Actor2017

Dragonfly

1Rules

1References

1Folders

2023-05-02Latest

Summary

Dragonfly is tracked here as a threat actor, intrusion set, or campaign with 1 Sigma detection spanning 2017. Coverage centers on windows / process_creation.

Related Detections

Search this threat

Emerging Threathightest

Ps.exe Renamed SysInternals Tool

Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report

WindowsProcess Creation

TA0005 · StealthG0035 · DragonflyT1036.003 · Rename Legitimate Utilities2013-05-009 · CAR 2013-05-009+1

Florian Roth (Nextron Systems)Sun Oct 222017

References

Resolving title…

us-cert.gov