メニュー
Adversary-emulation profile for Mustang Panda (G0129 / Bronze President / Stately Taurus / RedDelta / TA416 / TEMP.Hex), a China-based state-sponsored cyber-espionage actor operating since at least 2012.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/PurpleAILAB/Decepticon --skill mustang-panda-bronze-presidentコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
7-question gate run before promoting a finding to FINDING + opening a report. Kills weak/non-impactful findings before they reach the report stage and damage validity ratio.
Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.
Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
SOC 職業分類に基づく
SKILL.md を表示中
| name | mustang-panda-bronze-president |
| description | Adversary-emulation profile for Mustang Panda (G0129 / Bronze President / Stately Taurus / RedDelta / TA416 / TEMP.Hex), a China-based state-sponsored cyber-espionage actor operating since at least 2012. |
| allowed-tools | Bash Read Write |
| metadata | {"subdomain":"adversary-emulation","when_to_use":"Mustang Panda, Bronze President, Stately Taurus, RedDelta, TA416, TEMP.Hex, Earth Preta, Camaro Dragon, HIVE0154, Twill Typhoon, G0129, Chinese espionage emulation, PlugX / Korplug RAT, TONESHELL loader, DLL side-loading, USB worm propagation, spearphishing with themed lures, SE Asian government targeting, EU diplomatic targeting, Vatican targeting","tags":"mustang-panda, bronze-president, stately-taurus, reddelta, ta416, temp-hex, earth-preta, camaro-dragon, china, espionage, nation-state, g0129, adversary-emulation, mitre-attack","mitre_attack":"T1087.002, T1583.001, T1583.006, T1557, T1071.001, T1560.001, T1560.003, T1119, T1547.001, T1059, T1059.001, T1059.003, T1059.005, T1059.007, T1586.002, T1001.003, T1074.001, T1622, T1678, T1140, T1587.001, T1573.001, T1585.002, T1546.003, T1480, T1048.003, T1041, T1052.001, T1567.002, T1203, T1083, T1564.001, T1574.001, T1574.005, T1070, T1070.004, T1070.006, T1105, T1654, T1036.004, T1036.005, T1036.007, T1036.008, T1106, T1046, T1095, T1027, T1027.007, T1027.012, T1027.013, T1027.016, T1588.002, T1588.003, T1588.004, T1003, T1003.001, T1003.003, T1003.006, T1069.002, T1566.001, T1566.002, T1598.003, T1057, T1572, T1090, T1219.001, T1219.002, T1018, T1091, T1053.005, T1593, T1505.003, T1129, T1072, T1518, T1176.002, T1608, T1608.001, T1553.002, T1218.004, T1218.005, T1218.007, T1218.014, T1082, T1016, T1049, T1205, T1204.001, T1204.002, T1102, T1047"} |
Mustang Panda (MITRE ATT&CK G0129) is a China-based cyber-espionage threat actor conducting operations since at least 2012. Tracked under a dozen aliases — Bronze President (Secureworks), Stately Taurus / FIREANT (Unit 42), RedDelta (Recorded Future), TA416 (Proofpoint), Earth Preta (Trend Micro), HIVE0154 (IBM X-Force), Camaro Dragon (Check Point), Twill Typhoon / TANTALUM (Microsoft), LUMINOUS MOTH, UNC6384 / TEMP.Hex (Mandiant/Google TAG), Red Lich (PwC), and ClumsyToad (Cloudflare) — the group is best known for its prolific use of PlugX/Korplug RAT variants delivered through DLL side-loading, themed spearphishing lures, and USB-based propagation. Mustang Panda targets government, diplomatic, military, NGO, think-tank, and religious entities across Southeast Asia, Europe, and beyond, with sustained focus on Myanmar, Vietnam, the Philippines, Cambodia, Taiwan, Japan, Mongolia, and — since 2022 — European diplomatic bodies and Russia-related targets.
RECYCLE.BIN folders on removable media — critical for air-gapped network access.cmd.exe; batch scripts for collection; used cmd.exe /c ping.exe 8.8.8.8 -n 70&& delay-execution chains.autorun.vbs persistence scripts.wscript.exe.LoadLibrary to dynamically load DLLs.HKLM\...\Run\AdobelmdyU, HKCU\...\Run) with legitimate-sounding names (e.g., OneNote Update) pointing to executables that side-load malicious DLLs.inkform.exe, ExcelRepairToolboxLauncher.exe) to side-load malicious DLLs — the defining delivery mechanism for PlugX, TONESHELL, PUBLOAD, and other payloads.IRSetup.exe) to drop and execute payloads.OneNote Update).adobeupdate.dat, PotPlayerDB.dat, OneDrive.exe, AdobePlugins.exe.CheckRemoteDebuggerPresent API and exits if debugger detected.ping 8.8.8.8 -n 70 echo requests before executing legitimate executables.InstallUtil.exe to execute malicious Cobalt Strike Beacon stager.mshta.exe to launch collection scripts.RECYCLE.BIN folders on USB drives; modified file attributes to hidden and system.17 03 03 or 46 77 4d); only executes in memory when response packets match.vssadmin to create volume shadow copies and retrieve NTDS.dit; used reg save on SYSTEM hive to extract NTDS.tasklist /v; TONESHELL checks process name and path for environment validation.systeminfo; captured OS type via User-Agent analysis.ipconfig, arp, and SharpNBTScan.netstat -ano.InstallUtil.exe and its version.sshd.exe) to execute commands, transfer files, and spread across environments over SMB port 445.code.exe tunnel command with established GitHub accounts for persistent remote access.code.exe tunnel.rar.exe to create password-protected archives; also used TONESHELL, RemCom, and Impacket to execute WinRAR for archival.c:\windows\temp; stored documents in hidden USB folders.cmd.exe; TCP 5000 for administrative C2 node communication.DevTunnel.exe) for tool propagation.curl.| Name | ATT&CK ID | Type | Public/Custom |
|---|---|---|---|
| PlugX / Korplug (incl. Hodur variant) | S0013 | Modular Windows RAT (DLL side-loading, USB worm, keylogging, screen capture) | Custom |
| TONESHELL | S1239 | Multi-variant backdoor/loader with anti-analysis, FakeTLS C2 | Custom |
| PUBLOAD | S1228 | First-stage stager/downloader with environment-keyed execution | Custom |
| HIUPAN | S1230 | USB worm for propagation via removable media | Custom |
| BOOKWORM | S1226 | Modular implant (keylogging, clipboard, FakeTLS C2) | Custom |
| StarProxy | S1227 | Internal network proxy with FakeTLS and DLL side-loading | Custom |
| PAKLOG | S1233 | Keylogger/clipboard monitor | Custom |
| CorKLOG | S1235 | Encrypted keylogger with service persistence | Custom |
| SplatCloak | S1234 | Kernel-mode driver for EDR/AV evasion | Custom |
| SplatDropper | S1232 | Dropper for SplatCloak driver payloads | Custom |
| CLAIMLOADER | S1236 | Loader with COM-based execution and DLL side-loading | Custom |
| CANONSTAGER | S1237 | Stager with thread-local-storage injection | Custom |
| STATICPLUGIN | S1238 | COM-based loader disguised as document files | Custom |
| RCSession | S0662 | Backdoor with UAC bypass and fileless storage | Custom |
| PoisonIvy | S0012 | Legacy Windows RAT (DLL injection, rootkit) | Custom (older) |
| ShadowPad | S0596 | Modular backdoor platform (shared across Chinese APTs) | Custom (shared) |
| ORat | — | Custom RAT with WMI event-subscription persistence | Custom |
| Cobalt Strike | S0154 | Post-exploitation framework / Beacon | Public |
| China Chopper | S0020 | Web shell | Public |
| Mimikatz | S0002 | Credential dumping | Public |
| Impacket | S0357 | Network protocol / lateral-movement toolkit | Public |
| AdFind | S0552 | Active Directory enumeration | Public |
| NBTscan | S0590 | NetBIOS scanner | Public |
| Wevtutil | S0645 | Windows Event Log utility | Built-in |
| TeamViewer | — | Remote desktop software | Public (Commercial) |
Authorized-use caveat: Execute the following ONLY within the documented rules of engagement, target scope, and time window of an authorized engagement. Never deploy USB-propagation worms or kernel-mode drivers outside an explicitly sanctioned, isolated lab.
Map Mustang Panda's signature plays to Decepticon's own capabilities:
inkform.exe, or antivirus agent), (2) a malicious DLL matching the expected side-load name, and (3) an encrypted payload blob (.dat). The signed EXE loads the DLL, which decrypts and executes the payload in memory. Vary the signed EXE across engagements to test detection coverage.RECYCLE.BIN directory on removable media containing the side-loading triad plus an autorun trigger. Test whether endpoint detection catches the worm's USB-based spread and hidden-folder creation.ping -n 70 chains before launching the legitimate side-loading executable. Test mshta.exe and InstallUtil.exe proxy execution paths.OneNote Update, AdobelmdyU) pointing to the side-loading executable. Create scheduled tasks for backup persistence. Where testing WMI depth, set up WMI event subscriptions emulating ORat's consumer-based persistence.vssadmin shadow copies — matching Mustang Panda's documented post-compromise credential-harvesting pattern.code.exe tunnel with a GitHub account for persistent C2-like access. Combine with OpenSSH tunneling over SMB (port 445) for internal pivoting. This novel technique is increasingly common in Mustang Panda's 2023-2024 operations.17 03 03) to non-TLS TCP traffic to emulate TONESHELL/StarProxy's protocol impersonation. Proxy through Cloudflare CDN (T1090) to replicate RedDelta's infrastructure pattern. Use RC4 encryption for the C2 channel.rar.exe using password protection. Exfiltrate over the C2 channel or via curl to Dropbox/Google Drive to replicate the cloud-exfil pattern. Stage in c:\windows\temp before exfil.CheckRemoteDebuggerPresent), dynamic API resolution via hashed function names, junk code insertion, and geofencing/environment-keying guardrails.%TEMP%, %APPDATA%, USB drives); alert on unsigned DLLs loaded by signed executables; deploy application-control/allowlisting (WDAC/AppLocker) to block unapproved DLL loads.mmc.exe) executing MSC files from user-writable paths; strip or quarantine archive attachments (RAR/ZIP) containing executables.RECYCLE.BIN directories on removable drives; alert on attrib.exe +h +s usage; block autorun on removable media.%TEMP%, %APPDATA%, or non-standard paths; hunt for scheduled tasks creating reverse shells or referencing code.exe tunnel; audit WMI event subscriptions.vssadmin create shadow or ntdsutil invocations, and DCSync replication from non-DC accounts; monitor for reg save targeting SAM/SYSTEM/SECURITY hives.code.exe tunnel or DevTunnel.exe execution; block or alert on outbound connections to *.devtunnels.ms and *.vscode.dev; restrict Visual Studio Code installation to authorized developer systems.17 03 03) that fail proper TLS negotiation; monitor for unusual traffic patterns on non-standard ports.curl.exe); restrict cloud-storage application access via CASB; alert on new OAuth app consent grants.rar.exe a -hp); monitor FTP client usage; alert on large data transfers to external IPs from staging directories (c:\windows\temp).FileDelete events; monitor for timestomping patterns; alert on process/file deletion immediately following execution.