group

Cleaver G0003

Created: 31 May 2017
Last modified: 31 July 2026
Aliases: Cleaver · Threat Group 2889 · TG-2889

Cleaver is a threat group that has been attributed to Iranian actors and is responsible for activity tracked as Operation Cleaver. [1] Strong circumstantial evidence suggests Cleaver is linked to Threat Group 2889 (TG-2889). [2]

TechniquesBottom 16%

TacticsBottom 13%

Tools & malware55th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing G0003

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. (...)	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-10-09	fb4c31b0-13e8-4155-8aa5-24de4b8d6717
	Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)	Generic	stable	antivirus	-	-	Credential Access OS Credential Dumping LSASS Memory Security Account Manager Credential Access Steal or Forge Kerberos Tickets	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	78cc2dd2-7d20-4d32-93ff-057084c38b93
	Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2019-02-21	2023-03-10	03e2746e-2b31-42f1-ab7a-eb39365b2422
Splunk	The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage Command and Control Ingress Tool Transfer Resource Development Obtain Capabilities Tool Command and Control Proxy External Proxy	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	f7e5e792-d907-46c1-a58e-4ff974dc462a
Splunk	The following analytic highlights high-impact intrusion events assigned by Cisco Secure Firewall. (...)	Anomaly	experimental	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter Resource Development Develop Capabilities Malware Execution Exploitation for Client Execution	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	244a77bb-3b2a-46f1-bf2c-b4f7cd29276d
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
	Detects a command used by conti to find volume shadow backups	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Resource Development Develop Capabilities Malware	-	high	Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)	2021-08-09	—	7b30e0a7-c675-4b24-8a46-82fa67e2433d
Splunk	The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). (...)	Generic	stable	create_remote_thread	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-06-29	67d4dbef-9564-4699-8da8-03a151529edc
	Detects uses of the createdump.exe LOLOBIN utility to dump process memory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-01-04	2022-08-19	515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
	Detects the creation of an executable by another executable.	Hunting	test	file_event	windows	Sysmon	Resource Development Develop Capabilities Malware	-	low	frack113	2022-03-09	2025-02-24	297afac9-5d02-4138-8c58-b977bac60556
Splunk	The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. (...)	Generic	stable	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Michael Haag, Splunk	2019-12-11	2026-10-02	b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
	Files with well-known filenames (parts of credential dump software or files produced by them) creati (...)	Generic	test	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory Security Account Manager NTDS LSA Secrets	-	high	Teymur Kheirkhabarov, oscd.community	2019-11-01	2025-10-25	8fbf3271-1ef6-4e94-8210-03c2317947f6
	Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Bhabesh Raj, Jonhnathan Ribeiro	2023-11-27	2023-11-29	f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9
	Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.	Generic	test	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-06-27	2023-11-29	e5b33f7d-eb93-48b6-9851-09e1e610b6d7
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	f0d1feba-4344-4ca9-8121-a6c97bd6df52
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog System	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	4976aa50-8f41-45c6-8b15-ab3fc10e79ed
	Detects the load of dbghelp/dbgcore DLL by a potentially uncommon or potentially suspicious process. (...)	Hunting	test	image_load	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Perez Diego (@darkquassar), oscd.community, Ecco	2019-10-27	2024-03-01	0e277796-5f23-4e49-a490-483131d4f6e1
Splunk	The following analytic detects ARP Poisoning attacks by monitoring for Dynamic ARP Inspection (DAI) errors on Cisco network devices. (...)	Generic	experimental	network_device	-	Cisco IOS · Cisco	Credential Access, Collection Adversary-in-the-Middle ARP Cache Poisoning Initial Access Hardware Additions Impact Network Denial of Service	-	medium	Mikael Bjerkeland, Splunk	2020-08-11	2026-05-13	b44bebd6-bd39-467b-9321-73971bcd1aac	-
Splunk	The following analytic detects attempts to read LSASS memory, indicative of credential dumping. (...)	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-10-09	2c365e57-4414-4540-8dc0-73ab10729996
Splunk	The following analytic detects IPv6 network infrastructure threats by identifying suspicious activities such as IP and MAC address theft or packet drops. (...)	Generic	experimental	network_device	-	Cisco IOS · Cisco	Credential Access, Collection Adversary-in-the-Middle ARP Cache Poisoning Initial Access Hardware Additions Impact Network Denial of Service	-	medium	Mikael Bjerkeland, Splunk	2020-10-28	2026-05-13	c3be767e-7959-44c5-8976-0e9c12a91ad2
Splunk	The following analytic detects port security violations on Cisco switches. (...)	Generic	experimental	network_device	-	Cisco IOS · Cisco	Credential Access, Collection Adversary-in-the-Middle ARP Cache Poisoning Initial Access Hardware Additions Impact Network Denial of Service	-	medium	Mikael Bjerkeland, Splunk	2020-10-28	2026-05-13	2de3d5b8-a4fa-45c5-8540-6d071c194d24	-
Splunk	The following analytic detects the behavior of dumping credentials from memory by exploiting the Local Security Authority Subsystem Service (LSASS) using the comsvcs.dll and MiniDump via rundll32. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-10-16	2026-10-02	8943b567-f14d-4ee8-a0bb-2121d4ce3184
Splunk	The following analytic detects the use of procdump.exe to dump the LSASS process, specifically looki (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Credential Access OS Credential Dumping LSASS Memory	-	medium	Michael Haag, Splunk	2021-02-01	2026-10-02	3742ebfe-64c2-11eb-ae93-0242ac130002
	Detects process dump via legitimate sqldumper.exe binary	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	medium	Kirill Kiryanov, oscd.community	2020-10-08	2021-11-27	23ceaf5c-b6f1-4a32-8559-f2ff734be516
	Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of t (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	medium	Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)	2022-04-06	2023-04-12	dee0a7a3-f200-4112-a99b-952196d81e42
	Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Resource Development Develop Capabilities Malware	-	high	Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro	2019-09-30	2022-10-06	032f5fb3-d959-41a5-9263-4173c802dc2b
	Detects file creation events with filename patterns used by CrackMapExec.	Generic	test	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Nasreddine Bencherchali (Nextron Systems)	2024-03-11	2024-06-27	736ffa74-5f6f-44ca-94ef-1c0df4f51d2a
	Detects suspicious process patterns found in logs when CrackMapExec is used	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-03-12	2023-02-13	f26307d8-14cd-47e3-a26b-4b4769f24af6
	Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential ext (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2019-12-22	2024-11-23	36d88494-1d43-4dc0-b3fa-35c8fea0ca9d
	Detects well-known credential dumping tools execution via specific named pipe creation	Generic	test	pipe_created	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials	-	critical	Teymur Kheirkhabarov, oscd.community	2019-11-01	2023-08-07	961d0ba2-3eea-4303-a930-2cf78bbfcc5e
	Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process clo (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-07-01	—	d474c8fe-bb69-4ea0-b7d9-f682b56d52d3
	Detects the creation of the default dump file used by Outflank Dumpert tool. (...)	Generic	test	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2020-02-04	2023-05-09	93d94efc-d7ad-4161-ad7d-1638c4f908d8
	Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2020-02-04	2026-09-16	2704ab9e-afe2-4854-a3b1-0c0706d03578
	Detects process access requests from hacktool processes based on their default image name	Generic	test	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel	2023-11-27	—	d0d2f720-d14f-448d-8242-51ff396a334e
	Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening an (...)	Generic	test	process_access	windows	Sysmon	Execution Native API Credential Access OS Credential Dumping LSASS Memory	-	high	Bhabesh Raj (rule), @thefLinkk	2022-06-27	2023-11-28	b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5
	Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in orde (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-08-18	2024-11-23	ca621ba5-54ab-4035-9942-d378e6fcde3c
	Detects file creation events with filename patterns used by Impacket.	Generic	experimental	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	The DFIR Report, IrishDeath	2025-05-19	—	03f4ca17-de95-428d-a75a-4ee78b047256
	Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	critical	Nasreddine Bencherchali (Nextron Systems)	2022-10-24	2023-02-04	b99a1518-1ad5-4f65-bc95-1ffff97a8fd0
	Detection well-known mimikatz command line arguments	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials	-	high	Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton	2019-10-22	2023-02-21	a642964e-bead-4bed-8910-1bb4d63e3b4d
	Detects default lsass dump filename generated by SafetyKatz.	Generic	test	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Markus Neis	2018-07-24	2024-06-27	e074832a-eada-4fd7-94a1-10642b130e16
	Detects the execution of the hacktool SafetyKatz via PE information and default Image name	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	critical	Nasreddine Bencherchali (Nextron Systems)	2022-10-20	2023-02-04	b1876533-4ed5-4a83-90f3-b8645840a413
	Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2019-12-31	2025-10-21	7aa7009a-28b9-4344-8c1f-159489a390df
	Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-23	2026-01-09	589ac73f-8e12-409c-964e-31a2f5775ae2
	Detects suspicious use of XORDump process memory dumping utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-01-28	2023-02-08	66e563f9-1cbd-4a22-a957-d8b7c0f44372
	Detects the execution of different Windows based hacktools via their import hash (imphash) even if t (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Resource Development Obtain Capabilities Tool Credential Access OS Credential Dumping	-	critical	Florian Roth (Nextron Systems)	2022-03-04	2024-11-23	24e3e58a-646b-4b50-adef-02ef935b9fc8
	Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Resource Development Obtain Capabilities Tool Credential Access OS Credential Dumping	-	high	Florian Roth (Nextron Systems)	2022-04-27	2024-01-15	37c1333a-a0db-48be-b64b-7393b2386e3b
	Detects Access to LSASS Process	Generic	test	-	windows	Windows Defender	Credential Access OS Credential Dumping LSASS Memory	-	high	Markus Neis	2018-08-26	2022-08-13	a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98
	Detects potential mimikatz-like tools accessing LSASS from non system account	Generic	test	file_event	windows	WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-06-20	2023-12-11	962fe167-e48d-4fd6-9974-11e5b9a5d6d1
	Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as (...)	Generic	test	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-02-10	2023-11-29	4be8b654-0c01-4c9d-a10c-6b28467fc651
	Detects process access to LSASS memory with suspicious access flags and from a potentially suspiciou (...)	Hunting	test	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Florian Roth (Nextron Systems)	2021-11-27	2026-09-15	fa34b441-961a-42fa-a100-ecc28c886725

Title

Description

Cleaver G0003

Cleaver G0003

Cleaver MITRE reference G0003

Standing G0003

Reach

Coverage

Cleaver detections G0003