S0103 route
route can be used to find or change information within the local system IP routing table. 1
| Item | Value |
|---|---|
| ID | S0103 |
| Type | TOOL |
| Version | 1.1 |
| Created | 31 May 2017 |
| Last Modified | 06 April 2022 |
| Navigation Layer | View In ATT&CK® Navigator |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| enterprise | T1016 | System Network Configuration Discovery | route can be used to discover routing configuration information. |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0032 | Lazarus Group | 2 |
| G0071 | Orangeworm | 3 |
References
-
Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021. ↩
-
Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018. ↩