Leafminer G0077

Created: 17 October 2018
Last modified: 31 July 2026
Aliases: Leafminer · Raspite

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. [1]

Techniques49th pct

Tactics52nd pct

Tools & malware55th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Leafminer MITRE reference G0077

LSASS Memory T1003.001 ↗

Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.2

Credential Access90 detection rules

LSA Secrets T1003.004 ↗

Leafminer used several tools for retrieving login and password information, including LaZagne.3

Credential Access13 detection rules

Cached Domain Credentials T1003.005 ↗

Leafminer used several tools for retrieving login and password information, including LaZagne.4

Credential Access9 detection rules

Remote System Discovery T1018 ↗

Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.5

Discovery39 detection rules

Command Obfuscation T1027.010 ↗

Leafminer obfuscated scripts that were used on victim machines.6

Stealth13 detection rules

Network Service Discovery T1046 ↗

Leafminer scanned network services to search for vulnerabilities in the victim system.7

Discovery33 detection rules

Standing G0077

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques1749th pct

49th percentile · 51% of 176 ATT&CK groups have more Enterprise techniques.

Tactics952nd pct

52nd percentile · 52% of 176 ATT&CK groups have this many tactics spanned or fewer.

Tools & malware455th pct

55th percentile · 55% of 176 ATT&CK groups have this many tools and malware or fewer.

Campaigns089% tie · 4 values

89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique13med37th pct

37th percentile · 63% of 176 ATT&CK groups have more detection rules per technique.

Tests / technique9med

Leafminer detections G0077

401 distinct rules cover the 17 techniques recorded for this group. 261 Sigma · 140 Splunk.

17 covered by at least one rule401 distinct rules in total

Showing 1-50 of 400+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
Splunk	The following analytic detects attempts to dump the LSASS process memory, a common technique in credential dumping attacks. (...)	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-10-09	fb4c31b0-13e8-4155-8aa5-24de4b8d6717
	Detects file access requests to browser credential stores by uncommon processes. (...)	Hunting	test	file_event	windows	WinEventLog Security	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	low	Daniel Koifman (@Koifsec), Nasreddine Bencherchali	2024-10-21	—	4b60e527-ec73-4b47-8cb3-f02ad927ca65
	Adversaries may acquire credentials from web browsers by reading files specific to the target browser. (...)	Generic	test	ps_script	windows	PowerShell	Credential Access Credentials from Password Stores Credentials from Web Browsers	-	medium	frack113	2022-01-30	—	fc028194-969d-4122-8abe-0470d5b8f12f
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
Splunk	The following analytic detects the execution of network scanning utilities such as Advanced IP Scanner or Advanced Port Scanner. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Discovery Network Service Discovery Discovery Network Share Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-10-24	2026-05-13	9a4e50c7-5b62-4d52-93b4-f2b61332e9a5
	Detects the use of Advanced IP Scanner. (...)	Generic	test	file_event	windows	Sysmon	Discovery Network Service Discovery	-	medium	@ROxPinTeddy	2020-05-12	2022-11-29	fed85bf9-e075-4280-9159-fbe8a023d6fa
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-10-09	1fac1481-2dbc-48b2-9096-753c49b4ec71
	Detects javaw.exe in AppData folder as used by Adwind / JRAT	Generic	test	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic JavaScript	-	high	Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community	2017-11-10	2022-12-02	0bcfabcb-7929-47f4-93d6-b33fb67d34d1
	Detects a highly relevant Antivirus alert that reports password dumpers and stealers. (...)	Generic	stable	antivirus	-	-	Credential Access OS Credential Dumping LSASS Memory Security Account Manager Credential Access Steal or Forge Kerberos Tickets	-	critical	Florian Roth (Nextron Systems), Arnim Rupp	2018-09-09	2026-06-15	78cc2dd2-7d20-4d32-93ff-057084c38b93
	Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.	Generic	experimental	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	heyyanu	2026-03-26	—	557e3bd3-7f21-495d-8d50-7c8bdfb8041c
	Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.	Generic	test	-	windows	AppLocker	Execution Command and Scripting Interpreter PowerShell Windows Command Shell Visual Basic Python Execution User Execution Malicious File	-	medium	Pushkarev Dmitry	2020-06-28	2025-12-03	401e5d00-b944-11ea-8f9a-00163ecd60ae
	Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Archive Collected Data Archive via Utility Credential Access OS Credential Dumping LSASS Memory	-	critical	Florian Roth (Nextron Systems)	2019-02-21	2023-03-10	03e2746e-2b31-42f1-ab7a-eb39365b2422
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Automated Collection Credential Access Unsecured Credentials Credentials In Files	-	medium	frack113	2021-07-28	2022-11-11	f576a613-2392-4067-9d1a-9345fb58d8d1
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	The following analytic detects an IP address with 20 or more failed authentication attempts to the AWS Web Console within a 5-minute window. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Credential Access Brute Force Password Spraying Credential Stuffing	-	medium	Bhavin Patel, Splunk	2023-01-30	2026-05-13	f75b7f1a-b8eb-4975-a214-ff3e0a944757
Splunk	The following analytic identifies a single source IP failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Credential Access Brute Force Password Spraying Credential Stuffing	-	medium	Bhavin Patel	2022-09-26	2026-05-13	71e1fb89-dd5f-4691-8523-575420de4630
Splunk	The following analytic identifies a single source IP failing to authenticate into the AWS Console with multiple valid users. (...)	Anomaly	stable	authentication	-	AWS CloudTrail · AWS	Credential Access Brute Force Password Spraying Credential Stuffing Resource Development Compromise Accounts Cloud Accounts	-	medium	Bhavin Patel, Splunk	2022-09-26	2026-05-13	0b5c9c2b-e2cb-4831-b4f1-af125ceb1386
Splunk	The following analytic detects high-risk sign-in attempts against Azure Active Directory, identified by Azure Identity Protection. (...)	Generic	stable	authentication	-	Microsoft 365	Credential Access Brute Force Password Spraying Resource Development Compromise Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-11	2026-05-13	1ecff169-26d7-4161-9a7b-2ac4c8e61bea
Splunk	The following analytic detects an IP address with 20 or more failed authentication attempts to an Azure AD tenant within 10 minutes. (...)	Generic	stable	authentication	-	Microsoft 365	Credential Access Brute Force Password Guessing Password Spraying	-	medium	Mauricio Velazco, Bhavin Patel, Splunk	2023-01-23	2026-05-13	e5ab41bf-745d-4f72-a393-2611151afd8e
Splunk	The following analytic detects potential distributed password spraying attacks in an Azure AD environment. (...)	Hunting	stable	authentication	-	Microsoft 365	Credential Access Brute Force Password Spraying Credential Stuffing Resource Development Compromise Accounts Cloud Accounts	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	116e11a9-63ea-41eb-a66a-6a13bdc7d2c7
Splunk	The following analytic detects a single source IP failing to authenticate with 30 unique valid users within 5 minutes in Azure Active Directory. (...)	Anomaly	stable	authentication	-	Microsoft 365	Credential Access Brute Force Password Spraying Credential Stuffing Resource Development Compromise Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-11	2026-05-13	94481a6a-8f59-4c86-957f-55a71e3612a6
Splunk	The following analytic detects an Azure AD account successfully authenticating from multiple unique IP addresses within a 30-minute window. (...)	Generic	stable	authentication	-	Microsoft 365	Credential Access Brute Force Password Guessing Password Spraying	-	medium	Mauricio Velazco, Splunk	2023-01-24	2026-05-13	be6d868d-33b6-4aaa-912e-724fb555b11a
Splunk	The following analytic identifies a single source IP failing to authenticate with multiple valid users, potentially indicating a Password Spraying attack against an Azure Active Directory tenant. (...)	Anomaly	stable	authentication	-	Microsoft 365	Credential Access Brute Force Password Spraying Credential Stuffing Resource Development Compromise Accounts Cloud Accounts	-	medium	Mauricio Velazco, Gowthamaraj Rajendran, Splunk	2022-07-11	2026-05-13	3d8d3a36-93b8-42d7-8d91-c5f24cec223d
	Identifies when a key vault is modified or deleted.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	459a2970-bb84-4e6a-a32e-ff0fbd99448d
	Identifies when a Keyvault Key is modified or deleted in Azure.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	80eeab92-0979-4152-942d-96749e11df40
	Identifies when secrets are modified or deleted in Azure.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Credentials In Files	-	medium	Austin Songer @austinsonger	2021-08-16	2022-08-23	b831353c-1971-477b-abb6-2828edc3bca1
	Detects usage of "getcap" binary. (...)	Generic	test	process_creation	linux	Sysmon	Discovery File and Directory Discovery	-	low	Nasreddine Bencherchali (Nextron Systems)	2022-12-28	2026-01-24	d8d97d51-122d-4cdd-9e2f-01b4b4933530
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
Splunk	This analytic detects creation of new user accounts on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Persistence Create Account Local Account Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Local Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	9c8e4f2a-7d3b-4e5c-8a9f-1b6d4e8c3f5a
Splunk	This analytic detects user account lockouts on Cisco ASA devices resulting from excessive failed authentication attempts. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Credential Access Brute Force Password Guessing Password Spraying	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	3e8f9c2a-6d4b-4a7e-9c5f-1b8d7e3a9f2c
	Collect pertinent data from the configuration files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery Account Discovery Local Account Collection Data from Local System Credential Access Unsecured Credentials Credentials In Files	-	low	Austin Clark	2019-08-11	2023-01-04	cd072b25-a418-4f98-8ebc-5093fb38fe1a
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b
Splunk	This analytic detects bursts of ping, SSH, and Telnet commands issued from Cisco IOS or NX-OS devices. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Discovery Network Service Discovery Lateral Movement Remote Services SSH Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	efb20922-17bc-4fb0-880c-be50cfc100dd
	Find local accounts being created or modified as well as remote authentication configurations	Generic	test	authentication	-	Cisco AAA · Cisco	Persistence, Privilege Escalation Account Manipulation Persistence Create Account Local Account	-	high	Austin Clark	2019-08-12	2023-01-04	6d844f0f-1c18-41af-8f19-33e7654edfc3	-
Splunk	The following analytic detects a blocked connection event by identifying a "Block" value in the action field. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	17e9b764-3a2b-4d36-9751-32d13ce4718b
Splunk	The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage Command and Control Ingress Tool Transfer Resource Development Obtain Capabilities Tool Command and Control Proxy External Proxy	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	f7e5e792-d907-46c1-a58e-4ff974dc462a
Splunk	The following analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Reconnaissance Active Scanning Vulnerability Scanning Credential Access Brute Force Execution Exploitation for Client Execution Discovery Network Service Discovery Discovery Remote System Discovery	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	1f57f10e-1dc5-47ea-852c-2e85b2503d79
Splunk	This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Execution Command and Scripting Interpreter PowerShell Initial Access Exploit Public-Facing Application Lateral Movement Exploitation of Remote Services Credential Access OS Credential Dumping LSASS Memory	CVE-2023-27532	medium	Nasreddine Bencherchali, Splunk, Talos NTDR	2025-04-16	2026-05-13	7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
	Detects when the file "passwd" or "shadow" is copied from tmp path	Generic	test	process_creation	linux	Sysmon	Credential Access Unsecured Credentials Credentials In Files	-	high	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-01-31	—	fa4aaed5-4fe0-498d-bbc0-08e3346387ba
Splunk	The following analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS). (...)	Generic	stable	create_remote_thread	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Patrick Bareiss, Splunk	2019-12-11	2026-06-29	67d4dbef-9564-4699-8da8-03a151529edc
	Detects uses of the createdump.exe LOLOBIN utility to dump process memory	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-01-04	2022-08-19	515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
	Sysmon registry detection of a local hidden user account.	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence Create Account Local Account	-	high	Christian Burkard (Nextron Systems)	2021-05-03	2025-10-31	460479f3-80b7-42da-9c43-2cc1d54dbccd
	Detects the creation of a new user account. (...)	Generic	test	process_creation	macos	-	Persistence Create Account Local Account	-	low	Alejandro Ortuno, oscd.community	2020-10-06	2023-02-18	51719bf5-e4fd-4e44-8ba8-b830e7ac0731
	Detects the creation of a new user account. (...)	Generic	test	process_creation	linux	Linux Auditd	Persistence Create Account Local Account	-	medium	Marie Euler, Pawel Mazur	2020-05-18	2022-12-20	759d0d51-bc99-4b5e-9add-8f5b2c8e7512
Splunk	The following analytic detects the creation of an lsass.exe process dump using Windows Task Manager. (...)	Generic	stable	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	medium	Michael Haag, Splunk	2019-12-11	2026-10-02	b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
	Files with well-known filenames (parts of credential dump software or files produced by them) creati (...)	Generic	test	file_event	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory Security Account Manager NTDS LSA Secrets	-	high	Teymur Kheirkhabarov, oscd.community	2019-11-01	2025-10-25	8fbf3271-1ef6-4e94-8210-03c2317947f6
	Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.	Generic	stable	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Bhabesh Raj, Jonhnathan Ribeiro	2023-11-27	2023-11-29	f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9
	Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.	Generic	test	process_access	windows	Sysmon	Credential Access OS Credential Dumping LSASS Memory	-	high	Florian Roth (Nextron Systems)	2022-06-27	2023-11-29	e5b33f7d-eb93-48b6-9851-09e1e610b6d7
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	f0d1feba-4344-4ca9-8121-a6c97bd6df52
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog System	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	4976aa50-8f41-45c6-8b15-ab3fc10e79ed