AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
APT33
Aliases: APT33, Elfin, HOLMIUM, Peach Sandstorm
[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: FireEye APT33 Webinar Sept 2017)
Open interactive actor investigation
ATT&CK techniques
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- ftp tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Pupy tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PowerSploit tool reference — Explicit actor uses software relationship in pinned ATT&CK
- LaZagne tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Ruler tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Empire tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PoshC2 tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003.001 LSASS Memory simulation — Exact active technique ID
- T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.004 LSA Secrets simulation — Exact active technique ID
- T1003.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.005 Cached Domain Credentials simulation — Exact active technique ID
- T1003.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.013 Encrypted/Encoded File simulation — Exact active technique ID
- T1027.013 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1040 Network Sniffing simulation — Exact active technique ID
- T1040 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol simulation — Exact active technique ID
- T1048.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.005 Visual Basic simulation — Exact active technique ID
- T1059.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1068 Exploitation for Privilege Escalation simulation — Exact active technique ID
- T1068 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1071.001 Web Protocols simulation — Exact active technique ID
- T1071.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110.003 Password Spraying simulation — Exact active technique ID
- T1110.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1132.001 Standard Encoding simulation — Exact active technique ID
- T1132.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1203 Exploitation for Client Execution simulation — Exact active technique ID
- T1203 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.001 Malicious Link simulation — Exact active technique ID
- T1204.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1546.003 Windows Management Instrumentation Event Subscription simulation — Exact active technique ID
- T1546.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1547.001 Registry Run Keys / Startup Folder simulation — Exact active technique ID
- T1547.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.001 Credentials In Files simulation — Exact active technique ID
- T1552.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.006 Group Policy Preferences simulation — Exact active technique ID
- T1552.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555 Credentials from Password Stores simulation — Exact active technique ID
- T1555 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.003 Credentials from Web Browsers simulation — Exact active technique ID
- T1555.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.002 Spearphishing Link simulation — Exact active technique ID
- T1566.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1571 Non-Standard Port simulation — Exact active technique ID
- T1571 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1573.001 Symmetric Cryptography simulation — Exact active technique ID
- T1573.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameModule 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-nameModule 10 — Laboratories, tool discipline, and reporting
Red Team & Offensive Security · explicit-name