AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
Strider
Aliases: ProjectSauron, Strider
[Strider](https://attack.mitre.org/groups/G0041) is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda.(Citation: Symantec Strider Blog)(Citation: Kaspersky ProjectSauron Blog)
Open interactive actor investigation
ATT&CK techniques
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- T1090.001 Internal Proxy simulation — Exact active technique ID
- T1090.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1556.002 Password Filter DLL simulation — Exact active technique ID
- T1556.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1564.005 Hidden File System simulation — Exact active technique ID
- T1564.005 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Cyber Threat Intelligence (CTI) · tactic-routeDisassembly, decompilation, and code-led analysis
Malware Analysis & Reverse Engineering · tactic-routeModule 5 — Threat hunting
Blue Team & Defensive Security · tactic-routeModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · tactic-routeControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · tactic-routeWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · tactic-routeModule 5 — Cloud, containers, and Kubernetes
Red Team & Offensive Security · tactic-routeDisk, file-system, and persistence forensics
Digital Forensics & Incident Response (DFIR) · tactic-routeHuman, workload, pipeline, and emergency identity
Cloud Security · tactic-route