tool--ca656c25-44f1-471b-9d9f-e2a3bbb84973.json

{
    "external_references": [
        {
            "external_id": "S0361",
            "source_name": "mitre-attack",
            "url": "https://attack.mitre.org/software/S0361"
        },
        {
            "source_name": "Microsoft Expand Utility",
            "url": "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/expand",
            "description": "Microsoft. (2017, October 15). Expand. Retrieved February 19, 2019."
        },
        {
            "url": "http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/",
            "description": "Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.",
            "source_name": "Palo Alto Networks BBSRAT"
        }
    ],
    "created_by_ref": "The MITRE Corporation",
    "name": "Expand",
    "description": "[Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress a CAB file into executable content.(Citation: Palo Alto Networks BBSRAT)",
    "id": "tool--ca656c25-44f1-471b-9d9f-e2a3bbb84973",
    "type": "tool",
    "labels": [
        "tool"
    ],
    "modified": "2020-03-20T18:43:16.989Z",
    "created": "2019-02-19T19:17:14.971Z",
    "x_mitre_version": "1.1",
    "x_mitre_aliases": [
        "Expand"
    ],
    "x_mitre_platforms": [
        "Windows"
    ],
    "x_mitre_contributors": [
        "Matthew Demaske, Adaptforward"
    ]
}