APT1
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- APT1Our name
- Comment PandaCrowdStrike
- Comment CrewMandiant
- Comment GroupMandiant
Known techniques
- T1003.001LSASS Memory
- T1005Data from Local System
- T1007System Service Discovery
- T1016System Network Configuration Discovery
- T1021.001Remote Desktop Protocol
- T1036.005Match Legitimate Resource Name or Location
- T1049System Network Connections Discovery
- T1057Process Discovery
- T1059.003Windows Command Shell
- T1087.001Local Account
- T1114.001Local Email Collection
- T1114.002Remote Email Collection
- T1119Automated Collection
- T1135Network Share Discovery
- T1550.002Pass the Hash
- T1560.001Archive via Utility
- T1566.001Spearphishing Attachment
- T1566.002Spearphishing Link
- T1583.001Domains
- T1584.001Domains
- T1585.002Email Accounts
- T1588.001Malware
- T1588.002Tool
Malware and tools used
BISCUITCachedumpCALENDARGLOOXMAILgsecdumpipconfigLslsassMimikatzNetPass-The-Hash ToolkitPoisonIvyPsExecpwdumpSeasaltTasklistWEBC2xCmd
Source: MITRE ATT&CKRecent news
No stories yet.