Mustang Panda

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support foll

An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method. Adversaries may choose to use custom archival

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, enc

Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this techn

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a bi

Adversaries may buy and/or steal code signing certificates that can be used during targeting. Code signing is the process of digitally signing executa

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of intera

Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interfa

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries t

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of

Adversaries may employ various time-based methods to evade detection and analysis. These techniques often exploit system clocks, delays, or timing mec

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They

Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting. SSL/TLS certificates are designed to instill trust. They incl

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in fol

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries dete

Adversaries may acquire domains that can be used during targeting. Domain names are the human readable names used to represent one or more IP addresse

Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type

Adversaries may obfuscate then dynamically resolve API functions called by their malware in order to conceal malicious functionalities and impair defe

Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their op

Adversaries may compromise email accounts that can be used during targeting. Adversaries can use compromised email accounts to further their operation

Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer. These processes may automatically execute specifi

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications chan

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The d

Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, e

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo

Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file s

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files

Adversaries may abuse an integrated development environment (IDE) extension to establish persistent access to victim systems.(Citation: Mnemonic misus

AdFind is a free command-line query tool that can be used for gathering information from Active Directory.(

BOOKWORM is a modular trojan known to be leveraged by [Mustang Panda](https://attack.mitre.org/groups/G0129

CANONSTAGER is a loader known to be leveraged by Mustang Panda and

CLAIMLOADER is a malware variant that frequently accompanies legitimate executables that are used for DLL s

China Chopper is a Web Shell hosted on Web servers to prov

Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation

CorKLOG is a keylogger known to be leveraged by Mustang Panda and

HIUPAN (aka U2DiskWatch) is a is a worm that propagates through removable drives known to be leveraged by [

Impacket is an open source collection of modules written in Python for programmatically constructing and ma

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along

NBTscan is an open source tool that has been used by state groups to conduct internal reconnaissance within

PAKLOG is a keylogger known to be leveraged by Mustang Panda and w

PUBLOAD is a stager malware that has been observed installing itself in existing directories such as `C:\Us

PlugX is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Cita

PoisonIvy is a popular remote access tool (RAT) that has been used by many groups.(Citation: FireEye Poison

RCSession is a backdoor written in C++ that has been in use since at least 2018 by [Mustang Panda](https://

STATICPLUGIN is a downloader known to be leveraged by [Mustang Panda](https://attack.mitre.org/groups/G0129

ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang sof

SplatCloak is a malware that disables EDR-related routines used by Windows Defender and Kaspersky to aid in

SplatDropper is a loader that utilizes native windows API to deliver its payload to the victim environment.

StarProxy is custom malware used by Mustang Panda as a post-compro

TONESHELL is a custom backdoor that has been used since at least Q1 2021.(Citation: Palo Alto Unit42 STATEL

Wevtutil is a Windows command-line utility that enables administrators to retrieve information about event

RedDelta Modified PlugX Infection Chain Operations was executed by [Mustang Panda](https://attack.mitre.or