Threat Group-1314 G0028

Created: 31 May 2017
Last modified: 31 July 2026
Aliases: Threat Group-1314 · TG-1314

Threat Group-1314 is an unattributed threat group that has used compromised credentials to log into a victim's remote access infrastructure. [1]

TechniquesBottom 13%

Tactics34th pct

Tools & malware39th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Threat Group-1314 MITRE reference G0028

SMB/Windows Admin Shares T1021.002 ↗

Threat Group-1314 actors mapped network drives using net use.2

Lateral Movement54 detection rules

Windows Command Shell T1059.003 ↗

Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.3

Execution63 detection rules

Software Deployment Tools T1072 ↗

Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.4

Execution · Lateral Movement8 detection rules

Domain Accounts T1078.002 ↗

Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.5

Initial Access · Persistence · Privilege Escalation · Stealth14 detection rules

Standing G0028

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques4Bottom 13%

13th percentile · 87% of 176 ATT&CK groups have more Enterprise techniques.

Tactics634th pct

34th percentile · 66% of 176 ATT&CK groups have more tactics spanned.

Tools & malware239th pct

39th percentile · 61% of 176 ATT&CK groups have more tools and malware.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique34medTop 18%

82nd percentile · 82% of 176 ATT&CK groups have this many detection rules per technique or fewer.

Tests / technique3.5med

Threat Group-1314 detections G0028

139 distinct rules cover the 4 techniques recorded for this group. 98 Sigma · 41 Splunk.

4 covered by at least one rule139 distinct rules in total

Showing 1-50 of 100+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects access to ADMIN$ network share	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	low	Florian Roth (Nextron Systems)	2017-03-04	2024-01-16	098d7118-55bc-4912-a836-dc6483a8d150
	Detect remote login by Administrator user (depending on internal pattern).	Generic	test	authentication	windows	WinEventLog Security	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Default Accounts Domain Accounts Local Accounts	-	low	juju4	2017-10-29	2022-10-09	0f63e1ef-1eb9-4226-9d54-8927ca08520a
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. (...)	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic Command and Control Ingress Tool Transfer Initial Access Supply Chain Compromise Compromise Software Supply Chain	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-01	—	f6c27ecc-d890-4452-80e6-2e274a10e097
Splunk	The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	CVE-2021-44228	medium	Teoderick Contreras, Bhavin Patel, Splunk	2021-10-21	2026-05-13	54a6ed00-3256-11ec-b031-acde48001122
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	d7a95147-145f-4678-b85d-d1ff4a3bb3f6
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	5a105d34-05fc-401e-8553-272b45c1522d
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hi (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-14	—	ee5e119b-1f75-4b34-add8-3be976961e39
	Detects a copy command or a copy utility execution to or from an Admin share or remote	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Network Shared Drive Exfiltration Exfiltration Over Alternative Protocol Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali	2019-12-30	2025-10-22	855bc8b5-2ae8-402e-a9ed-b889e6df1900
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
	Detects the use of the spoolss named pipe over SMB. (...)	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	OTR (Open Threat Research)	2018-11-28	2022-08-11	214e8f95-100a-4e04-bb31-ef6cba8ce07e
	Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model	-	high	Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)	2020-10-12	2022-11-26	c39f0c81-7348-4965-ab27-2fde35a1b641
Splunk	The following analytic detects endpoints causing a high number of account lockouts within a short period. (...)	Anomaly	stable	configuration_change	-	-	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Domain Accounts	-	medium	David Dorsey, Splunk	2020-04-29	2026-05-13	c026e3dd-7e18-4abb-8f41-929e836efe74	-
Splunk	The following analytic detects executions of cmd.exe spawned by processes that are commonly abused by attackers and do not typically launch cmd.exe. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-05-13	dcfd6b40-42f9-469d-a433-2e53f7486664	-
Splunk	The following analytic identifies the execution of `PsExec.exe` with the `accepteula` flag in the command line. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-10-09	27c3a83d-cada-47c6-9042-67baf19d2574
Splunk	The following detects the execution of cscript.exe or wscript.exe processes spawned by cmd.exe, leveraging Endpoint Detection and Response (EDR) telemetry mapped to the Endpoint data model, with additional contextual filtering to improve fidelity and reduce false positives. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Bhavin Patel, Mauricio Velazco, Splunk	2020-04-29	2026-05-13	b89919ed-fe5f-492c-b139-95dbb162039e
	Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. (...)	Generic	experimental	ps_script	windows	PowerShell	Persistence, Privilege Escalation Account Manipulation Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Domain Accounts	-	low	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-05-24	—	9b111d8e-92e0-4153-88bc-daefc1333aba
	Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs. (...)	Generic	experimental	ps_script	windows	PowerShell	Persistence, Privilege Escalation Account Manipulation Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Domain Accounts	-	medium	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-05-24	—	02122374-b74e-495c-b285-9e4da973f3d6
	Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. (...)	Generic	experimental	dns	windows	Sysmon	Command and Control Application Layer Protocol DNS Execution Command and Scripting Interpreter Windows Command Shell	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-11-19	—	c082c2b0-525b-4dbc-9a26-a57dc4692074
	Detects Elise backdoor activity used by APT32	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	critical	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2018-01-31	2023-03-09	e507feb7-5f73-4ef6-a970-91bb6f6d744f
Splunk	The following analytic detects executable files (.exe, .dll, etc.) being written to Windows administrative SMB shares (Admin$, IPC$, C$). (...)	Generic	stable	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-04-26	2026-08-05	f63c34fe-a435-11eb-935a-acde48001122
	Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability rep (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2020-10189	high	Florian Roth (Nextron Systems)	2020-03-25	2023-01-21	846b866e-2a57-46ee-8e16-85fa92759be7
	Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and Partner (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Privilege Escalation Exploitation for Privilege Escalation Execution, Stealth Hijack Execution Flow	CVE-2019-1378	high	Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro	2019-11-15	2021-11-27	1c373b6d-76ce-4553-997d-8c1da9a6b5f5
	Detects repeated failed (outgoing) attempts to mount a hidden share	Unsupported	unsupported	-	windows	SMB Client	Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Fabian Franz	2022-08-30	2023-02-24	1c3be8c5-6171-41d3-b792-cab6f717fcdb
	This detection excludes known namped pipes accessible remotely and notify on newly observed ones, ma (...)	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Samir Bousseaden	2019-04-03	2023-03-14	52d8b0c6-53d6-439a-9e41-52ad442ad9ad
	This detection excludes known namped pipes accessible remotely and notify on newly observed ones, ma (...)	Generic	test	-	-	SMB · Zeek	Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Samir Bousseaden, @neu5ron, Tim Shelton	2020-04-02	2022-12-27	021310d9-30a6-480a-84b7-eaa69aeb92bb
	This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access Brute Force Execution Command and Scripting Interpreter PowerShell Windows Command Shell Discovery Password Policy Discovery Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Florian Roth (Nextron Systems)	2022-02-25	2023-03-08	42a993dd-bb3e-48c8-b372-4d6684c4106c
	Detects various execution patterns of the CrackMapExec pentesting framework	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Execution, Persistence, Privilege Escalation Scheduled Task/Job Execution Windows Management Instrumentation	-	high	Thomas Patzke	2020-05-22	2023-11-06	058f4380-962d-40a5-afce-50207d36d7e2
	Detects the use of Jlaive to execute assemblies in a copied PowerShell	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell	-	medium	Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)	2022-05-24	2023-02-22	0a99eb3e-1617-41bd-b095-13dc767f3def
	Detects command line parameters used by Koadic hack tool	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Visual Basic JavaScript	-	high	wagga, Jonhnathan Ribeiro, oscd.community	2020-01-12	2023-02-11	5cddf373-ef00-4112-ad72-960ac29bac34
	Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. (...)	Generic	experimental	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-08	—	efc21479-9e83-41da-8cf1-122e06ba8db3
	Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Windows Command Shell Execution Native API Stealth System Binary Proxy Execution Rundll32	-	high	Alexander Rausch	2020-06-24	2023-03-01	95022b85-ff2a-49fa-939a-d7b8f56eeb9b
	Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Luca Di Bartolomeo (CrimpSec)	2024-01-29	—	055fb54c-a8f4-4aee-bd44-f74cf30a0d9d
	Detects the launch of a child process via "conhost.exe" with the "--headless" flag. (...)	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-07-23	—	00ca75ab-d5ce-43be-b86c-55ff39c6abfc
	Detects a suspicious child process of a Microsoft HTML Help (HH.exe)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic JavaScript Initial Access Phishing Spearphishing Attachment Stealth System Binary Proxy Execution Compiled HTML File Regsvr32 Rundll32 Execution Windows Management Instrumentation	-	high	Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)	2020-04-01	2023-04-12	52cad028-0ff0-4854-8f67-d25dfcbc78b4
Splunk	The following analytic identifies the use of suspicious command-line parameters associated with Impacket tools, such as `wmiexec.py`, `smbexec.py`, `dcomexec.py`, and `atexec.py`, which are used for lateral movement and remote code execution. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Mauricio Velazco, Splunk	2021-11-19	2026-05-13	8ce07472-496f-11ec-ab3b-3e22fbd008af
Splunk	The following analytic identifies suspicious command-line parameters associated with the use of Impacket's smbexec.py for lateral movement. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Michael Haag, Splunk	2023-04-25	2026-05-13	bb3c1bac-6bdf-4aa0-8dc9-068b8b712a76
Splunk	The following analytic detects the use of Impacket's `wmiexec.py` tool for lateral movement by identifying specific command-line parameters. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Michael Haag, Splunk	2021-11-19	2026-10-09	d6e464e4-5c6a-474e-82d2-aed616a3a492
	Detects execution of Impacket's psexec.py.	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Bhabesh Raj	2020-12-14	2022-09-22	32d56ea1-417f-44ff-822b-882873f5f43b
	Detects when an instance identity has taken an action that isn't inside SSM. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Domain Accounts	-	high	jamesc-grafana	2024-07-11	—	352a918a-34d8-4882-8470-44830c507aa3
	Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...)	Unsupported	unsupported	service	windows	WinEventLog System	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-21	2022-03-21	1a17ce75-ff0d-4f02-9709-2b7bb5618cf0
	Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...)	Generic	test	service	windows	WinEventLog Security	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-21	2022-10-05	6fb63b40-e02a-403e-9ffd-3bcc1d749442
	Alerts on Metasploit host's authentications on the domain.	Generic	test	authentication	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Chakib Gzenayi (@Chak092), Hosni Mribah	2020-05-06	2024-01-25	72124974-a68b-4366-b990-d30e0b2a190d
Splunk	Microsoft Intune device remediation scripts are a tool administrators can use to remotely manage devices, this functionality can also be abused for SYSTEM level code execution and lateral movement to intune managed devices. (...)	Hunting	stable	cloud_audit	-	Azure	Stealth Indirect Command Execution Command and Control Ingress Tool Transfer Lateral Movement Remote Services Cloud Services Execution, Lateral Movement Software Deployment Tools	-	medium	Dean Luxton	2025-01-06	2026-05-13	6fe42e07-15b1-4caa-b547-7885666cb1bd
Splunk	Microsoft Intune device management configuration policies are a tool administrators can use to remotely manage policies and settings on intune managed devices. (...)	Hunting	stable	cloud_audit	-	Azure	Defense Impairment Disable or Modify System Firewall Defense Impairment Disable or Modify Tools Privilege Escalation, Defense Impairment Domain or Tenant Policy Modification Lateral Movement Remote Services Cloud Services Execution, Lateral Movement Software Deployment Tools	-	medium	Dean Luxton	2025-01-06	2026-05-13	3c49e5ed-625c-408c-a2c7-8e2b524efb2c