group

APT33 G0064

Created: 18 April 2018
Last modified: 31 July 2026
Aliases: APT33 · HOLMIUM · Elfin · Peach Sandstorm

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.[1][2]

Techniques68th pct

Tactics66th pct

Tools & malwareTop 10%

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing G0064

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects the execution of 7z or 7za processes with command lines pointing to SMB network shares. (...)	Hunting	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Teoderick Contreras, Splunk	2021-08-17	2026-05-13	01d29b48-ff6f-11eb-b81e-acde48001123
	Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-27	2026-06-05	ec570e53-4c76-45a9-804d-dc3f355ff7a7
Splunk	The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. (...)	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-10-09	fb4c31b0-13e8-4155-8aa5-24de4b8d6717
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_event	windows	WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	low	Daniel Koifman (@Koifsec), Nasreddine Bencherchali	2024-10-21	—	4b60e527-ec73-4b47-8cb3-f02ad927ca65
	Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	frack113	2022-01-30	—	fc028194-969d-4122-8abe-0470d5b8f12f
	Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.	Generic	test	file_access	windows	-	Credential Access Unsecured Credentials Group Policy Preferences	-	medium	frack113	2023-12-21	2024-07-29	d51694fe-484a-46ac-92d6-969e76d60d10
	Detects file access requests to the Windows Sysvol Policies Share by uncommon processes	Hunting	test	file_access	windows	-	Credential Access Unsecured Credentials Group Policy Preferences	-	medium	frack113	2023-12-21	—	8344c19f-a023-45ff-ad63-a01c5396aea0
	Detects accounts that are created or deleted by non-approved users.	Placeholder	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'	2022-08-11	2023-12-15	c98184ba-4a27-4e10-b7b7-da48e71f4d25
	Detects when an account was created and deleted in a short period of time.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton	2022-08-11	2022-08-18	6f583da0-3a90-4566-a4ed-83c09fe18bbf
	Detects when an account is disabled or blocked for sign in but tried to log in	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Yochana Henderson, '@Yochana-H'	2022-06-17	—	4afac85c-224a-4dd7-b1af-8da40e1c60bd
	This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.	Generic	test	authentication	windows	WinEventLog Security	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Florian Roth (Nextron Systems)	2017-02-19	2025-10-17	9eb99343-d336-4020-a3cd-67f3819e68ee
	Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.	Generic	test	-	-	Azure Risk Detection · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	be4d9c86-d702-4030-b52e-c7859110e5e8
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	ps_module	windows	PowerShell	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2025-10-17	64e8e417-c19a-475a-8d19-98ea705394cc
	Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe	Generic	test	pipe_created	windows	Sysmon	Execution Command and Scripting Interpreter PowerShell	-	medium	Roberto Rodriguez @Cyb3rWard0g, Tim Shelton	2019-09-12	2025-10-07	58cb02d5-78ce-4692-b3e1-dce850aae41a
Splunk	The following analytic detects the execution of 7z.exe, a 7-Zip utility, spawned from rundll32.exe or dllhost.exe. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Collection Archive Collected Data Archive via Utility	-	medium	Michael Haag, Teoderick Contreras, Splunk	2021-04-22	2026-05-13	9364ee8e-a39a-11eb-8f1d-acde48001122
	Detects a highly relevant Antivirus alert that reports APT malware. (...)	Generic	experimental	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Arnim Rupp (Nextron Systems)	2026-06-15	—	101a1877-2cf4-474d-abfd-7f6ac4788d1a
	Detects a highly relevant Antivirus alert that reports an exploitation framework. (...)	Generic	stable	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	238527ad-3c2c-4e4f-a1f6-92fd63adb864
	Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)	Generic	stable	antivirus	-	-	Credential Access OS Credential Dumping LSASS Memory Security Account Manager Credential Access Steal or Forge Kerberos Tickets	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	78cc2dd2-7d20-4d32-93ff-057084c38b93
	Detects a highly relevant Antivirus alert that reports a remote access tool. (...)	Generic	experimental	antivirus	-	-	Execution Exploitation for Client Execution Command and Control Remote Access Tools Remote Desktop Software	-	critical	Arnim Rupp (Nextron Systems)	2026-06-15	—	97233998-3838-4581-88c6-f1d19d3993fb
	Detects when a configuration change is made to an applications AppID URI.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Unsecured Credentials Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	1b45b0d1-773f-4f23-aedc-814b759563b1
	Detects when a configuration change is made to an applications URI. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Credential Access Steal Application Access Token Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-02	—	0055ad1f-be85-4798-83cf-a6da17c993b3
	Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. (...)	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-01	—	248649b7-d64f-46f0-9fb2-a52774166fb5
	Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. (...)	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-01	—	55695bc0-c8cf-461f-a379-2535f563c854
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects DNS queries made by "AppInstaller.EXE". (...)	Generic	test	dns	windows	Sysmon	Command and Control Ingress Tool Transfer	-	medium	frack113	2021-11-24	2023-11-09	7cff77e1-9663-46a3-8260-17f2e1aa9d0a
	Detects suspicious user agent strings used in APT malware in proxy logs	Generic	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols	-	high	Florian Roth (Nextron Systems), Markus Neis	2019-11-12	2024-02-15	6ec820f2-e963-4801-9127-d8b2dce4d31b
	Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2019-02-21	2023-03-10	03e2746e-2b31-42f1-ab7a-eb39365b2422
	Detects suspicious user agent string of APT40 Dropbox tool	Emerging	test	proxy	-	-	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage	-	high	Thomas Patzke	2019-11-12	2023-05-18	5ba715b6-71b7-44fd-8245-f66893e81b3d
	Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Ingress Tool Transfer	-	medium	Victor Sergeev, oscd.community	2020-10-09	2023-10-18	eee00933-a761-4cd0-be70-c42fe91731e7
	The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Phishing Spearphishing Attachment Execution User Execution	-	medium	Sreeman	2020-03-13	2022-04-14	24de4f3b-804c-4165-b442-5a06a2302c7e
Splunk	The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Patrick Bareiss, Splunk	2021-02-22	2026-05-13	22cc7a62-3884-48c4-82da-592b8199b72f
Splunk	The following analytic detects updates to the SAML provider in AWS. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	635c26cc-0fd1-4098-8ec9-824bf9544b11
	Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.	Generic	test	-	-	Azure Risk Detection · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	1a41023f-1e70-4026-921a-4d9341a9038e
	Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...)	Generic	test	-	windows	WinEventLog Application	Impact Endpoint Denial of Service Application or System Exploitation Execution Exploitation for Client Execution Credential Access Exploitation for Credential Access Privilege Escalation Exploitation for Privilege Escalation Stealth Exploitation for Stealth Lateral Movement Exploitation of Remote Services	CVE-2020-0601	critical	Florian Roth (Nextron Systems), Zach Mathis	2020-01-15	2022-10-22	48d91a3a-2363-43ba-a456-ca71ac3da5c2
	Detects kernel auto-loading of the authencesn crypto module via modprobe This occurs when user-space (...)	Emerging	experimental	process_creation	linux	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Kernel Modules and Extensions Privilege Escalation Exploitation for Privilege Escalation	CVE-2026-31431	high	Gene Kazimiarovich	2026-05-09	—	474b415a-d917-4f3b-8c62-9e1a0d5f7b48
	Detect when authentications to important application(s) only required single-factor authentication	Placeholder	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	MikeDuddington, '@dudders1'	2022-07-28	2026-05-08	f272fb46-25f2-422c-b667-45837994980f
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Automated Collection Credential Access Unsecured Credentials Credentials In Files	-	medium	frack113	2021-07-28	2022-11-11	f576a613-2392-4067-9d1a-9345fb58d8d1
Splunk	The following analytic identifies access denied error when attempting to invoke AWS Bedrock models. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Lateral Movement Use Alternate Authentication Material Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	c53a8e62-f741-11ee-9f6e-acde48001122
	Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization. (...)	Placeholder	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Ivan Saakov	2025-10-19	—	313e72de-0c0d-4d65-8c95-87f4d546eceb
Splunk	The following analytic identifies the creation of a new AWS IAM policy version that allows access to all resources. (...)	Generic	stable	account_management	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2021-02-22	2026-05-13	2a9b80d3-6340-4345-b5ad-212bf3d0dac4
	Detects changes to the EC2 instance startup script. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Unix Shell	-	high	faloker	2020-02-12	2022-06-07	1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
Splunk	The following analytic detects an IP address with 20 or more failed authentication attempts to the AWS Web Console within a 5-minute window. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Credential Access Brute Force Password Spraying Credential Stuffing	-	medium	Bhavin Patel, Splunk	2023-01-30	2026-05-13	f75b7f1a-b8eb-4975-a214-ff3e0a944757
	Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-b1d3-46bd-ba26-133337c0ffee
	Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-7375-4f4e-b83b-133337c0ffee
	Detects S3 Browser utility creating IAM User or AccessKey.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Execution Command and Scripting Interpreter Cloud API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	high	daniel.bohannon@permiso.io (@danielhbohannon)	2023-05-17	—	db014773-d9d9-4792-91e5-133337c0ffee
	Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Ivan Saakov	2024-12-19	—	92f84194-8d9a-4ee0-8699-c30bfac59780
	Detects when an user creates or invokes a lambda function.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Austin Songer @austinsonger	2021-10-03	2023-03-24	d914951b-52c8-485f-875e-86abab710c0b

Title

Description

APT33 G0064

APT33 MITRE reference G0064

Standing G0064

Reach

Coverage

APT33 detections G0064