Mustang Panda MINIRECON File and System Reconnaissance via Sideloaded DLL

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the MINIRECON implant performing reconnaissance activities, including sensitive directory listing and system information gathering. The rule monitors specific sideloaded process names such as 'pcl2bmp.exe' or 'Project Proposal.exe' as they execute discovery commands like 'dir /s', 'systeminfo', 'ipconfig', and 'whoami'.