Procedure examples

Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.

Aquatic Panda captured local Windows security event log data from victim machines using the wevtutil utility to extract contents to an evtx output file.

Aquatic Panda has attempted to discover services for third party EDR products.

Aquatic Panda used remote scheduled tasks to install malicious software on victim systems during lateral movement actions.

Aquatic Panda leveraged stolen credentials to move laterally via RDP in victim environments.

Aquatic Panda used remote shares to enable lateral movement in victim environments.

Aquatic Panda used SSH with captured user credentials to move laterally in victim environments.

Aquatic Panda has encoded PowerShell commands in Base64.

Aquatic Panda gathers information on recently logged-in users on victim devices.

Aquatic Panda created new, malicious services using names such as Windows User Service to attempt to blend in with legitimate items on victim systems.

Aquatic Panda renamed or moved malicious binaries to legitimate locations to evade defenses and blend into victim environments.

Aquatic Panda used WMI for lateral movement in victim environments.

Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.

Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to cmd /C.

Aquatic Panda used malicious shell scripts in Linux environments following access via SSH to install Linux versions of Winnti malware.

Aquatic Panda cleared command history in Linux environments to remove traces of activity after operations.

Aquatic Panda has deleted malicious executables from compromised machines.

Aquatic Panda used multiple mechanisms to capture valid user accounts for victim domains to enable lateral movement and access to additional hosts in victim environments.

Aquatic Panda has used native OS commands to understand privilege levels and system details.

Aquatic Panda used the last command in Linux environments to identify recently logged-in users on victim machines.

Aquatic Panda has downloaded additional malware onto compromised hosts.

Aquatic Panda modified the victim registry to enable the `RestrictedAdmin` mode feature, allowing for pass the hash behaviors to function via RDP.

Aquatic Panda used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary.

Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.

Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.

Aquatic Panda used a registry edit to enable a Windows feature called RestrictedAdmin in victim environments. This change allowed Aquatic Panda to leverage "pass the hash" mechanisms as the alteration allows for RDP connections with a valid account name and hash only, without possessing a cleartext password value.

Aquatic Panda has used several publicly available tools, including WinRAR and 7zip, to compress collected files and memory dumps prior to exfiltration.

Aquatic Panda has used DLL search-order hijacking to load `exe`, `dll`, and `dat` files into memory. Aquatic Panda loaded a malicious DLL into the legitimate Windows Security Health Service executable (SecurityHealthService.exe) to execute malicious code on victim systems.

Aquatic Panda modified the ld.so preload file in Linux environments to enable persistence for Winnti malware.

Aquatic Panda has acquired and used njRAT in its operations.

Aquatic Panda has acquired and used Cobalt Strike in its operations.

Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).

Aquatic Panda enumerated logs related to authentication in Linux environments prior to deleting selective entries for defense evasion purposes.

Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.

Aquatic Panda clears Windows Event Logs following activity to evade defenses.