APT31 Judgement Panda Activity Detection

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•25

Detects activity associated with the APT31 (ZIRCONIUM) threat group, specifically focusing on credential dumping using ldifde, lateral movement attempts involving copying tools like procdump64.exe, netsess.exe, and 7za.exe to remote shares, and archiving data. This rule is based on observations described in the Crowdstrike 2019 Global Threat Report.