Mustang Panda Dropper Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•31

This rule detects specific command-line parameters and image paths associated with Mustang Panda droppers. It looks for patterns like 'Temp\wtask.exe /create', specific environment variable manipulations ('%windir:~-3,1%%PUBLIC:~-9,1%', '%windir:~-1,1%'), VBScript execution with file paths containing 'C:\Users\' and '.txt', and the execution of 'Temp\winwsh.exe'. These indicators are characteristic of the dropper stage used by the Mustang Panda APT group.