← Back to Actors
Aquatic Panda
Aquatic Panda
[Aquatic Panda](https://attack.mitre.org/groups/G0143) is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, [Aquatic Panda](https://attack.mitre.org/groups/G0143) has primarily targeted entities in the telecommunications, technology, and government sectors.(Citation: CrowdStrike AQUATIC PANDA December 2021)
37
Techniques
37
Covered
0
Gaps
100%
Coverage
Coverage37/37
COVERED (37)
T1003.001LSASS Memory111 det.T1005Data from Local System51 det.T1007System Service Discovery15 det.T1021Remote Services105 det.T1021.001Remote Desktop Protocol54 det.T1021.002SMB/Windows Admin Shares74 det.T1021.004SSH35 det.T1027.010Command Obfuscation38 det.T1033System Owner/User Discovery62 det.T1036.004Masquerade Task or Service7 det.T1036.005Match Legitimate Resource Name or Location45 det.T1047Windows Management Instrumentation88 det.T1059.001PowerShell376 det.T1059.003Windows Command Shell87 det.T1059.004Unix Shell169 det.T1070.001Clear Windows Event Logs16 det.T1070.003Clear Command History15 det.T1070.004File Deletion45 det.T1078.002Domain Accounts28 det.T1082System Information Discovery88 det.T1087Account Discovery56 det.T1105Ingress Tool Transfer191 det.T1112Modify Registry205 det.T1218.011Rundll3276 det.T1518.001Security Software Discovery11 det.T1543.003Windows Service80 det.T1550.002Pass the Hash10 det.T1560.001Archive via Utility27 det.T1562.001Disable or Modify Tools325 det.T1574.001DLL111 det.T1574.006Dynamic Linker Hijacking24 det.T1588.001Malware2 det.T1588.002Tool13 det.T1595.002Vulnerability Scanning13 det.T1654Log Enumeration1 det.T1685Disable or Modify Tools281 det.T1685.005Clear Windows Event Logs12 det.