Donut
- ID
- S0695
- Type
- Tool
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 17 Apr 2025
Donut is an open source framework used to generate position-independent shellcode.[1][2] Donut generated code has been used by multiple threat actors to inject and load malicious payloads into memory.[3]
Techniques used (16)
- T1027.002 Software Packing
- T1027.013 Encrypted/Encoded File
- T1027.015 Compression
- T1055 Process Injection
- T1057 Process Discovery
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.005 Visual Basic
- T1059.006 Python
- T1059.007 JavaScript
- T1070 Indicator Removal
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1106 Native API
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools