Covenant
- ID
- S1155
- Type
- Tool
- Platforms
- Linux, macOS, Windows
- Source
- attack.mitre.org
- MITRE last modified
- 7 Sep 2024
Covenant is a multi-platform command and control framework written in .NET. While designed for penetration testing and security research, the tool has also been used by threat actors such as HAFNIUM during operations. Covenant functions through a central listener managing multiple deployed "Grunts" that communicate back to the controller.[1][2]
Techniques used (10)
- T1047 Windows Management Instrumentation
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1218.004 InstallUtil
- T1218.005 Mshta
- T1218.010 Regsvr32
- T1571 Non-Standard Port
- T1573.002 Asymmetric Cryptography