Sigma rule: Mustang Panda Dropper

Rule

Title

Mustang Panda Dropper

Status

test

Level

high

Author

Florian Roth (Nextron Systems), oscd.community

Date

2019-10-30

Modified

2021-11-27

File

rules-emerging-threats/2019/TA/MustangPanda/proc_creation_win_apt_mustangpanda.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects specific process parameters as used by Mustang Panda droppers

Log source

product

windows

category

process_creation

Detection

selection_cli:
    - CommandLine|contains:
          - 'Temp\wtask.exe /create'
          - '%windir:~-3,1%%PUBLIC:~-9,1%'
          - '/tn "Security Script '
          - '%windir:~-1,1%'
    - CommandLine|contains|all:
          - '/E:vbscript'
          - 'C:\Users\'
          - '.txt'
          - '/F'
selection_img:
    Image|endswith: 'Temp\winwsh.exe'
condition: 1 of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.t1587.001
• attack.resource-development
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1587.001

References

• https://app.any.run/tasks/7ca5661d-a67b-43ec-98c1-dd7a8103c256/
• https://app.any.run/tasks/b12cccf3-1c22-4e28-9d3e-c7a6062f3914/
• https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2019/TA/MustangPanda/proc_creation_win_apt_mustangpanda.yml