Espionage backdoors are built to stay quiet for months, and most of the names in this category will never appear in a headline, yet each one is a documented pattern a defender can hunt for. This hub covers the 187 MITRE ATT&CK v20 software entries in the espionage backdoors and implants category whose names run from M to Z, from Machete to ZxxZ. Names from A to L are in the companion ATT&CK Espionage Backdoors and Implants Software Hub. The behaviour counts on this page were computed from the ATT&CK v20 technique relationships for every member, not estimated. It is written for threat hunters, detection engineers and CTI analysts who need to turn a malware name in a report into telemetry and controls.
Key takeaways
- Windows dominates. 187 entries, all typed as malware in ATT&CK; 180 list Windows as a platform, while Linux, macOS, containers and Android appear only a handful of times.
- Download, discover, phone home. The three most shared techniques are T1105 Ingress Tool Transfer (105 members), T1082 System Information Discovery (95) and T1071.001 Web Protocols (91): most implants pull more tooling over HTTP or HTTPS after profiling the host.
- Persistence is ordinary. Registry Run keys (54 members), scheduled tasks (32) and Windows services (31) carry most of the persistence, so autostart auditing still catches a large share of the long tail.
- Attribution is concentrated. 161 entries have at least one associated group in ATT&CK v20; APT29, OilRig, NIMBUS MANTICORE and MuddyWater account for the most members, and 26 entries have no group recorded.
- Behaviour beats names. Hash and name indicators age quickly; the shared behaviours below stay stable across families and are the better investment for detection.
What this category covers
NHI Mgmt Group groups the ATT&CK software catalogue into hubs. This category holds custom backdoors, implants and modular espionage platforms whose main purpose is long-term covert access and collection, typically operated by state-linked groups, plus a smaller number of criminal backdoors with similar behaviour such as More_eggs (used by FIN6 and Cobalt Group according to ATT&CK). General-purpose remote access trojans, post-exploitation frameworks and loaders sit in their own hubs: see the ATT&CK Remote Access Trojans Software Hub, the ATT&CK C2 and Post-Exploitation Frameworks Software Hub and the ATT&CK Loaders and Droppers Software Hub.
A few members show why the category matters beyond endpoint hygiene, using ATT&CK's own descriptions:
- Supply chain implants: SUNSPOT injected the SUNBURST backdoor into the SolarWinds Orion software update framework, and ATT&CK records SUNSPOT as used by APT29 since at least February 2020. ShadowPad was first identified in a supply chain compromise of NetSarang software in 2017 and has since been used by several China-linked groups. See the Software Supply Chain Security Guide.
- Identity infrastructure implants: Skeleton Key injects false credentials into domain controllers to create a backdoor password, and ATT&CK notes that Mimikatz carries similar functionality as a module.
- Long-lived platforms: ATT&CK describes Regin as a malware platform with timestamps dating back to 2003, and Uroburos as an espionage tool used by FSB units associated with Turla that has had several variants.
- Stealthy persistence: Tarrask, used by HAFNIUM according to ATT&CK, was designed to maintain persistence through concealed scheduled tasks.
- Cloud-adjacent targets: Siloscape targets Kubernetes clusters through Windows containers and was first observed in March 2021.
Common behaviours across members
The table counts how many of the 187 members ATT&CK v20 links to each technique through a "uses" relationship. It shows where shared detection effort pays off most.
| Technique | Members | Tactic focus | Defensive angle |
|---|---|---|---|
| T1105 Ingress Tool Transfer | 105 | Command and control | Alert on unusual processes writing executables after outbound web requests |
| T1082 System Information Discovery | 95 | Discovery | Baseline which processes call host profiling commands and APIs |
| T1071.001 Web Protocols | 91 | Command and control | Proxy logging, TLS inspection where lawful, beacon interval analysis |
| T1059.003 Windows Command Shell | 77 | Execution | Parent and child process analytics on cmd.exe |
| T1083 File and Directory Discovery | 71 | Discovery | Bulk directory enumeration by non-user processes |
| T1057 Process Discovery | 64 | Discovery | Process listing from unexpected binaries |
| T1140 Deobfuscate/Decode Files or Information | 62 | Stealth | Script block logging; decoded payload written to disk |
| T1016 System Network Configuration Discovery | 62 | Discovery | ipconfig, route and ARP queries from services |
| T1070.004 File Deletion | 61 | Stealth | Self-deletion shortly after execution; forward logs off-host |
| T1033 System Owner/User Discovery | 61 | Discovery | whoami and similar from non-interactive sessions |
| T1547.001 Registry Run Keys / Startup Folder | 54 | Persistence | Autostart auditing with a known-good baseline |
| T1005 Data from Local System | 52 | Collection | Access to document stores by unusual processes |
| T1573.001 Symmetric Cryptography | 46 | Command and control | Non-standard encrypted payloads inside HTTP bodies |
| T1041 Exfiltration Over C2 Channel | 45 | Exfiltration | Upload volume per destination and per process |
| T1113 Screen Capture | 39 | Collection | Screen capture APIs called by background processes |
| T1036.005 Match Legitimate Resource Name or Location | 36 | Stealth | System binary names running from the wrong path |
| T1053.005 Scheduled Task | 32 | Persistence | Event ID 4698 and task registry changes |
| T1543.003 Windows Service | 31 | Persistence | Event ID 7045 new service creation |
| T1059.001 PowerShell | 31 | Execution | Script block logging (Event ID 4104), Constrained Language Mode |
| T1574.001 DLL | 23 | Stealth and execution | Signed binaries loading unsigned DLLs from writable folders |
| T1056.001 Keylogging | 23 | Collection | Keyboard hook APIs in non-input processes |
| T1071.004 DNS | 17 | Command and control | Long or high-entropy subdomains, high query volume to one domain |
Tactic labels follow ATT&CK v20, where several defence evasion techniques now sit under the Stealth tactic. For the wider picture, see the ATT&CK Command and Control Tactic and the ATT&CK Discovery Tactic (TA0007) Guide.
Detection and hardening themes
Where to look first
| Signal | Data source | Members it helps with |
|---|---|---|
| New Run key values, scheduled tasks and services outside change windows | Sysmon Event IDs 12 and 13; Security Event ID 4698; System Event ID 7045 | The persistence majority, including Tarrask-style hidden tasks |
| Office, script hosts or signed applications making first-time outbound HTTPS connections | EDR network events; Sysmon Event ID 3; proxy logs | Web protocol C2, the most common channel here |
| Executables or DLLs written by processes that just made a web request | EDR file events; Sysmon Event ID 11 | Ingress tool transfer and staged second stages |
| Signed binaries loading DLLs from user-writable paths | Sysmon Event ID 7 | DLL side-loading families |
| PowerShell with encoded commands or long obfuscated script blocks | Event ID 4104 | PowerShell backdoors such as POWERSTATS, PowerExchange and POWRUNER |
| Unusual services or modules on domain controllers; authentication anomalies | DC EDR coverage; Event IDs 4624 and 4769 analytics | Skeleton Key and other identity infrastructure implants |
| Software build or update servers spawning unexpected processes | Build server EDR; integrity checks on build outputs | SUNSPOT-style build tampering |
Hardening that removes common footholds
- Start with application control: WDAC or AppLocker in audit mode on servers, then enforce. Most members are custom Windows binaries that would not be on an allow list.
- Constrain script hosts: enable PowerShell script block logging and Constrained Language Mode for standard users, and restrict wscript and mshta where they are not needed.
- Force egress through an inspecting proxy: deny direct outbound internet from servers, log every request with process context where the EDR supports it, and review first-seen domains.
- Protect the identity tier: EDR on every domain controller, LSA protection and alerting on any new service or driver on a DC. See the Active Directory and Entra ID Hardening Guide.
- Treat build and update infrastructure as tier 0: isolate build systems, sign outputs and compare builds, as the SolarWinds case showed. Roll back any control that breaks a business process by returning to audit mode, not by removing it.
Where identity fits
Backdoors in this category frequently harvest what lets an operator return without the implant: browser-stored credentials (T1555.003, 12 members), keystrokes and, in the Skeleton Key case, the domain authentication path itself. Service accounts and API keys found on a compromised host extend access long after the malware is cleaned. After any confirmed implant, rotate the machine and service credentials that host could read, not only the user passwords. See the Service Account Security Guide.
Metrics
- Percentage of the 22 behaviours above with a tested detection mapped in the SIEM or EDR.
- Percentage of servers with application control in enforce mode.
- Percentage of servers with direct internet egress (target zero).
- Mean time from a new autostart entry to analyst review.
- Number of domain controllers without full EDR coverage (target zero).
Framework mapping
| Control theme | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 | CIS Controls v8.1 |
|---|---|---|---|
| Application allow listing | CM-7, CM-10 | PR.PS-05 | Control 2 |
| Egress filtering and proxying | SC-7 | PR.IR-01 | Control 13 |
| Endpoint monitoring and logging | SI-4, AU-2, AU-6 | DE.CM-01, DE.CM-09 | Controls 8 and 13 |
| Malicious code protection | SI-3 | DE.CM-09 | Control 10 |
| Software integrity in build pipelines | SI-7, SR-4 | GV.SC-07 | Control 16 |
| Credential rotation after compromise | IA-5, IR-4 | RS.MI-02 | Control 5 |
Common failure patterns
- Hunting by name only: blocking a hash from a report while the Run key, task or service it created stays in place.
- Servers with open egress: the most common channel is plain HTTPS, which succeeds wherever servers can browse the internet.
- Cleaning the host but not the credentials: the operator returns with harvested passwords, tokens or service account secrets.
- Unmonitored domain controllers and build servers: the highest-value targets for implants such as Skeleton Key and SUNSPOT often carry the least EDR coverage.
- Logs that live only on the host: with file deletion recorded for 61 members, local evidence disappears quickly.
Complete member table (M to Z)
Every entry assigned to this hub, alphabetical, from ATT&CK v20. Up to three associated groups are shown; linked names have an NHI Mgmt Group threat actor profile. For names A to L, see the ATT&CK Espionage Backdoors and Implants Software Hub.
| ID | Name | Type | Platforms | Associated groups (ATT&CK v20) |
|---|---|---|---|---|
| S0409 | Machete | Malware | Windows | Machete |
| S1060 | Mafalda | Malware | Windows | Metador |
| S1169 | Mango | Malware | Windows | OilRig |
| S1156 | Manjusaka | Malware | Linux, Windows | None recorded in ATT&CK v20 |
| S1059 | metaMain | Malware | Windows | Metador |
| S1146 | MgBot | Malware | Windows | Daggerfly |
| S1015 | Milan | Malware | Windows | HEXANE |
| S9059 | MiniBike | Malware | Windows | NIMBUS MANTICORE |
| S9060 | MiniBus | Malware | Windows | NIMBUS MANTICORE |
| S9052 | MiniFast | Malware | Windows | NIMBUS MANTICORE |
| S9053 | MiniJunk | Malware | Windows | NIMBUS MANTICORE |
| S0084 | Mis-Type | Malware | Windows | None recorded in ATT&CK v20 |
| S0083 | Misdat | Malware | Windows | None recorded in ATT&CK v20 |
| S0080 | Mivast | Malware | Windows | Deep Panda |
| S0079 | MobileOrder | Malware | Platform not listed in ATT&CK | Scarlet Mimic |
| S1026 | Mongall | Malware | Windows | Aoqin Dragon |
| S0284 | More_eggs | Malware | Windows | FIN6, Cobalt Group, Evilnum |
| S1047 | Mori | Malware | Windows | MuddyWater |
| S9032 | MuddyViper | Malware | Windows | MuddyWater |
| S0233 | MURKYTOP | Malware | Windows | Leviathan |
| S0205 | Naid | Malware | Windows | Elderwood |
| S0272 | NDiskMonitor | Malware | Windows | Patchwork |
| S0630 | Nebulae | Malware | Windows | Naikon |
| S0691 | Neoichor | Malware | Windows | Ke3chang |
| S0210 | Nerex | Malware | Windows | Elderwood |
| S0034 | NETEAGLE | Malware | Windows | APT30 |
| S0033 | NetTraveler | Malware | Windows | TA459 |
| S1106 | NGLite | Malware | Windows | None recorded in ATT&CK v20 |
| S1192 | NICECURL | Malware | Windows | APT42 |
| S0118 | Nidiran | Malware | Windows | Suckfly |
| S1090 | NightClub | Malware | Windows | MoustachedBouncer |
| S1147 | Nightdoor | Malware | Windows | Daggerfly |
| S1100 | Ninja | Malware | Windows | ToddyCat |
| S1107 | NKAbuse | Malware | Linux, macOS, Windows | None recorded in ATT&CK v20 |
| S0340 | Octopus | Malware | Windows | Nomadic Octopus |
| S0439 | Okrum | Malware | Windows | Ke3chang |
| S0138 | OLDBAIT | Malware | Windows | APT28 |
| S0052 | OnionDuke | Malware | Windows | APT29 |
| S0264 | OopsIE | Malware | Windows | OilRig |
| S0229 | Orz | Malware | Windows | Leviathan |
| S0165 | OSInfo | Malware | Windows | APT3 |
| S0626 | P8RAT | Malware | Windows | menuPass |
| S1233 | PAKLOG | Malware | Windows | Mustang Panda |
| S0208 | Pasam | Malware | Windows | Elderwood |
| S1102 | Pcexter | Malware | Windows | ToddyCat |
| S0158 | PHOREAL | Malware | Windows | APT32 |
| S0517 | Pillowmint | Malware | Windows | FIN7 |
| S0048 | PinchDuke | Malware | Windows | APT29 |
| S0501 | PipeMon | Malware | Windows | Winnti Group |
| S0124 | Pisloader | Malware | Windows | APT18 |
| S0254 | PLAINTEE | Malware | Windows | Rancor |
| S0067 | pngdowner | Malware | Windows | Putter Panda |
| S9066 | POLLBLEND | Malware | Windows | NIMBUS MANTICORE |
| S0216 | POORAIM | Malware | Windows | APT37 |
| S0150 | POSHSPY | Malware | Windows | APT29 |
| S0139 | PowerDuke | Malware | Windows | APT29 |
| S1173 | PowerExchange | Malware | Windows | OilRig |
| S1012 | PowerLess | Malware | Windows | Magic Hound |
| S0441 | PowerShower | Malware | Windows | Inception |
| S0145 | POWERSOURCE | Malware | Windows | FIN7 |
| S0393 | PowerStallion | Malware | Windows | Turla |
| S0223 | POWERSTATS | Malware | Windows | MuddyWater |
| S0371 | POWERTON | Malware | Windows | APT33 |
| S0184 | POWRUNER | Malware | Windows | OilRig |
| S0113 | Prikormka | Malware | Windows | None recorded in ATT&CK v20 |
| S0238 | Proxysvc | Malware | Windows | Lazarus Group |
| S0078 | Psylo | Malware | Windows | Scarlet Mimic |
| S0147 | Pteranodon | Malware | Windows | Gamaredon Group |
| S0196 | PUNCHBUGGY | Malware | Windows | FIN8 |
| S0197 | PUNCHTRACK | Malware | Windows | FIN8 |
| S1032 | PyDCrypt | Malware | Windows | Moses Staff |
| S0269 | QUADAGENT | Malware | Windows | OilRig |
| S1076 | QUIETCANARY | Malware | Windows | None recorded in ATT&CK v20 |
| S0629 | RainyDay | Malware | Windows | Naikon |
| S0458 | Ramsay | Malware | Windows | None recorded in ATT&CK v20 |
| S0055 | RARSTONE | Malware | Windows | Naikon |
| S0241 | RATANKBA | Malware | Windows | Lazarus Group |
| S0169 | RawPOS | Malware | Windows | FIN5 |
| S0662 | RCSession | Malware | Windows | Threat Group-3390, Mustang Panda |
| S0495 | RDAT | Malware | Windows | OilRig |
| S0416 | RDFSNIFFER | Malware | Windows | FIN7 |
| S0172 | Reaver | Malware | Windows | None recorded in ATT&CK v20 |
| S0153 | RedLeaves | Malware | Windows | menuPass |
| S0511 | RegDuke | Malware | Windows | APT29 |
| S0019 | Regin | Malware | Windows | None recorded in ATT&CK v20 |
| S0375 | Remexi | Malware | Windows | APT39 |
| S0166 | RemoteCMD | Malware | Windows | APT3 |
| S0125 | Remsec | Malware | Windows | Strider |
| S0258 | RGDoor | Malware | Windows | OilRig |
| S0003 | RIPTIDE | Malware | Windows | APT12 |
| S0448 | Rising Sun | Malware | Windows | None recorded in ATT&CK v20 |
| S0270 | RogueRobin | Malware | Windows | DarkHydrus |
| S0090 | Rover | Malware | Windows | None recorded in ATT&CK v20 |
| S0148 | RTM | Malware | Windows | RTM |
| S9037 | RustyWater | Malware | Windows | MuddyWater |
| S0085 | S-Type | Malware | Windows | None recorded in ATT&CK v20 |
| S1210 | Sagerunex | Malware | Windows | Lotus Blossom |
| S1099 | Samurai | Malware | Windows | ToddyCat |
| S1085 | Sardonic | Malware | Windows | FIN8 |
| S0053 | SeaDuke | Malware | Windows | APT29 |
| S0345 | Seasalt | Malware | Windows | APT1 |
| S0382 | ServHelper | Malware | Windows | TA505 |
| S0596 | ShadowPad | Malware | Windows | BRONZE BUTLER, Tropic Trooper, APT41, and 5 more |
| S1019 | Shark | Malware | Windows | HEXANE |
| S0546 | SharpStage | Malware | Windows | Molerats |
| S0450 | SHARPSTATS | Malware | Windows | MuddyWater |
| S0444 | ShimRat | Malware | Windows | Mofang |
| S0028 | SHIPSHAPE | Malware | Platform not listed in ATT&CK | APT30 |
| S0063 | SHOTPUT | Malware | Windows | APT3 |
| S1178 | ShrinkLocker | Malware | Windows | None recorded in ATT&CK v20 |
| S0217 | SHUTTERSPEED | Malware | Platform not listed in ATT&CK | APT37 |
| S0589 | Sibot | Malware | Windows | APT29 |
| S0610 | SideTwist | Malware | Windows | OilRig |
| S9058 | SIGHTGRAB | Malware | Windows | NIMBUS MANTICORE |
| S0623 | Siloscape | Malware | Windows, Containers | None recorded in ATT&CK v20 |
| S0007 | Skeleton Key | Malware | Windows | APT5 |
| S0218 | SLOWDRIFT | Malware | Windows | APT37 |
| S1035 | Small Sieve | Malware | Windows | MuddyWater |
| S0159 | SNUGRIDE | Malware | Windows | menuPass |
| S0273 | Socksbot | Malware | Windows | None recorded in ATT&CK v20 |
| S0627 | SodaMaster | Malware | Windows | menuPass |
| S1166 | Solar | Malware | Windows | OilRig |
| S0157 | SOUNDBITE | Malware | Windows | APT32 |
| S0035 | SPACESHIP | Malware | Windows | APT30 |
| S0543 | Spark | Malware | Windows | Molerats |
| S1140 | Spica | Malware | Windows | Star Blizzard |
| S1234 | SplatCloak | Malware | Windows | Mustang Panda |
| S0390 | SQLRat | Malware | Platform not listed in ATT&CK | FIN7 |
| S0058 | SslMM | Malware | Windows | Naikon |
| S1227 | StarProxy | Malware | Windows | Mustang Panda |
| S1037 | STARWHALE | Malware | Windows | MuddyWater |
| S0142 | StreamEx | Malware | Windows | Deep Panda |
| S1034 | StrifeWater | Malware | Windows | Moses Staff |
| S0491 | StrongPity | Malware | Windows, Android | PROMETHIUM |
| S1042 | SUGARDUMP | Malware | Windows | None recorded in ATT&CK v20 |
| S1049 | SUGARUSH | Malware | Windows | None recorded in ATT&CK v20 |
| S0559 | SUNBURST | Malware | Windows | APT29 |
| S0562 | SUNSPOT | Malware | Windows | APT29 |
| S0018 | Sykipot | Malware | Windows | None recorded in ATT&CK v20 |
| S0060 | Sys10 | Malware | Windows | Naikon |
| S0663 | SysUpdate | Malware | Windows, Linux | Threat Group-3390 |
| S0098 | T9000 | Malware | Windows | None recorded in ATT&CK v20 |
| S0586 | TAINTEDSCRIBE | Malware | Windows | Lazarus Group |
| S0467 | TajMahal | Malware | Windows | None recorded in ATT&CK v20 |
| S1193 | TAMECAT | Malware | Windows | APT42 |
| S1011 | Tarrask | Malware | Windows | HAFNIUM |
| S0164 | TDTESS | Malware | Windows | CopyKittens |
| S0146 | TEXTMATE | Malware | Windows | FIN7 |
| S0665 | ThreatNeedle | Malware | Windows | Lazarus Group |
| S0668 | TinyTurla | Malware | Windows | Turla |
| S0004 | TinyZBot | Malware | Windows | Cleaver |
| S0671 | Tomiris | Malware | Platform not listed in ATT&CK | None recorded in ATT&CK v20 |
| S1239 | TONESHELL | Malware | Windows | Mustang Panda |
| S0678 | Torisma | Malware | Windows | None recorded in ATT&CK v20 |
| S0682 | TrailBlazer | Malware | Windows | APT29 |
| S1201 | TRANSLATEXT | Malware | Windows | Kimsuky |
| S0001 | Trojan.Mebromi | Malware | Windows | None recorded in ATT&CK v20 |
| S9064 | TRUSTTRAP | Malware | Windows | NIMBUS MANTICORE |
| S0178 | Truvasys | Malware | Windows | PROMETHIUM |
| S0647 | Turian | Malware | Windows, Linux | BackdoorDiplomacy |
| S0199 | TURNEDUP | Malware | Windows | APT33 |
| S9067 | TWOSTROKE | Malware | Windows | NIMBUS MANTICORE |
| S0130 | Unknown Logger | Malware | Windows | Patchwork |
| S0275 | UPPERCUT | Malware | Windows | menuPass, MirrorFace |
| S0022 | Uroburos | Malware | Linux, Windows, macOS | Turla |
| S0452 | USBferry | Malware | Windows | Tropic Trooper |
| S0136 | USBStealer | Malware | Windows | APT28 |
| S0207 | Vasport | Malware | Windows | Elderwood |
| S0180 | Volgmer | Malware | Windows | Lazarus Group |
| S0579 | Waterbear | Malware | Windows | BlackTech |
| S0109 | WEBC2 | Malware | Windows | APT1 |
| S0515 | WellMail | Malware | Windows | APT29 |
| S0514 | WellMess | Malware | Windows | APT29 |
| S0206 | Wiarp | Malware | Windows | Elderwood |
| S0155 | WINDSHIELD | Malware | Platform not listed in ATT&CK | APT32 |
| S0219 | WINERACK | Malware | Platform not listed in ATT&CK | APT37 |
| S0176 | Wingbird | Malware | Windows | NEODYMIUM |
| S0059 | WinMM | Malware | Windows | Naikon |
| S0653 | xCaon | Malware | Windows | IndigoZebra |
| S0117 | XTunnel | Malware | Windows | APT28 |
| S0388 | YAHOYAH | Malware | Windows | Tropic Trooper |
| S0248 | yty | Malware | Windows | None recorded in ATT&CK v20 |
| S0251 | Zebrocy | Malware | Windows | APT28 |
| S0230 | ZeroT | Malware | Windows | TA459 |
| S0086 | ZLib | Malware | Windows | None recorded in ATT&CK v20 |
| S0412 | ZxShell | Malware | Windows | Axiom, Threat Group-3390, APT41 |
| S1013 | ZxxZ | Malware | Windows | BITTER |
Practitioner checklist
- Map your detections against the 22 shared behaviours above and close the gaps first.
- Baseline and alert on new Run keys, scheduled tasks and services.
- Remove direct internet egress from servers and log proxy traffic with process context.
- Enable PowerShell script block logging and Sysmon image load monitoring for side-loading.
- Put full EDR coverage and tamper protection on every domain controller and build server.
- Move servers to application control in enforce mode, after an audit period.
- After any implant finding, rotate credentials, tokens and keys the host could reach.
- When a report names a member here, pull its ATT&CK page and hunt its techniques, not just its hashes.
Standards and references
- MITRE ATT&CK: Software
- MITRE ATT&CK: SUNBURST (S0559)
- MITRE ATT&CK: ShadowPad (S0596)
- MITRE ATT&CK: Skeleton Key (S0007)
- MITRE D3FEND: Knowledge Graph
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- CIS: Critical Security Controls v8.1
Related NHI Mgmt Group resources: ATT&CK Espionage Backdoors and Implants Software Hub · ATT&CK Remote Access Trojans Software Hub · Threat Hunting Guide · BRICKSTORM Backdoor Guide · ATT&CK Mitigations