APT1 has been known to use credential dumping using Mimikatz.2
group
APT1 G0006
- Created
- 31 May 2017
- Last modified
- 31 July 2026
- Aliases
- APT1 · Comment Crew · Comment Group · Comment Panda
APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. [1]
23
Techniques57th pct
8
Tactics48th pct
17
Tools & malwareTop 8%
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference G0006
APT1 used the commands net start and tasklist to get a listing of the services on the system.4
APT1 used the ipconfig /all command to gather network configuration information.5
The APT1 group is known to have used RDP during operations.6
The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.78
Standing G0006
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques2357th pct
57th percentile · 57% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
Tactics848th pct
48th percentile · 52% of 176 ATT&CK groups have more tactics spanned.
Tools & malware17Top 8%
92nd percentile · 92% of 176 ATT&CK groups have this many tools and malware or fewer.
Campaigns089% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique13med38th pct
38th percentile · 62% of 176 ATT&CK groups have more detection rules per technique.
Tests / technique3med
Detection coverage G0006
456 distinct rules cover the 23 techniques recorded for this group. The 483 technique-to-rule mappings resolve to 456 distinct rules, because one rule can cover several techniques. 292 Sigma · 164 Splunk.
20 covered by at least one rule3 with no coverage456 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org