✕
Image
Currently viewing ATT&CK v19.2 which was live between April 28, 2026 and October 12, 2026. Learn more about the versioning system or see the live site.
ATT&CKcon 7.0 registration is open! Join us October 27-28, 2026 in McLean, VA or virtually. Register in person or register virtually. See the FAQ for hotel and venue details.
  1. Home
  2. Software
  3. route

route

route can be used to find or change information within the local system IP routing table. [1]

ID: S0103
ⓘ
Type: TOOL
Version: 1.1
Created: 31 May 2017
Last Modified: 16 April 2025
Enterprise Layer
download view Image

Techniques Used

Domain ID Name Use
Enterprise T1016 System Network Configuration Discovery

route can be used to discover routing configuration information.

Groups That Use This Software

ID Name References
G0071 Orangeworm

[2]
G0032 Lazarus Group

[3]

References

  1. Microsoft. (n.d.). Route. Retrieved April 17, 2016.
  2. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  1. Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.