MITRE ATT&CKsoftware (tool)

S0695 Donut

Published 2022-03-25 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2022-03-25

Description

Donut is an open source framework used to generate position-independent shellcode. Donut generated code has been used by multiple threat actors to inject and load malicious payloads into memory.

Related

Uses · MITRE ATT&CK (16)

  • T1685 Disable or Modify Tools technique
  • T1027.015 Compression sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1620 Reflective Code Loading technique
  • T1059.007 JavaScript sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1059.006 Python sub-technique
  • T1027.002 Software Packing sub-technique
  • T1055 Process Injection technique
  • T1057 Process Discovery technique
  • T1059 Command and Scripting Interpreter technique
  • T1070 Indicator Removal technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique

Referenced by MITRE ATT&CK · uses (1)

  • G0119 Indrik Spider group

References