Poseidon Group G0033

Created: 31 May 2017
Last modified: 31 July 2026
Alias: Poseidon Group

Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Poseidon Group as a security firm. [1]

Techniques26th pct

TacticsBottom 20%

Tools & malwareNone recorded

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Poseidon Group MITRE reference G0033

OS Credential Dumping T1003 ↗

Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.2

Credential Access51 detection rules

System Service Discovery T1007 ↗

After compromising a victim, Poseidon Group discovers all running services.3

Discovery13 detection rules

Match Legitimate Resource Name or Location T1036.005 ↗

Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.4

Stealth30 detection rules

System Network Connections Discovery T1049 ↗

Poseidon Group obtains and saves information about victim network interfaces and addresses.5

Discovery17 detection rules

Process Discovery T1057 ↗

After compromising a victim, Poseidon Group lists all running processes.6

Discovery10 detection rules

PowerShell T1059.001 ↗

The Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components.7

Execution300 detection rules

Standing G0033

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques826th pct

26th percentile · 74% of 176 ATT&CK groups have more Enterprise techniques.

Tactics4Bottom 20%

20th percentile · 80% of 176 ATT&CK groups have more tactics spanned.

Tools & malware0Bottom 9%

9th percentile · 91% of 176 ATT&CK groups have more tools and malware.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique28.5med71st pct

71st percentile · 71% of 176 ATT&CK groups have this many detection rules per technique or fewer.

Tests / technique9med

Poseidon Group detections G0033

467 distinct rules cover the 8 techniques recorded for this group. 344 Sigma · 123 Splunk.

8 covered by at least one rule467 distinct rules in total

Showing 1-50 of 400+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_access	windows	-	Credential Access OS Credential Dumping	-	low	frack113, X__Junior (Nextron Systems)	2022-04-09	2024-07-29	91cb43db-302a-47e3-b3c8-7ede481e27bf
	Detects file access requests to chromium based browser sensitive files by uncommon processes. (...)	Hunting	test	file_access	windows	-	Credential Access OS Credential Dumping	-	low	X__Junior (Nextron Systems)	2024-07-29	—	c5f37810-a85f-4186-81e9-33f23abb4141
	Detects file access requests to crypto currency files by uncommon processes. (...)	Generic	test	file_access	windows	-	Credential Access OS Credential Dumping	-	medium	X__Junior (Nextron Systems)	2024-07-29	—	f41b0311-44f9-44f0-816d-dd45e39d4bc8
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	2025-07-09	9212f354-7775-4e28-9c9f-8f0a4544e664
	Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Domain Account	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-03-14	—	e5d36acd-acb4-4c6f-a13f-9eb203d50099
	Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs	Generic	test	-	windows	WinEventLog Security	Discovery Account Discovery Domain Account	-	high	Samir Bousseaden	2019-04-03	2022-07-13	35ba1d85-724d-42a3-889f-2e2362bcaf23
	Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...)	Generic	experimental	file_event	windows	Sysmon	Discovery Account Discovery Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Domain Groups	-	medium	Arnim Rupp (Nextron Systems), Thomas Patzke	2025-07-09	—	0a1255c5-d732-4b62-ac02-b5152d34fb83
Splunk	The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. (...)	Generic	stable	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-25	2026-10-02	de7fcadc-04f3-11ec-a241-acde48001122
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
	Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)	Generic	stable	antivirus	-	-	Credential Access OS Credential Dumping LSASS Memory Security Account Manager Credential Access Steal or Forge Kerberos Tickets	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	78cc2dd2-7d20-4d32-93ff-057084c38b93
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
	focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cob (...)	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	critical	ok @securonix invrep_de, oscd.community	2020-10-09	2022-12-25	8d31a8ce-46b5-4dd6-bdc3-680931f1db86
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
	Detects default file names outputted by the BloodHound collection tool SharpHound	Generic	test	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Execution Command and Scripting Interpreter PowerShell Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	high	C.J. May	2022-08-09	2026-02-19	02773bed-83bf-469f-b7ff-e676e7d78bab
	Detects powershell execution with that make use of to the bxor (Bitwise XOR). (...)	Hunting	test	ps_classic_start	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	low	Teymur Kheirkhabarov, Harish Segar	2020-06-29	2024-12-11	812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
	Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access OS Credential Dumping	-	medium	Julia Fomina, oscd.community	2020-10-09	2025-10-31	93671f99-04eb-4ab4-a161-70d446a84003
	Detects calls to cmdlets that are used to export certificates from the local certificate store. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Credential Access Unsecured Credentials Private Keys	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-18	—	9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-11-01	2025-10-07	87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
	Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.	Generic	test	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	frack113	2021-10-20	2023-12-14	61d0475c-173f-4844-86f7-f3eebae1c66b
	Detects execution of ChromeLoader malware via a registered scheduled task	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Persistence, Privilege Escalation Scheduled Task/Job Scheduled Task Persistence Software Extensions	-	high	@kostastsale	2022-01-10	—	0a74c5a9-1b71-4475-9af2-7829d320d5c2
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Command and Control Non-Standard Port Privilege Escalation, Stealth Process Injection Command and Control Remote Access Tools Lateral Movement Remote Services	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
Splunk	This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Initial Access Exploit Public-Facing Application Execution Exploitation for Client Execution Credential Access OS Credential Dumping Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	ec99bb81-c31b-4837-8c7d-1b32aa70b337
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
	Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell	-	high	Florian Roth (Nextron Systems)	2022-08-23	2026-05-13	a16980c2-0c56-4de0-9a79-17971979efdd
	Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Command and Control Ingress Tool Transfer	-	medium	Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community	2019-01-16	2021-11-27	1ac8666b-046f-4201-8aba-1951aaec03a3
	Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Obfuscated Files or Information	-	medium	Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton	2020-10-11	2023-02-01	74403157-20f5-415d-89a7-c505779585cf
	Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	a80d927d-ac6e-443f-a867-e8d6e3897318
	Detects suspicious processes based on name and location that access the windows credential manager and vault. (...)	Generic	test	file_access	windows	-	Credential Access OS Credential Dumping	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-11	2026-07-28	407aecb1-e762-4acf-8c7b-d087bcff3bb6
	Detects usage of crontab to list the tasks of the user	Generic	test	process_creation	linux	Sysmon	Discovery System Service Discovery	-	low	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-06-02	—	403ed92c-b7ec-4edd-9947-5b535ee12d46
Splunk	The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)	Generic	stable	file_event	-	CrushFTP	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Initial Access Exploit Public-Facing Application	CVE-2025-31161	medium	Michael Haag, Splunk	2025-04-14	2026-09-08	82eb7f64-d219-4e21-acfe-956de84c1a35
	Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected (...)	Emerging	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	CVE-2022-24527	high	Florian Roth (Nextron Systems)	2022-04-13	—	e0a41412-c69a-446f-8e6e-0e6d7483dad7
Splunk	The following analytic detects the execution of the `Invoke-AzureHound` command-line argument, commonly used by the AzureHound tool. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	26f02e96-c300-11eb-b611-acde48001122
Splunk	The following analytic detects the creation of specific AzureHound-related files, such as `*-azurecollection.zip` and various `.json` files, on disk. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-05-13	1c34549e-c31b-11eb-996b-acde48001122
Splunk	The following analytic detects the use of the Certify tool via an in-memory PowerShell function to enumerate Active Directory Certificate Services (AD CS) environments. (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Credential Access Steal or Forge Authentication Certificates	-	medium	Steven Dick	2023-07-28	2026-05-13	f533ca6c-9440-4686-80cb-7f294c07812a
Splunk	The following analytic detects suspicious PowerShell execution indicative of PowerShell-Empire activity. (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Michael Haag, Splunk	2021-06-09	2026-05-13	bc1dc6b8-c954-11eb-bade-acde48001122
Splunk	The following analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). (...)	Generic	stable	ps_script	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell Credential Access OS Credential Dumping	-	medium	Michael Haag, Splunk	2021-06-09	2026-05-13	8148c29c-c952-11eb-9255-acde48001122
Splunk	The following analytic detects the execution of SharpHound command-line arguments, specifically `-collectionMethod` and `invoke-bloodhound`. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	a0bdd2f6-c2ff-11eb-b918-acde48001122
Splunk	The following analytic detects the creation of files typically associated with SharpHound, a reconnaissance tool used for gathering domain and trust data. (...)	Generic	stable	file_event	windows	Sysmon	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	42b4b438-beed-11eb-ba1d-acde48001122
Splunk	The following analytic detects the usage of the SharpHound binary by identifying its original filename, `SharpHound.exe`, and the process name. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Local Account Domain Account Discovery Domain Trust Discovery Discovery Permission Groups Discovery Local Groups Domain Groups	-	medium	Michael Haag, Splunk	2021-06-03	2026-10-02	dd04b29a-beed-11eb-87bc-acde48001122
	This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Execution, Stealth Trusted Developer Utilities Proxy Execution	-	medium	Agro (@agro_sev) oscd.community	2020-10-10	2022-12-09	0152550d-3a26-4efd-9f0e-54a0b28ae2f3
Splunk	The following analytic identifies the execution of `dsquery.exe` with command-line arguments used to discover domain users. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Domain Account	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-25	2026-05-13	b1a8ce04-04c2-11ec-bea7-acde48001122
Splunk	The following analytic detects the execution of `wmic.exe` with command-line arguments used to query for domain users. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Account Discovery Domain Account	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-08-25	2026-05-13	383572e0-04c5-11ec-bdcc-acde48001122
	Domain user and group enumeration via network reconnaissance. (...)	Unsupported	unsupported	-	-	DCE/RPC · Zeek	Discovery Account Discovery Domain Account Discovery System Information Discovery	-	medium	Nate Guagenti (@neu5ron), Open Threat Research (OTR)	2020-05-03	2023-03-24	66a0bdc6-ee04-441a-9125-99d2eb547942

...