Sapphire-Sleet
Active1 briefing · first covered 6/24/2026 · last covered 6/24/2026
Indicators of Compromise
Subscribe to unlock this actor's full IOC list
Free subscribers unlock full IOC lists, Sigma detection rules, remediation steps, and every daily briefing.
Attribution & Known Techniques
Matched to APT38 in MITRE ATT&CK.
56 MITRE ATT&CK techniques for this actor
This is a paid platform feature — not included with a free email subscription. It requires an active team account.
Hunting Queries
Real hunting queries matched to this actor's known MITRE techniques, sourced from FalconForceTeam's FalconFriday project (BSD-3-Clause). Written for Microsoft Defender/Sentinel (Kusto) today — not yet CrowdStrike Falcon or SentinelOne-specific syntax.
15 hunting queries for this actor's techniques
This is a paid platform feature — not included with a free email subscription. It requires an active team account.
Coverage Timeline
Not yet tracked for this actor
- CrowdStrike Falcon / SentinelOne Deep Visibility-specific query syntax — hunting queries above (if any) are Microsoft Defender/Sentinel KQL
- File transfer and exfiltration services used