group

PittyTiger G0011

Created: 31 May 2017
Last modified: 31 July 2026
Alias: PittyTiger

PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.[1][2]

TechniquesBottom 8%

Tactics26th pct

Tools & malware60th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing G0011

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects accounts that are created or deleted by non-approved users.	Placeholder	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'	2022-08-11	2023-12-15	c98184ba-4a27-4e10-b7b7-da48e71f4d25
	Detects when an account was created and deleted in a short period of time.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton	2022-08-11	2022-08-18	6f583da0-3a90-4566-a4ed-83c09fe18bbf
	This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.	Generic	test	authentication	windows	WinEventLog Security	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Florian Roth (Nextron Systems)	2017-02-19	2025-10-17	9eb99343-d336-4020-a3cd-67f3819e68ee
	Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.	Generic	test	-	-	Azure Risk Detection · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	be4d9c86-d702-4030-b52e-c7859110e5e8
	Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. (...)	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-01	—	248649b7-d64f-46f0-9fb2-a52774166fb5
	Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. (...)	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-01	—	55695bc0-c8cf-461f-a379-2535f563c854
Splunk	The following analytic detects updates to the SAML provider in AWS. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	635c26cc-0fd1-4098-8ec9-824bf9544b11
	Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.	Generic	test	-	-	Azure Risk Detection · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	1a41023f-1e70-4026-921a-4d9341a9038e
	Detect when authentications to important application(s) only required single-factor authentication	Placeholder	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	MikeDuddington, '@dudders1'	2022-07-28	2026-05-08	f272fb46-25f2-422c-b667-45837994980f
Splunk	The following analytic identifies access denied error when attempting to invoke AWS Bedrock models. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Lateral Movement Use Alternate Authentication Material Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	c53a8e62-f741-11ee-9f6e-acde48001122
	Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Ivan Saakov	2024-12-19	—	92f84194-8d9a-4ee0-8699-c30bfac59780
	Detects when an user creates or invokes a lambda function.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Austin Songer @austinsonger	2021-10-03	2023-03-24	d914951b-52c8-485f-875e-86abab710c0b
Splunk	The following analytic detects updates to the SAML provider in AWS. (...)	Generic	stable	account_management	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Rod Soto, Splunk	2021-01-26	2026-05-13	2f0604c6-6030-11eb-ae93-0242ac130002
	Identifies when suspicious SAML activity has occurred in AWS. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Privilege Escalation Abuse Elevation Control Mechanism Lateral Movement Use Alternate Authentication Material Application Access Token Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer	2021-09-22	2022-12-18	f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
Splunk	The following analytic detects unusual authentication activity in Azure AD, specifically when a single user account has over 8 authentication attempts using 3+ unique application IDs and 5+ unique user agents within a short period. (...)	Anomaly	stable	authentication	-	Microsoft 365	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	5d8bb1f0-f65a-4b4e-af2e-fcdb88276314
	Indicates user activity that is unusual for the user or consistent with known attack patterns.	Generic	test	-	-	Azure Risk Detection · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-07	—	a2cb56ff-4f46-437a-a0fa-ffa4d1303cba
	Identifies when an user or application modified the federation settings on the domain.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer	2021-09-06	2022-06-08	352a54e1-74ba-4929-9d47-8193d67aba1e
	Identifies when an admission controller is executed in Azure Kubernetes. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Container API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer @austinsonger	2021-11-25	2022-12-18	a61a3c56-4ce2-4351-a079-88ae4cbd2b58
	Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.	Generic	experimental	-	-	Audit · Microsoft 365	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Josh Nickels, Marius Rothenbücher	2025-01-08	—	13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc
	Detects when a user has been elevated to manage all Azure Subscriptions. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Austin Songer @austinsonger	2021-11-26	2026-09-26	ca9bf243-465e-494a-9e54-bf9fc239057d
	Detects when there is a interruption in the authentication process.	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer @austinsonger	2021-11-26	2022-12-18	8366030e-7216-476b-9927-271d79f13cf3
	Detects BGP failures which may be indicative of brute force attacks to manipulate routing	Generic	test	-	-	BGP · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	2023-01-23	56fa3cd6-f8d6-4520-a8c7-607292971886
Splunk	This analytic detects the creation of privileged user accounts on Cisco IOS devices, which could indicate an attacker establishing backdoor access. (...)	Anomaly	stable	configuration_change	-	Cisco IOS · Cisco	Persistence Create Account Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	63e3aff9-45d7-4d41-bcdb-9da561fb4533
Splunk	This analytic detects Cisco IOS-XE WebUI authentication failure and success logs that include local port 21111. (...)	Generic	stable	network_device	-	Cisco IOS · Cisco	Initial Access Exploit Public-Facing Application Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-19	77a1751f-552f-456c-b9ae-cdb66eec3e42
Splunk	The following analytic detects Cisco IOS-XE configuration changes performed by the WebUI WSMA process.	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Initial Access Exploit Public-Facing Application Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali	2026-05-19	2026-09-08	f9686576-a23d-4c4d-bfad-a45499dc448a
	Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels	Generic	test	-	-	LDAP · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	—	50e606bf-04ce-4ca7-9d54-3449494bbd4b
Splunk	This analytic correlates risk events between privileged account creation on Cisco IOS devices and HTTP requests to privileged execution paths such as `/level/15/exec/-/*`. (...)	Correlation	stable	-	-	Cisco	Persistence Create Account Lateral Movement Remote Services SSH Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2026-01-12	2026-05-13	2c9d4f5a-8b6e-4c7f-9d8e-1a2b3c4d5e6f
Splunk	This analytic detects a correlation between privileged account creation on Cisco IOS devices and sub (...)	Correlation	stable	-	-	Cisco	Persistence Create Account Lateral Movement Remote Services SSH Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2026-01-12	2026-05-13	7f8e2b4c-9a3d-4e1f-8c5b-6d7e8f9a0b1c
Splunk	The following analytic detects outbound connections to commonly abused file sharing and pastebin-style hosting domains. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Web Protocols Exfiltration Exfiltration Over Web Service Exfiltration to Cloud Storage Command and Control Ingress Tool Transfer Resource Development Obtain Capabilities Tool Command and Control Proxy External Proxy	-	medium	Nasreddine Bencherchali, Splunk	2025-04-03	2026-05-13	f7e5e792-d907-46c1-a58e-4ff974dc462a
Splunk	This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Command and Control Application Layer Protocol Initial Access Exploit Public-Facing Application Execution Exploitation for Client Execution Credential Access OS Credential Dumping Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Nasreddine Bencherchali, Splunk	2025-04-16	2026-05-13	ec99bb81-c31b-4837-8c7d-1b32aa70b337
Splunk	The following analytic detects cloud API calls executed by user roles that have not previously run these commands. (...)	Anomaly	stable	configuration_change	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	David Dorsey, Splunk	2020-10-27	2026-09-22	2181ad1f-1e73-4d0c-9780-e8880482a08f	-
Splunk	The following analytic detects cloud provisioning activities originating from previously unseen cities. (...)	Anomaly	stable	configuration_change	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Rico Valdez, Bhavin Patel, Splunk	2020-11-30	2026-09-22	e7ecc5e0-88df-48b9-91af-51104c68f02f	-
Splunk	The following analytic detects cloud provisioning activities originating from previously unseen countries. (...)	Anomaly	stable	configuration_change	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Rico Valdez, Bhavin Patel, Splunk	2020-12-01	2026-09-22	94994255-3acf-4213-9b3f-0494df03bb31	-
Splunk	The following analytic detects cloud provisioning activities originating from previously unseen IP addresses. (...)	Anomaly	stable	configuration_change	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Rico Valdez, Splunk	2020-11-30	2026-09-22	f86a8ec9-b042-45eb-92f4-e9ed1d781078	-
Splunk	The following analytic detects cloud provisioning activities originating from previously unseen regions. (...)	Anomaly	stable	configuration_change	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Rico Valdez, Bhavin Patel, Splunk	2020-10-26	2026-09-22	5aba1860-9617-4af9-b19d-aecac16fe4f2	-
Splunk	This detection identifies the creation, deletion, or modification of a local user account on an ESXi host. (...)	Anomaly	stable	-	esxi	VMware ESXi · VMware	Persistence, Privilege Escalation Account Manipulation Persistence Create Account Local Account Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	b5e3b024-a7bb-4019-8975-46cf54485e78
Splunk	This detection identifies instances where the ESXi UI is accessed using the root account instead of a delegated administrative user. (...)	Anomaly	stable	-	esxi	VMware ESXi · VMware	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	218bf991-6c63-4c26-a682-6ac1a53ad8f8	-
Splunk	This detection monitors for signs of a shared or potentially compromised root account on ESXi hosts by tracking the number of unique IP addresses logging in as root within a short time window. (...)	Anomaly	stable	-	esxi	VMware ESXi · VMware	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	1bc8f235-5d7c-457c-95ca-5e92edcb52ea
Splunk	This detection identifies when a user is granted the Administrator role on an ESXi host. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Persistence, Privilege Escalation Account Manipulation Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	b0c64d6e-cfdf-441a-b6ce-d956e202563e	-
	Detects successful logon from public IP address via RDP. (...)	Generic	test	authentication	windows	WinEventLog Security	Credential Access Brute Force Initial Access, Persistence External Remote Services Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)	2023-01-19	2024-03-11	259a9cdf-c4dd-4fa2-b243-2269e5ab18a2
	Detects successful logon from public IP address via SMB. (...)	Generic	test	authentication	windows	WinEventLog Security	Credential Access Brute Force Initial Access, Persistence External Remote Services Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)	2023-01-19	2024-03-11	78d5cab4-557e-454f-9fb9-a222bd0d5edc
	Detects suspicious failed logins with different user accounts from a single source system	Unsupported	unsupported	-	windows	WinEventLog Security	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Florian Roth (Nextron Systems)	2017-01-10	2023-02-24	e98374a6-e2d9-4076-9b5c-11bdb2569995	-
	Detects a failed logon attempt from a public IP. (...)	Generic	test	authentication	windows	WinEventLog Security	Initial Access Exploit Public-Facing Application Initial Access, Persistence External Remote Services Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	NVISO	2020-05-06	2024-03-11	f88e112a-21aa-44bd-9b01-6ee2a2bbbed1
	Detects suspicious failed logins with different user accounts from a single source system	Unsupported	unsupported	authentication	windows	WinEventLog Security	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Florian Roth (Nextron Systems)	2017-01-10	2023-02-24	6309ffc4-8fa2-47cf-96b8-a2f72e58e538	-
Splunk	The following analytic identifies the use of the GCPloit exploitation framework within Google Cloud Platform (GCP). (...)	Generic	experimental	cloud_audit	-	Google Cloud	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Rod Soto, Splunk	2020-10-08	2026-05-13	a1c5a85e-a162-410c-a5d9-99ff639e5a52
Splunk	Geolocation data can be inaccurate or easily spoofed by Remote Employment Fraud (REF) workers. (...)	Anomaly	experimental	authentication	-	Okta	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Marissa Bower, Raven Tait	2025-06-12	2026-05-13	64f91df1-49ec-46aa-81bd-2282d3cea765	-
	Identifies when an admission controller is executed in GCP Kubernetes. (...)	Generic	test	cloud_audit	-	GCP Audit · Google Cloud	Credential Access Unsecured Credentials Container API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer @austinsonger	2021-11-25	2022-12-18	6ad91e31-53df-4826-bd27-0166171c8040
	Detects a login attempt in Google Workspace flagged as a potential attack by a government-backed thr (...)	Generic	experimental	-	-	Google Workspace Login · Google Cloud	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Tom Kluter	2026-04-28	—	eafe6f2b-cfec-4612-aec2-49563c33a087
	Detects attempts to enable the guest account using the sysadminctl utility	Generic	test	process_creation	macos	-	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Default Accounts	-	low	Sohan G (D4rkCiph3r)	2023-02-18	—	d7329412-13bd-44ba-a072-3387f804a106
	Detects guest users being invited to tenant by non-approved inviters	Placeholder	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	MikeDuddington, '@dudders1'	2022-07-28	2026-05-09	4ad97bf5-a514-41a4-abd3-4f3455ad4865

Title

Description

PittyTiger G0011

PittyTiger G0011

PittyTiger MITRE reference G0011

Standing G0011

Reach

Coverage

PittyTiger detections G0011