AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0038 · 16 ATT&CK techniques · 0 correlated reports

Stealth Falcon

Aliases: Stealth Falcon

[Stealth Falcon](https://attack.mitre.org/groups/G0038) is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. (Citation: Citizen Lab Stealth Falcon May 2016)

Open interactive actor investigation

ATT&CK techniques

T1005T1012T1016T1033T1041T1047T1053.005T1057T1059T1059.001T1071.001T1082T1555T1555.003T1555.004T1573.001

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research

Attack tools, simulations and detection rules

Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.

T1005 Data from Local System simulation — Exact active technique ID
T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1012 Query Registry simulation — Exact active technique ID
T1012 detection rules — Exact active technique ID; not actor-specific detector coverage
T1016 System Network Configuration Discovery simulation — Exact active technique ID
T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
T1033 System Owner/User Discovery simulation — Exact active technique ID
T1033 detection rules — Exact active technique ID; not actor-specific detector coverage
T1041 Exfiltration Over C2 Channel simulation — Exact active technique ID
T1041 detection rules — Exact active technique ID; not actor-specific detector coverage
T1047 Windows Management Instrumentation simulation — Exact active technique ID
T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
T1053.005 Scheduled Task simulation — Exact active technique ID
T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1057 Process Discovery simulation — Exact active technique ID
T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059 Command and Scripting Interpreter simulation — Exact active technique ID
T1059 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.001 PowerShell simulation — Exact active technique ID
T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1071.001 Web Protocols simulation — Exact active technique ID
T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1082 System Information Discovery simulation — Exact active technique ID
T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
T1555 Credentials from Password Stores simulation — Exact active technique ID
T1555 detection rules — Exact active technique ID; not actor-specific detector coverage
T1555.003 Credentials from Web Browsers simulation — Exact active technique ID
T1555.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1555.004 Windows Credential Manager simulation — Exact active technique ID
T1555.004 detection rules — Exact active technique ID; not actor-specific detector coverage
T1573.001 Symmetric Cryptography simulation — Exact active technique ID
T1573.001 detection rules — Exact active technique ID; not actor-specific detector coverage

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.

Module 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-id Module 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-name Module 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-name Controlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-name Windows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-name Module 5 — Threat hunting
Blue Team & Defensive Security · explicit-name Evidence integrity, order of volatility, and chain of custody
Digital Forensics & Incident Response (DFIR) · topic-match Timeline reconstruction, ATT CK mapping, CTI, and confidence
Digital Forensics & Incident Response (DFIR) · topic-match Module 10 — Cloud, containers, Kubernetes, and SaaS defense
Blue Team & Defensive Security · topic-match Module 1 — Mission, authorization, and methodology
Red Team & Offensive Security · topic-match Module 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · topic-match Endpoint live response and volatile acquisition
Digital Forensics & Incident Response (DFIR) · topic-match