{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,23]],"date-time":"2025-12-23T00:29:28Z","timestamp":1766449768316,"version":"3.41.0"},"publisher-location":"New York, NY, USA","reference-count":68,"publisher":"ACM","license":[{"start":{"date-parts":[[2020,10,30]],"date-time":"2020-10-30T00:00:00Z","timestamp":1604016000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2020,10,30]]},"DOI":"10.1145\/3372297.3423355","type":"proceedings-article","created":{"date-parts":[[2021,3,4]],"date-time":"2021-03-04T16:20:42Z","timestamp":1614874842000},"page":"787-802","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":10,"title":["Mnemosyne: An Effective and Efficient Postmortem Watering Hole Attack Investigation System"],"prefix":"10.1145","author":[{"given":"Joey","family":"Allen","sequence":"first","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zheng","family":"Yang","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Matthew","family":"Landen","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Raghav","family":"Bhat","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Harsh","family":"Grover","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Andrew","family":"Chang","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yang","family":"Ji","sequence":"additional","affiliation":[{"name":"Palo Alto Networks, Santa Clara, CA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Roberto","family":"Perdisci","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology & University of Georgia, Atlanta, GA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Wenke","family":"Lee","sequence":"additional","affiliation":[{"name":"Georgia Institute of Technology, Atlanta, GA, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2020,11,2]]},"reference":[{"key":"e_1_3_2_2_1_1","unstructured":"]aptcost2015 cost of cyber crime study: United states a . http:\/\/www.ponemon.org\/blog\/2015-cost-of-cyber-crime-united-states.  ]aptcost2015 cost of cyber crime study: United states a . http:\/\/www.ponemon.org\/blog\/2015-cost-of-cyber-crime-united-states."},{"key":"e_1_3_2_2_2_1","unstructured":"]aptnotesAptnotes b . https:\/\/github.com\/kbandla\/APTnotes.git.  ]aptnotesAptnotes b . https:\/\/github.com\/kbandla\/APTnotes.git."},{"key":"e_1_3_2_2_3_1","unstructured":"dmoz. https:\/\/dmoz-odp.org\/.  dmoz. https:\/\/dmoz-odp.org\/."},{"key":"e_1_3_2_2_4_1","unstructured":"emaildefender. https:\/\/www.secantcorp.com\/emaildefender.  emaildefender. https:\/\/www.secantcorp.com\/emaildefender."},{"key":"e_1_3_2_2_5_1","unstructured":"Mitre att&ck. https:\/\/attack.mitre.org\/.  Mitre att&ck. https:\/\/attack.mitre.org\/."},{"key":"e_1_3_2_2_6_1","unstructured":"passivetotal. https:\/\/www.riskiq.com\/products\/passivetotal.  passivetotal. https:\/\/www.riskiq.com\/products\/passivetotal."},{"key":"e_1_3_2_2_7_1","unstructured":"How was the attack on the pfsa and polish banks carried out and who else was targeted by criminals? https:\/\/niebezpiecznik.pl\/post\/jak-przeprowadzono-atak-na-knf-i-polskie-banki-oraz-kto-jeszcze-byl-na-celowniku-przestepcow\/.  How was the attack on the pfsa and polish banks carried out and who else was targeted by criminals? https:\/\/niebezpiecznik.pl\/post\/jak-przeprowadzono-atak-na-knf-i-polskie-banki-oraz-kto-jeszcze-byl-na-celowniku-przestepcow\/."},{"key":"e_1_3_2_2_8_1","unstructured":"puppeteer. https:\/\/developers.google.com\/web\/tools\/puppeteer.  puppeteer. https:\/\/developers.google.com\/web\/tools\/puppeteer."},{"key":"e_1_3_2_2_9_1","unstructured":"splunk. https:\/\/www.splunk.com.  splunk. https:\/\/www.splunk.com."},{"key":"e_1_3_2_2_10_1","unstructured":"waf. https:\/\/owasp.org\/www-community\/Web_Application_Firewall.  waf. https:\/\/owasp.org\/www-community\/Web_Application_Firewall."},{"key":"e_1_3_2_2_11_1","unstructured":"F. R. Barbehenn Brittany January 2020. https:\/\/unit42.paloaltonetworks.com\/xhunt-campaign-new-watering-hole-identified-for-credential-harvesting\/.  F. R. Barbehenn Brittany January 2020. https:\/\/unit42.paloaltonetworks.com\/xhunt-campaign-new-watering-hole-identified-for-credential-harvesting\/."},{"key":"e_1_3_2_2_12_1","first-page":"319","volume-title":"24th USENIX Security Symposium (USENIX Security 15)","author":"Bates A.","year":"2015"},{"key":"e_1_3_2_2_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516725"},{"key":"e_1_3_2_2_14_1","first-page":"595","volume-title":"24th $$USENIX$$ Security Symposium ($$USENIX$$ Security 15)","author":"Borgolte K.","year":"2015"},{"key":"e_1_3_2_2_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-11379-1_3"},{"key":"e_1_3_2_2_16_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-44885-4_5"},{"key":"e_1_3_2_2_17_1","first-page":"33","volume-title":"USENIX security symposium","author":"Curtsinger C.","year":"2011"},{"key":"e_1_3_2_2_18_1","doi-asserted-by":"publisher","DOI":"10.5555\/2685048.2685090"},{"key":"e_1_3_2_2_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICC.2012.6363769"},{"key":"e_1_3_2_2_20_1","doi-asserted-by":"publisher","DOI":"10.5555\/2442626.2442634"},{"volume-title":"April, 25","year":"2017","author":"Hacquebord F.","key":"e_1_3_2_2_21_1"},{"key":"e_1_3_2_2_22_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24046"},{"key":"e_1_3_2_2_23_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23349"},{"key":"e_1_3_2_2_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00096"},{"key":"e_1_3_2_2_25_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24270"},{"key":"e_1_3_2_2_26_1","first-page":"487","volume-title":"26th USENIX Security Symposium (USENIX Security 17)","author":"Hossain M. N.","year":"2017"},{"key":"e_1_3_2_2_27_1","doi-asserted-by":"crossref","DOI":"10.1109\/SP40000.2020.00064","volume-title":"Combating dependence explosion in forensic analysis using alternative tag propagation semantics","author":"Hossain M. N.","year":"2020"},{"key":"e_1_3_2_2_28_1","unstructured":"B. S. A. Intelligence. Lazarus & watering-hole attacks February 2017. https:\/\/baesystemsai.blogspot.com\/2017\/02\/lazarus-watering-hole-attacks.html.  B. S. A. Intelligence. Lazarus & watering-hole attacks February 2017. https:\/\/baesystemsai.blogspot.com\/2017\/02\/lazarus-watering-hole-attacks.html."},{"key":"e_1_3_2_2_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134045"},{"key":"e_1_3_2_2_30_1","first-page":"1705","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Ji Y.","year":"2018"},{"volume-title":"November","year":"2014","key":"e_1_3_2_2_31_1"},{"key":"e_1_3_2_2_32_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00116"},{"key":"e_1_3_2_2_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/1047915.1047918"},{"volume-title":"Proceedings of the 12th Annual Network and Distributed System Security Symposium (NDSS)","year":"2005","author":"King S. T.","key":"e_1_3_2_2_34_1"},{"key":"e_1_3_2_2_35_1","unstructured":"]energyPassiveTotalY. Klijnsma. New insights into energetic bear's watering hole cyber attacks on turkish critical infrastructure November 2017 a . https:\/\/www.riskiq.com\/blog\/labs\/energetic-bear.  ]energyPassiveTotalY. Klijnsma. New insights into energetic bear's watering hole cyber attacks on turkish critical infrastructure November 2017 a . https:\/\/www.riskiq.com\/blog\/labs\/energetic-bear."},{"key":"e_1_3_2_2_36_1","unstructured":"]flashPassiveTotalY. Klijnsma. Fake flash player update linked to watering hole attack on popular middle east news site September 2017 b . https:\/\/www.riskiq.com\/blog\/labs\/fake-flash-update-watering-hole-attack.  ]flashPassiveTotalY. Klijnsma. Fake flash player update linked to watering hole attack on popular middle east news site September 2017 b . https:\/\/www.riskiq.com\/blog\/labs\/fake-flash-update-watering-hole-attack."},{"key":"e_1_3_2_2_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.48"},{"volume-title":"March","year":"2020","author":"Kwiatkowski Ivan D. P.","key":"e_1_3_2_2_38_1"},{"key":"e_1_3_2_2_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/2872362.2872395"},{"key":"e_1_3_2_2_40_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23306"},{"volume-title":"Nov.","year":"2017","author":"Lassalle D.","key":"e_1_3_2_2_41_1"},{"volume-title":"Proceedings of the 20th Annual Network and Distributed System Security Symposium (NDSS)","year":"2013","author":"Lee K. H.","key":"e_1_3_2_2_42_1"},{"key":"e_1_3_2_2_43_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23319"},{"key":"e_1_3_2_2_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.8"},{"key":"e_1_3_2_2_45_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23254"},{"key":"e_1_3_2_2_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/1866307.1866356"},{"key":"e_1_3_2_2_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/2818000.2818039"},{"key":"e_1_3_2_2_48_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23350"},{"volume-title":"Proceedings of the 25th USENIX Security Symposium (Security)","year":"2017","author":"Ma S.","key":"e_1_3_2_2_49_1"},{"volume-title":"Proceedings of the 2018 USENIX Annual Technical Conference (ATC)","year":"2018","author":"Ma S.","key":"e_1_3_2_2_50_1"},{"key":"e_1_3_2_2_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939783"},{"key":"e_1_3_2_2_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00026"},{"key":"e_1_3_2_2_53_1","unstructured":"]appleM. Mimoso. Apple watering hole attack February 2013 a. https:\/\/threatpost.com\/ios-developer-site-core-facebook-apple-watering-hole-attack-022013\/77546.  ]appleM. Mimoso. Apple watering hole attack February 2013 a. https:\/\/threatpost.com\/ios-developer-site-core-facebook-apple-watering-hole-attack-022013\/77546."},{"key":"e_1_3_2_2_54_1","unstructured":"]clickjackingM. Mimoso May 2013 b . https:\/\/threatpost.com\/watering-hole-attack-claims-us-department-of-labor-website\/100081\/.  ]clickjackingM. Mimoso May 2013 b . https:\/\/threatpost.com\/watering-hole-attack-claims-us-department-of-labor-website\/100081\/."},{"volume-title":"October","year":"2014","author":"Mimoso M.","key":"e_1_3_2_2_55_1"},{"key":"e_1_3_2_2_56_1","first-page":"2","volume":"1","author":"Moshchuk A.","year":"2006","journal-title":"A crawler-based study of spyware in the web. In NDSS"},{"volume-title":"Proceedings of the 16th USENIX Security Symposium (Security)","year":"2007","author":"Moshchuk A.","key":"e_1_3_2_2_57_1"},{"key":"e_1_3_2_2_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/2810103.2813656"},{"key":"e_1_3_2_2_59_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24065"},{"key":"e_1_3_2_2_60_1","unstructured":"P. Paganini. Watering hole attacks on polish banks linked to lazarus group February 2017. https:\/\/securityaffairs.co\/wordpress\/56235\/apt\/lazarus-group-polish-bank.html.  P. Paganini. Watering hole attacks on polish banks linked to lazarus group February 2017. https:\/\/securityaffairs.co\/wordpress\/56235\/apt\/lazarus-group-polish-bank.html."},{"key":"e_1_3_2_2_61_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23100"},{"key":"e_1_3_2_2_62_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23282"},{"key":"e_1_3_2_2_63_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.24167"},{"volume-title":"IN NDSS. Citeseer","year":"2006","author":"Wang Y.-M.","key":"e_1_3_2_2_64_1"},{"volume-title":"Technical aspects of cyber kill chain. CoRR, abs\/1606.03184","year":"2016","author":"Yadav T.","key":"e_1_3_2_2_65_1"},{"volume-title":"Uiscope: Accurate, instrumentation-free, and visible attack investigation for gui applications","year":"2020","author":"Yang R.","key":"e_1_3_2_2_66_1"},{"key":"e_1_3_2_2_67_1","doi-asserted-by":"publisher","DOI":"10.14778\/2535568.2448939"},{"key":"e_1_3_2_2_68_1","unstructured":"Z. Zorz. Banks around the world targeted in watering hole attacks February 2017. https:\/\/www.helpnetsecurity.com\/2017\/02\/14\/banks-watering-hole-attacks\/.  Z. Zorz. Banks around the world targeted in watering hole attacks February 2017. https:\/\/www.helpnetsecurity.com\/2017\/02\/14\/banks-watering-hole-attacks\/."}],"event":{"name":"CCS '20: 2020 ACM SIGSAC Conference on Computer and Communications Security","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"],"location":"Virtual Event USA","acronym":"CCS '20"},"container-title":["Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372297.3423355","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3372297.3423355","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T22:02:20Z","timestamp":1750197740000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3372297.3423355"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,10,30]]},"references-count":68,"alternative-id":["10.1145\/3372297.3423355","10.1145\/3372297"],"URL":"https:\/\/doi.org\/10.1145\/3372297.3423355","relation":{},"subject":[],"published":{"date-parts":[[2020,10,30]]},"assertion":[{"value":"2020-11-02","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}