Mustang Panda MINIRECON Host Reconnaissance and File Discovery

Ibrahim Saud@tektrix

•updated Jun 30, 2026•9•0•7

Detects host reconnaissance and file discovery activities indicative of the MINIRECON implant, a tool linked to Mustang Panda campaigns. The rule monitors for the execution of common system enumeration and file searching commands triggered by the 'pct12bmp.exe' process, or in unauthorized contexts.