AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0001 · 17 ATT&CK techniques · 0 correlated reports

Axiom

Aliases: Axiom, Group 72

[Axiom](https://attack.mitre.org/groups/G0001) is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between [Axiom](https://attack.mitre.org/groups/G0001) and [Winnti Group](https://attack.mitre.org/groups/G0044) but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015)

Open interactive actor investigation

ATT&CK techniques

T1001.002T1003T1005T1021.001T1078T1189T1190T1203T1546.008T1553T1560T1563.002T1566T1583.002T1583.003T1584.005

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research

Attack tools, simulations and detection rules

Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.

T1001.002 Steganography simulation — Exact active technique ID
T1001.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1003 OS Credential Dumping simulation — Exact active technique ID
T1003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1005 Data from Local System simulation — Exact active technique ID
T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1078 Valid Accounts simulation — Exact active technique ID
T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
T1189 Drive-by Compromise simulation — Exact active technique ID
T1189 detection rules — Exact active technique ID; not actor-specific detector coverage
T1190 Exploit Public-Facing Application simulation — Exact active technique ID
T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
T1203 Exploitation for Client Execution simulation — Exact active technique ID
T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
T1546.008 Accessibility Features simulation — Exact active technique ID
T1546.008 detection rules — Exact active technique ID; not actor-specific detector coverage
T1553 Subvert Trust Controls simulation — Exact active technique ID
T1553 detection rules — Exact active technique ID; not actor-specific detector coverage
T1560 Archive Collected Data simulation — Exact active technique ID
T1560 detection rules — Exact active technique ID; not actor-specific detector coverage
T1563.002 RDP Hijacking simulation — Exact active technique ID
T1563.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1566 Phishing simulation — Exact active technique ID
T1566 detection rules — Exact active technique ID; not actor-specific detector coverage
T1583.002 DNS Server simulation — Exact active technique ID
T1583.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1583.003 Virtual Private Server simulation — Exact active technique ID
T1583.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1584.005 Botnet simulation — Exact active technique ID
T1584.005 detection rules — Exact active technique ID; not actor-specific detector coverage

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.

Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-id Module 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-id Module 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-id Exploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-id Module 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · explicit-name Module 12 — Human-layer and physical testing
Red Team & Offensive Security · explicit-name Malware, phishing, ransomware, and behavior extraction
Digital Forensics & Incident Response (DFIR) · explicit-name Human, workload, pipeline, and emergency identity
Cloud Security · explicit-name Scenario-based cyber risk assessment and treatment
Governance, Risk & Compliance (GRC) · explicit-name Evidence integrity, order of volatility, and chain of custody
Digital Forensics & Incident Response (DFIR) · topic-match Timeline reconstruction, ATT CK mapping, CTI, and confidence
Digital Forensics & Incident Response (DFIR) · topic-match Weakness taxonomy and vulnerability identity
Vulnerability Research & Exploit Development · topic-match