{"name":"Ember Bear — APT Atlas","versions":{"attack":"16","navigator":"5.1.0","layer":"4.5"},"domain":"enterprise-attack","description":"Techniques observed for Ember Bear (nation-state). Source: https://aptatlas.net/actors/ember-bear","filters":{"platforms":[]},"sorting":0,"layout":{"layout":"side","aggregateFunction":"average","showID":true,"showName":true},"hideDisabled":false,"techniques":[{"techniqueID":"T1003","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Credential Access","enabled":true,"showSubtechniques":false},{"techniqueID":"T1003.001","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Credential Access","enabled":true,"showSubtechniques":true},{"techniqueID":"T1003.002","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Credential Access","enabled":true,"showSubtechniques":true},{"techniqueID":"T1003.004","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Credential Access","enabled":true,"showSubtechniques":true},{"techniqueID":"T1005","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Collection","enabled":true,"showSubtechniques":false},{"techniqueID":"T1018","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Discovery","enabled":true,"showSubtechniques":false},{"techniqueID":"T1021","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Lateral Movement","enabled":true,"showSubtechniques":false},{"techniqueID":"T1027.002","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Stealth","enabled":true,"showSubtechniques":true},{"techniqueID":"T1036","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Stealth","enabled":true,"showSubtechniques":false},{"techniqueID":"T1036.005","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Stealth","enabled":true,"showSubtechniques":true},{"techniqueID":"T1046","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Discovery","enabled":true,"showSubtechniques":false},{"techniqueID":"T1047","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Execution","enabled":true,"showSubtechniques":false},{"techniqueID":"T1053.005","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Execution","enabled":true,"showSubtechniques":true},{"techniqueID":"T1059","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Execution","enabled":true,"showSubtechniques":false},{"techniqueID":"T1059.001","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Execution","enabled":true,"showSubtechniques":true},{"techniqueID":"T1059.003","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Execution","enabled":true,"showSubtechniques":true},{"techniqueID":"T1059.007","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Execution","enabled":true,"showSubtechniques":true},{"techniqueID":"T1070.004","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Stealth","enabled":true,"showSubtechniques":true},{"techniqueID":"T1071.004","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Command And Control","enabled":true,"showSubtechniques":true},{"techniqueID":"T1090.003","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Command And Control","enabled":true,"showSubtechniques":true},{"techniqueID":"T1095","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Command And Control","enabled":true,"showSubtechniques":false},{"techniqueID":"T1110","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Credential Access","enabled":true,"showSubtechniques":false},{"techniqueID":"T1112","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Defense Impairment","enabled":true,"showSubtechniques":false},{"techniqueID":"T1119","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Collection","enabled":true,"showSubtechniques":false},{"techniqueID":"T1125","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Collection","enabled":true,"showSubtechniques":false},{"techniqueID":"T1190","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Initial Access","enabled":true,"showSubtechniques":false},{"techniqueID":"T1195","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Initial Access","enabled":true,"showSubtechniques":false},{"techniqueID":"T1203","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Execution","enabled":true,"showSubtechniques":false},{"techniqueID":"T1204.001","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Execution","enabled":true,"showSubtechniques":true},{"techniqueID":"T1210","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Lateral Movement","enabled":true,"showSubtechniques":false},{"techniqueID":"T1497","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Stealth","enabled":true,"showSubtechniques":false},{"techniqueID":"T1550.002","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Lateral Movement","enabled":true,"showSubtechniques":true},{"techniqueID":"T1552.001","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Credential Access","enabled":true,"showSubtechniques":true},{"techniqueID":"T1560","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Collection","enabled":true,"showSubtechniques":false},{"techniqueID":"T1561.002","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Impact","enabled":true,"showSubtechniques":true},{"techniqueID":"T1566.001","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Initial Access","enabled":true,"showSubtechniques":true},{"techniqueID":"T1567.002","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Exfiltration","enabled":true,"showSubtechniques":true},{"techniqueID":"T1570","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Lateral Movement","enabled":true,"showSubtechniques":false},{"techniqueID":"T1571","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Command And Control","enabled":true,"showSubtechniques":false},{"techniqueID":"T1583","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Resource Development","enabled":true,"showSubtechniques":false},{"techniqueID":"T1583.003","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Resource Development","enabled":true,"showSubtechniques":true},{"techniqueID":"T1583.006","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Resource Development","enabled":true,"showSubtechniques":true},{"techniqueID":"T1585","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Resource Development","enabled":true,"showSubtechniques":false},{"techniqueID":"T1589.002","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Reconnaissance","enabled":true,"showSubtechniques":true},{"techniqueID":"T1654","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Discovery","enabled":true,"showSubtechniques":false},{"techniqueID":"T1684.001","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Stealth","enabled":true,"showSubtechniques":true},{"techniqueID":"T1685","score":1,"color":"#5ce1ff","comment":"Observed for Ember Bear · Defense Impairment","enabled":true,"showSubtechniques":false}],"gradient":{"colors":["#0d1230","#5ce1ff"],"minValue":0,"maxValue":1},"legendItems":[{"label":"Used by Ember Bear","color":"#5ce1ff"}],"metadata":[{"name":"source","value":"APT Atlas"},{"name":"actor_id","value":"ember-bear"},{"name":"mitre_gid","value":"G1003"}]}