Threat Group-1314

Threat Group-1314 is a tracked threat actor referenced in ATT&CK-style mappings and Splunk analytic annotations as using Windows command execution, SMB-based lateral movement, domain account abuse, permission group discovery, account discovery, network share discovery, inter-process communication, and process injection. The provided content specifically states that Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands and used compromised domain credentials for the victim's Altiris endpoint management platform to move laterally. Techniques explicitly associated with the group in the content include T1059.003 (Windows Command Shell), T1021.002 (SMB/Windows Admin Shares), T1078.002 (Domain Accounts), T1069 (Permission Groups Discovery), T1087 (Account Discovery), T1135 (Network Share Discovery), T1559 (Inter-Process Communication), and T1055 (Process Injection). The group is also referenced in detections and hunting content related to suspicious named pipes, SMB activity, PowerView AD ACL enumeration, suspicious Kerberos TGT requests, potentially unwanted application named pipes, unusual Windows theme file creation, and Microsoft Intune administrative activity. Known aliases in the provided content are tg_1314 and threat_group_1314.