Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S0603
MITRE ATT&CK Malware

Stuxnet (S0603)

W32.Stuxnet
ShareXLinkedInRedditHN

[Stuxnet](https://attack.mitre.org/software/S0603) was the first publicly reported malware to specifically target industrial control systems devices. [Stuxnet](https://attack.mitre.org/software/S0603) is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)(Citation: CISA ICS Advisory ICSA-10-272-01)(Citation: ESET Stuxnet Under the Microscope)(Citation: Langer Stuxnet) [Stuxnet](https://attack.mitre.org/software/S0603) was discovered in 2010, with some components being used as early as November 2008.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)

Platforms: Windows

▪Techniques implemented (69)

T1016System Network Configuration DiscoveryT1082System Information DiscoveryT1132.001Standard Encoding
S0603 on MITRE ATT&CK →
T1560.003Archive via Custom Method
T1070.006Timestomp
T1129Shared Modules
T1047Windows Management Instrumentation
T1112Modify Registry
T1543.003Windows Service
T1140Deobfuscate/Decode Files or Information
T1070.004File Deletion
T1134.001Token Impersonation/Theft
T1210Exploitation of Remote Services
T1027.013Encrypted/Encoded File
T1091Replication Through Removable Media
T1480Execution Guardrails
T1041Exfiltration Over C2 Channel
T1070Indicator Removal
T1055.001Dynamic-link Library Injection
T1573.001Symmetric Cryptography
T1014Rootkit
T1071.001Web Protocols
T1083File and Directory Discovery
T1008Fallback Channels
T1087.002Domain Account
T1120Peripheral Device Discovery
T1685Disable or Modify Tools
T1068Exploitation for Privilege Escalation
T1078.001Default Accounts
T1518.001Security Software Discovery
T1087.001Local Account
T1021.002SMB/Windows Admin Shares
T1012Query Registry
T1124System Time Discovery
T1553.002Code Signing
T1135Network Share Discovery
T1078.002Domain Accounts
T1106Native API
T1570Lateral Tool Transfer
T1053.005Scheduled Task
T1021Remote Services
T1090.001Internal Proxy
T1080Taint Shared Content
T1505.001SQL Stored Procedures
T0849Masquerading
T0888Remote System Information Discovery
T1694.002Hardcoded Credentials
T0877I/O Image
T0801Monitor Process State
T0867Lateral Tool Transfer
T0834Native API
T0836Modify Parameter
T0874Hooking
T0843Program Download
T0847Replication Through Removable Media
T1701.002Windows Command Shell
T0863User Execution
T0873.001Siemens Project File Format
T0869Standard Application Layer Protocol
T0885Commonly Used Port
T0866Exploitation of Remote Services
T0831Manipulation of Control
T0889Modify Program
T0821Modify Controller Tasking
T0832Manipulation of View
T0886Remote Services
T0835Manipulate I/O Image
T0851Rootkit
T0842Network Sniffing

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.