G0028 Threat Group-1314

Threat Group-1314 is an unattributed threat group that has used compromised credentials to log into a victim’s remote access infrastructure. ¹

Associated Group Descriptions

Name	Description
TG-1314	¹

Domain	ID	Name	Use
enterprise	T1059	Command and Scripting Interpreter	-
enterprise	T1059.003	Windows Command Shell	Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.¹
enterprise	T1021	Remote Services	-
enterprise	T1021.002	SMB/Windows Admin Shares	Threat Group-1314 actors mapped network drives using `net use`.¹
enterprise	T1072	Software Deployment Tools	Threat Group-1314 actors used a victim’s endpoint management platform, Altiris, for lateral movement.¹
enterprise	T1078	Valid Accounts	-
enterprise	T1078.002	Domain Accounts	Threat Group-1314 actors used compromised domain credentials for the victim’s endpoint management platform, Altiris, to move laterally.¹

ID	Name	References	Techniques
S0039	Net	¹	Domain Account:Account Discovery Local Account:Account Discovery Local Account:Create Account Domain Account:Create Account Network Share Connection Removal:Indicator Removal Network Share Discovery Password Policy Discovery Local Groups:Permission Groups Discovery Domain Groups:Permission Groups Discovery SMB/Windows Admin Shares:Remote Services Remote System Discovery System Network Connections Discovery System Service Discovery Service Execution:System Services System Time Discovery
S0029	PsExec	¹	Domain Account:Create Account Windows Service:Create or Modify System Process Lateral Tool Transfer SMB/Windows Admin Shares:Remote Services Service Execution:System Services