Gold Open Source

Explore Packages Vulnerabilities CWEs MCP Servers Scan

Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

Explore Everything
Packages
Gold Certified Packages
Container Images
AI Models
MCP Servers
Agent Skills
Chip Manufacturers

Security Data & Tools

Scan Your Dependencies
Trending Threats
Threat RSS Feeds
CVE Database
Actively Exploited (KEV)
SGZ Zero-Days
CWE Index
MITRE ATT&CK
Malicious Packages
Security Glossary
Supply-Chain Report
Developers (API & Badge)
Chrome Extension
Credits & Data Sources

Products

The Platform
ESSCM
Portal
TPRM
OSM
Cowork
Code / Runner
Guard

Use Cases

Know Your Software
Auto-Fix Vulnerabilities
Asset Discovery
AI Governance
MCP Server Security
Supply Chain Compliance
Zero-Day Discovery
All Use Cases

Company

About
Pricing
Blog
Documentation
Safeguard Academy
Contact
Privacy Policy
Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard

Home/ATT&CK/Software/S1018

MITRE ATT&CK Malware

Saint Bot (S1018)

ShareX LinkedIn Reddit HN

[Saint Bot](https://attack.mitre.org/software/S1018) is a .NET downloader that has been used by [Saint Bear](https://attack.mitre.org/groups/G1031) since at least March 2021.(Citation: Malwarebytes Saint Bot April 2021)(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )

Platforms: Windows

▪Techniques implemented (37)

T1218.010Regsvr32 T1055.001Dynamic-link Library Injection T1016System Network Configuration Discovery T1548.002Bypass User Account Control T1027Obfuscated Files or Information T1036Masquerading T1105Ingress Tool Transfer T1071.001Web Protocols T1082System Information Discovery T1059.003Windows Command Shell T1497.003Time Based Checks T1012Query Registry T1053.005Scheduled Task T1106Native API T1204.002Malicious File T1055.004Asynchronous Procedure Call T1566.002Spearphishing Link T1027.002Software Packing T1059.005Visual Basic T1497.001System Checks T1059.001PowerShell T1622Debugger Evasion T1614System Location Discovery T1547.001Registry Run Keys / Startup Folder T1140Deobfuscate/Decode Files or Information T1055.012Process Hollowing T1057Process Discovery T1566.001Spearphishing Attachment T1036.005Match Legitimate Resource Name or Location T1083File and Directory Discovery T1574Hijack Execution Flow T1033System Owner/User Discovery T1218.004InstallUtil T1204.001Malicious Link T1132.001Standard Encoding T1070.004File Deletion T1005Data from Local System

▪Used by groups (2)

G1003Ember Bear G1031Saint Bear

S1018on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.