaon has been used to target political entities in Central Asia, including Kyrgyzstan and Uzbekistan.[1][2]

Windows

S0123: xCmd

xCmd is an open source tool that is similar to PsExec and allows the user to execute applications on remote systems. [1]

S0248: yty

yty is a modular, plugin-based malware framework. The components of the framework are written in a variety of programming languages. [1]

Windows

S0350: zwShell

zwShell is a remote access tool (RAT) written in Delphi that has been seen in the wild since the spring of 2010 and used by threat actors during Night Dragon.[1]

Windows

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use

Software

Software results

S0227: spwebmember

S0225: sqlmap

S0653: xCaon

S0123: xCmd

S0248: yty

S0350: zwShell