group
Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.[1][2] This group has been active since at least 2009.[3][4][5][6]
In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.[7][8] Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.[9]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.101112
During the 2016 Ukraine Electric Power Attack, Sandworm Team used Mimikatz to capture and use legitimate credentials.13
Sandworm Team has used ntdsutil.exe to back up the Active Directory database, likely for credential access.14
Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.15
Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.1617
During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets. 18
During the 2016 Ukraine Electric Power Attack, Sandworm Team checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.19
Sandworm Team has copied payloads to the ADMIN$ share of remote systems and run net use to connect to network shares.2021
During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized net use to connect to network shares.22
Sandworm Team has used Base64 encoding within malware variants.23
During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.24
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
97th percentile · 97% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
94th percentile · 94% of 176 ATT&CK groups have this many tactics spanned or fewer.
97th percentile · 97% of 176 ATT&CK groups have this many tools and malware or fewer.
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
40th percentile · 60% of 176 ATT&CK groups have more detection rules per technique.
22nd percentile · 78% of 176 ATT&CK groups have more atomic tests per technique.
65% of the population shares a single value across only 12 distinct values, so a percentile here would rank the tie, not the entity.
43% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this group’s 79 Enterprise techniques.
Technique Campaign use over its cumulative rule count.
2074 distinct rules cover the 79 techniques recorded for this group. 1376 Sigma · 698 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Splunk | The following analytic identifies DNS queries to domains associated with the 3CX supply chain attack. (...) | Generic | stable | dns | windows | Sysmon | medium | Michael Haag, Splunk | 2023-04-11 | 2026-09-22 | 791b727c-deec-4fbe-a732-756131b3c5a1 | ||||
Splunk | The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. (...) | Generic | stable | process_access | windows | Sysmon | - | medium | Patrick Bareiss, Splunk | 2019-12-11 | 2026-10-09 | fb4c31b0-13e8-4155-8aa5-24de4b8d6717 | |||
Detects access to ADMIN$ network share | Generic | test | network_connection | windows | WinEventLog Security | - | low | Florian Roth (Nextron Systems) | 2017-03-04 | 2024-01-16 | 098d7118-55bc-4912-a836-dc6483a8d150 | ||||
Detects file access requests to browser credential stores by uncommon processes. (...) | Hunting | test | file_event | windows | WinEventLog Security | - | low | Daniel Koifman (@Koifsec), Nasreddine Bencherchali | 2024-10-21 | — | 4b60e527-ec73-4b47-8cb3-f02ad927ca65 | ||||
Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...) | Generic | test | ps_script | windows | PowerShell | - | medium | frack113 | 2022-01-30 | — | fc028194-969d-4122-8abe-0470d5b8f12f | ||||
Splunk | The following analytic identifies access to the /api/v1/configuration/users/user-roles/user-role/rest-userrole1/web/web-bookmarks/bookmark endpoint, which is associated with CVE-2023-46805 and CVE-2024-21887 vulnerabilities. (...) | Generic | stable | webserver | - | Suricata | medium | Michael Haag, Splunk | 2024-01-17 | 2026-05-13 | 15838756-f425-43fa-9d88-a7f88063e81a | ||||
Detects accounts that are created or deleted by non-approved users. | Placeholder | test | cloud_audit | - | Azure Audit Logs · Azure | - | medium | Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1' | 2022-08-11 | 2023-12-15 | c98184ba-4a27-4e10-b7b7-da48e71f4d25 | ||||
Detects when an account was created and deleted in a short period of time. | Generic | test | cloud_audit | - | Azure Audit Logs · Azure | - | high | Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton | 2022-08-11 | 2022-08-18 | 6f583da0-3a90-4566-a4ed-83c09fe18bbf | ||||
This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted. | Generic | test | authentication | windows | WinEventLog Security | - | medium | Florian Roth (Nextron Systems) | 2017-02-19 | 2025-10-17 | 9eb99343-d336-4020-a3cd-67f3819e68ee | ||||
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory. | Generic | test | ps_script | windows | PowerShell | - | low | frack113 | 2022-03-17 | 2023-07-08 | 36bed6b2-e9a0-4fff-beeb-413a92b86138 | ||||
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-03-14 | 2025-07-09 | 9212f354-7775-4e28-9c9f-8f0a4544e664 | ||||
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-03-14 | — | e5d36acd-acb4-4c6f-a13f-9eb203d50099 | ||||
Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address. | Generic | test | - | - | Azure Risk Detection · Azure | - | high | Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' | 2023-09-03 | — | be4d9c86-d702-4030-b52e-c7859110e5e8 | ||||
Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs | Generic | test | - | windows | WinEventLog Security | - | high | Samir Bousseaden | 2019-04-03 | 2022-07-13 | 35ba1d85-724d-42a3-889f-2e2362bcaf23 | ||||
Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. (...) | Generic | experimental | file_event | windows | Sysmon | - | medium | Arnim Rupp (Nextron Systems), Thomas Patzke | 2025-07-09 | — | 0a1255c5-d732-4b62-ac02-b5152d34fb83 | ||||
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). (...) | Generic | test | pipe_created | windows | Sysmon | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2021-10-08 | 2023-11-30 | 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3 | ||||
Detect remote login by Administrator user (depending on internal pattern). | Generic | test | authentication | windows | WinEventLog Security | - | low | juju4 | 2017-10-29 | 2022-10-09 | 0f63e1ef-1eb9-4226-9d54-8927ca08520a | ||||
Splunk | The following analytic detects potential exploitation attempts against Adobe ColdFusion vulnerabilities CVE-2023-29298 and CVE-2023-26360. (...) | Anomaly | stable | webserver | - | Suricata | medium | Michael Haag, Splunk | 2023-08-23 | 2026-05-13 | d6821c0b-fcdc-4c95-a77f-e10752fae41a | ||||
Splunk | The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. (...) | Anomaly | stable | webserver | - | Suricata | medium | Michael Haag, Splunk | 2023-08-23 | 2026-05-13 | 695aceae-21db-4e7f-93ac-a52e39d02b93 | ||||
Detects the deletion of the "Zone.Identifier" ADS. (...) | Hunting | test | file_delete | windows | Sysmon | - | low | frack113 | 2023-09-04 | — | 7eac0a16-5832-4e81-865f-0268a6d19e4b | ||||
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...) | Generic | test | file_delete | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-04 | 2025-07-04 | 3109530e-ab47-4cc6-a953-cac5ebcc93ae | ||||
Detects suspicious access to URLs that was noticed in cases in which attackers exploitated the ADSel (...) | Emerging | test | webserver | - | - | high | Tobias Michalski (Nextron Systems), Max Altgelt (Nextron Systems) | 2021-09-20 | 2023-01-02 | 6702b13c-e421-44cc-ab33-42cc25570f11 | |||||
Splunk | The following analytic detects the use of the `[Adsisearcher]` type accelerator in PowerShell to query Active Directory for domain users. (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Teoderick Contreras, Mauricio Velazco, Splunk | 2021-08-25 | 2026-10-02 | de7fcadc-04f3-11ec-a241-acde48001122 | |||
Detects javaw.exe in AppData folder as used by Adwind / JRAT | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community | 2017-11-10 | 2022-10-09 | 1fac1481-2dbc-48b2-9096-753c49b4ec71 | ||||
Detects javaw.exe in AppData folder as used by Adwind / JRAT | Generic | test | file_event | windows | Sysmon | - | high | Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community | 2017-11-10 | 2022-12-02 | 0bcfabcb-7929-47f4-93d6-b33fb67d34d1 | ||||
Detects the deletion of all backups or system state backups via "wbadmin.exe". (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | frack113, Nasreddine Bencherchali (Nextron Systems) | 2021-12-13 | 2024-05-10 | 639c9081-f482-47d3-a0bd-ddee3d4ecd76 | ||||
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe | Generic | test | ps_module | windows | PowerShell | - | medium | Roberto Rodriguez @Cyb3rWard0g | 2019-08-11 | 2025-10-17 | 64e8e417-c19a-475a-8d19-98ea705394cc | ||||
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe | Generic | test | pipe_created | windows | Sysmon | - | medium | Roberto Rodriguez @Cyb3rWard0g, Tim Shelton | 2019-09-12 | 2025-10-07 | 58cb02d5-78ce-4692-b3e1-dce850aae41a | ||||
Detects loading of Amsi.dll by uncommon processes | Hunting | test | image_load | windows | Sysmon | - | low | frack113 | 2023-03-12 | 2026-06-29 | facd1549-e416-48e0-b8c4-41d7215eedc8 | ||||
Detects a highly relevant Antivirus alert that reports APT malware. (...) | Generic | experimental | antivirus | - | - | - | critical | Arnim Rupp (Nextron Systems) | 2026-06-15 | — | 101a1877-2cf4-474d-abfd-7f6ac4788d1a | ||||
Detects a highly relevant Antivirus alert that reports an exploitation framework. (...) | Generic | stable | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2018-09-09 | 2026-06-15 | 238527ad-3c2c-4e4f-a1f6-92fd63adb864 | ||||
Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...) | Generic | stable | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2018-09-09 | 2026-06-15 | 78cc2dd2-7d20-4d32-93ff-057084c38b93 | ||||
Detects a highly relevant Antivirus alert that reports ransomware. (...) | Generic | test | antivirus | - | - | - | critical | Florian Roth (Nextron Systems), Arnim Rupp | 2022-05-12 | 2026-06-15 | 4c6ca276-d4d0-4a8c-9e4c-d69832f8671f | ||||
Detects a highly relevant Antivirus alert that reports a remote access tool. (...) | Generic | experimental | antivirus | - | - | - | critical | Arnim Rupp (Nextron Systems) | 2026-06-15 | — | 97233998-3838-4581-88c6-f1d19d3993fb | ||||
Detects a highly relevant Antivirus alert that reports a web shell. (...) | Generic | test | antivirus | - | - | - | high | Florian Roth (Nextron Systems), Arnim Rupp | 2018-09-09 | 2026-06-29 | fdf135a2-9241-4f96-a114-bb404948f736 | ||||
Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective | Emerging | test | process_creation | linux | Sysmon | high | Nasreddine Bencherchali (Nextron Systems) | 2022-07-20 | — | c8a5f584-cdc8-42cc-8cce-0398e4265de3 | |||||
Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective | Emerging | test | webserver | - | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-07-19 | 2023-01-02 | 1a9a04fd-02d1-465c-abad-d733fd409f9c | |||||
Detects an issue in apache logs that reports threading related errors | Generic | test | - | - | Apache | - | medium | Florian Roth (Nextron Systems) | 2019-01-22 | 2021-11-27 | e9a2b582-3f6a-48ac-b4a1-6849cdc50b3c | ||||
Detects the removal or uninstallation of an application via "Wmic.EXE". | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-01-28 | 2024-07-02 | b53317a0-8acf-4fd1-8de8-a5401e776b96 | ||||
Detects an attempt to terminate a process via "wmic" with the "call terminate" flag. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-09-11 | — | 49d9671b-0a0a-4c09-8280-d215bfd30662 | ||||
An application has been removed. (...) | Generic | test | - | windows | WinEventLog Application | - | low | frack113 | 2022-01-28 | 2022-09-17 | 570ae5ec-33dc-427c-b815-db86228ad43e | ||||
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. (...) | Generic | test | authentication | - | Azure Sign-in Logs · Azure | - | medium | Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' | 2022-06-01 | — | 248649b7-d64f-46f0-9fb2-a52774166fb5 | ||||
Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. (...) | Generic | test | authentication | - | Azure Sign-in Logs · Azure | - | medium | Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' | 2022-06-01 | — | 55695bc0-c8cf-461f-a379-2535f563c854 | ||||
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled. | Generic | experimental | - | windows | AppLocker | - | medium | heyyanu | 2026-03-26 | — | 557e3bd3-7f21-495d-8d50-7c8bdfb8041c | ||||
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. | Generic | test | - | windows | AppLocker | - | medium | Pushkarev Dmitry | 2020-06-28 | 2025-12-03 | 401e5d00-b944-11ea-8f9a-00163ecd60ae | ||||
Detects DNS queries made by "AppInstaller.EXE". (...) | Generic | test | dns | windows | Sysmon | - | medium | frack113 | 2021-11-24 | 2023-11-09 | 7cff77e1-9663-46a3-8260-17f2e1aa9d0a | ||||
Detects suspicious user agent strings used in APT malware in proxy logs | Generic | test | proxy | - | - | - | high | Florian Roth (Nextron Systems), Markus Neis | 2019-11-12 | 2024-02-15 | 6ec820f2-e963-4801-9127-d8b2dce4d31b | ||||
Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant | Emerging | stable | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems), @41thexplorer | 2018-11-20 | 2023-03-08 | 7453575c-a747-40b9-839b-125a0aae324b | ||||
Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant | Emerging | stable | file_event | windows | Sysmon | - | critical | @41thexplorer | 2018-11-20 | 2023-02-20 | 3a3f81ca-652c-482b-adeb-b1c804727f74 | ||||
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2019-02-21 | 2023-03-10 | 03e2746e-2b31-42f1-ab7a-eb39365b2422 |