MITRE ATT&CKsoftware (tool)
S1155 Covenant
- Domain
- enterprise
- Platforms
- Linux, macOS, Windows
- Version
- 1.0
- Created
- 2024-09-04
Description
Covenant is a multi-platform command and control framework written in .NET. While designed for penetration testing and security research, the tool has also been used by threat actors such as HAFNIUM during operations. Covenant functions through a central listener managing multiple deployed "Grunts" that communicate back to the controller.
Related
Uses · MITRE ATT&CK (10)
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1571 Non-Standard Port technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1218.004 InstallUtil sub-technique
- T1218.005 Mshta sub-technique
- T1218.010 Regsvr32 sub-technique
- T1047 Windows Management Instrumentation technique
- T1082 System Information Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G0125 HAFNIUM group
References
- https://github.com/cobbr/Covenant Github Covenant
- https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/ Microsoft HAFNIUM March 2020