← All techniques and the coverage heatmap

Reports

Each report maps this technique in its own ATT&CK table, at the confidence the report states. The link opens that table.

Detection rules

No published detection rule on the site covers this technique yet.

Tracked actors

Designations whose reports map this technique.

• UTA-2026-021: Assembler-model intrusion operator staging other actors' tooling against one German victim forest
• UTA-2026-024: Windows post-exploitation intrusion set with Sliver and a blockchain-resolved implant

ATT&CK v19.2. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; technique names are MITRE's and link to MITRE's own pages. The mapping on each linked page is this publication's reading of its own evidence.