group

Putter Panda G0024

Created: 31 May 2017
Last modified: 31 July 2026
Aliases: Putter Panda · APT2 · MSUpdater

Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD). [1]

TechniquesBottom 13%

TacticsBottom 20%

Tools & malware55th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing G0024

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic detects the use of commands to add or set exclusions in Windows Defender. It (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Nasreddine Bencherchali, Splunk	2021-11-25	2026-06-08	773b66fe-4dd9-11ec-8289-acde48001122
	Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-09-02	2024-03-19	d7662ff6-9e97-4596-a61d-9839e32dee8d
	Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts	Generic	test	ps_script	windows	PowerShell	Defense Impairment Disable or Modify Tools	-	high	Florian Roth (Nextron Systems)	2022-11-09	—	e0d6c087-2d1c-47fd-8799-3904103c5a98
	Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. (...)	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2025-12-25	—	aa37cbb0-da36-42cb-a90f-fdf216fc7467
	Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a "Dev Drive".	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	high	@kostastsale, Nasreddine Bencherchali (Nextron Systems)	2023-11-05	2024-08-16	31e124fb-5dc4-42a0-83b3-44a69c77b271
	Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use (...)	Generic	experimental	process_creation	linux	Linux Auditd	Defense Impairment Disable or Modify Tools Privilege Escalation, Stealth Process Injection Proc Memory	-	high	Milad Cheraghi	2025-05-26	2025-12-05	e497a24e-9345-4a62-9803-b06d7d7cb132
	Detect changes in auditd configuration files	Generic	test	file_event	linux	Linux Auditd	Defense Impairment Disable or Modify Tools	-	high	Mikhail Larin, oscd.community	2019-10-25	2021-11-27	977ef627-4539-4875-adf4-ed8f780c4922
	Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	59b70e4d-dd17-44a9-b740-acf07ae3eb6a
	Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety c (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Marco Pedrinazzi (@pedrinazziM) (InTheCyber)	2026-07-10	—	1c722651-254a-4b04-a9f4-99b62a2d0a1f
	Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools Disable or Modify Cloud Log	-	high	suktech24	2025-11-27	—	d2656e78-c069-4571-8220-9e0ab5913f19
	Detects updates of the GuardDuty list of trusted IPs, perhaps to disable security alerts against malicious IPs.	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	faloker	2020-02-11	2022-10-09	6e61ee20-ce00-4f8d-8aee-bedd8216f7e3
	Detects evade to Macie detection.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	medium	Sittikorn S	2021-07-06	2023-03-24	91f6a16c-ef71-437a-99ac-0b070e3ad221
	Detects the modification of the findings on SecurityHub.	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Defense Impairment Disable or Modify Tools	-	high	Sittikorn S	2021-06-28	—	a607e1fe-74bf-4440-a3ec-b059b9103157
Splunk	The following analytic detects when the risk-based step-up consent security setting in Azure AD is disabled. (...)	Generic	stable	account_management	-	Microsoft 365	Defense Impairment Disable or Modify Tools	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	875de3d7-09bc-4916-8c0a-0929f4ced3d8
	Detects when Events are deleted in Azure Kubernetes. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Defense Impairment Disable or Modify Tools	-	medium	Austin Songer @austinsonger	2021-07-24	2022-08-23	225d8b09-e714-479c-a0e4-55e6f29adf35
	Detects changes to the bitbucket audit log configuration.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	6aa12161-235a-4dfb-9c74-fe08df8d8da1
	Detects Bitbucket global secret scanning rule deletion activity.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05
	Detects Bitbucket global SSH access configuration changes.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools Lateral Movement Remote Services SSH	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	16ab6143-510a-44e2-a615-bdb80b8317fc
	Detects when a secret scanning allowlist rule is added for projects.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	low	Muhammad Faisal (@faisalusuf)	2024-02-25	—	42ccce6d-7bd3-4930-95cd-e4d83fa94a30
	Detects when a repository is exempted from secret scanning feature.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	high	Muhammad Faisal (@faisalusuf)	2024-02-25	—	b91e8d5e-0033-44fe-973f-b730316f23a1
	Detects when secret scanning rule is deleted for the project or repository.	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Defense Impairment Disable or Modify Tools	-	low	Muhammad Faisal (@faisalusuf)	2024-02-25	—	ff91e3f0-ad15-459f-9a85-1556390c138d
Splunk	Adversaries may intentionally suppress or reduce the volume of core Cisco ASA syslog messages to evade detection or cover their tracks. (...)	Hunting	stable	firewall	-	Cisco Secure Firewall · Cisco	Defense Impairment Disable or Modify Tools	CVE-2025-20362 CVE-2025-20333	medium	Bhavin Patel, Micheal Haag, Splunk	2025-09-25	2026-05-13	4b4f8fdd-1f9e-45d8-9b0f-1f64c0b297a4
Splunk	This analytic detects the disabling of logging functionality on a Cisco ASA device through CLI comma (...)	Generic	stable	firewall	-	Cisco Secure Firewall · Cisco	Defense Impairment Disable or Modify Tools	-	medium	Bhavin Patel, Micheal Haag, Nasreddine Bencherchali, Splunk	2025-09-25	2026-05-13	7b4c9f3e-5a88-4b7b-9c4b-94d8e5d67201
Splunk	This analytic detects tampering with logging filter configurations on Cisco ASA devices via CLI or ASDM. (...)	Anomaly	stable	firewall	-	Cisco Secure Firewall · Cisco	Defense Impairment Disable or Modify Tools	-	medium	Nasreddine Bencherchali, Splunk	2025-11-21	2026-05-13	b87b48a8-6d1a-4280-9cf1-16a950dbf901
Splunk	This analytic provides comprehensive monitoring of configuration changes on Cisco devices by analyzing archive logs. (...)	Hunting	stable	configuration_change	-	Cisco IOS · Cisco	Persistence, Privilege Escalation Account Manipulation Defense Impairment Disable or Modify Tools Persistence Server Software Component Web Shell	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	f52d5c0b-d45d-4304-b300-a4f6a1130dec
	Turn off logging locally or remote	Generic	test	authentication	-	Cisco AAA · Cisco	Defense Impairment Disable or Modify Tools	-	high	Austin Clark	2019-08-11	2023-01-04	9e8f6035-88bf-4a63-96b6-b17c0508257e
	Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. (...)	Generic	experimental	authentication	-	Cisco AAA · Cisco	Defense Impairment Disable or Modify Tools Persistence, Defense Impairment, Credential Access Modify Authentication Process Network Device Authentication	-	medium	Luc Génaux	2026-04-28	—	ef0ff092-a24a-4fbc-beea-06c08d53e085
Splunk	This analytic detects Cisco IOS-XE command sequences where show logging, clear logging, and exit occur within a short period. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Defense Impairment Disable or Modify Tools Clear Windows Event Logs	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	e20a6709-5f2c-4508-83fb-b3af6f705717
Splunk	This analytic detects rapid modification of Cisco IOS-XE VTY access-class settings. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Defense Impairment Disable or Modify Tools Lateral Movement Remote Services	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	a01ca274-16cb-476d-a814-d2ffe29d8905
Splunk	This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. (...)	Anomaly	stable	configuration_change	-	Cisco IOS · Cisco	Defense Impairment Disable or Modify Tools Credential Access, Discovery Network Sniffing Credential Access Unsecured Credentials	CVE-2018-0171	medium	Bhavin Patel, Michael Haag, Splunk	2025-08-21	2026-05-13	b0ce5521-2533-4f24-b8d5-c2ff977aae08
	Detects modification of Windows Registry Classes keys used for persistence. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	9df5f547-c86a-433e-b533-f2794357e242
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)	2019-10-25	2025-10-22	f59c3faf-50f3-464b-9f4c-1b67ab512d99
	Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a proces (...)	Hunting	test	create_remote_thread	windows	Sysmon	Privilege Escalation, Stealth Process Injection Dynamic-link Library Injection	-	medium	Roberto Rodriguez @Cyb3rWard0g	2019-08-11	2024-01-22	052ec6f6-1adc-41e6-907a-f1c813478bee
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	f674e36a-4b91-431e-8aef-f8a96c2aca35
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	cbf93e5d-ca6c-4722-8bea-e9119007c248
	Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Defense Impairment Disable or Modify Tools	-	high	Matt Anderson, Dray Agha, Anna Pham (Huntress)	2026-01-02	—	85f520e7-6f5e-43ca-874c-222e5bf9c0de
	Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during (...)	Emerging	test	registry_event	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	CVE-2023-42793	high	Nasreddine Bencherchali (Nextron Systems)	2023-10-24	—	9f9f92ba-5300-43a4-b435-87d1ee571688
	Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)	2019-10-25	2026-01-05	24357373-078f-44ed-9ac4-6d334a668a11
Splunk	The following analytic detects modifications to the Windows registry that disable the Antimalware Scan Interface (AMSI) by setting the "AmsiEnable" value to "0x00000000". (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-06-23	2026-05-13	9c27ec42-d338-11eb-9044-acde48001122
Splunk	The following analytic detects the modification of Windows Defender registry settings to disable antivirus and antispyware protections. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-18	2026-06-08	aa4f695a-3024-11ec-9987-acde48001122
Splunk	The following analytic detects the modification of the Windows registry to disable the Windows Defender BlockAtFirstSeen feature. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-18	2026-05-13	2dd719ac-3021-11ec-97b4-acde48001122
Splunk	The following analytic detects the modification of the registry to disable Windows Defender's Enhanced Notification feature. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-18	2026-05-13	dc65678c-301f-11ec-8e30-acde48001122
Splunk	The following analytic detects the modification of the Windows Defender MpEngine registry value, specifically setting MpEnablePus to 0x00000000. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-18	2026-05-13	cc391750-3024-11ec-955a-acde48001122
Splunk	The following analytic detects the modification of the registry to disable Windows Defender SpyNet reporting. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-18	2026-05-13	898debf4-3021-11ec-ba7c-acde48001122
Splunk	The following analytic detects the modification of the Windows registry to disable the Windows Defender Submit Samples Consent feature. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-10-18	2026-06-08	73922ff8-3022-11ec-bf5e-acde48001122
Splunk	The following analytic detects modifications to the registry that disable the Event Tracing for Windows (ETW) feature. (...)	Generic	stable	registry_event	windows	Sysmon	Defense Impairment Disable or Modify Tools	-	medium	Teoderick Contreras, Splunk, Steven Dick	2021-06-23	2026-10-02	f0eacfa4-d33f-11eb-8f9d-acde48001122
	Detects disabling Windows Defender Exploit Guard Network Protection	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools	-	medium	Austin Songer @austinsonger	2021-08-04	2023-08-17	bf9e1387-b040-4393-9851-1598f8ecfae9
	Detects usage of powershell cmdlets to disable or remove ETW trace sessions	Generic	test	ps_script	windows	PowerShell	Defense Impairment Disable or Modify Tools Stealth Indicator Removal	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-28	2026-10-12	115fdba9-f017-42e6-84cf-d5573bf2ddf8
	Detects the usage of utilities such as 'systemctl', 'service'...etc to stop or disable tools and services on Linux systems. (...)	Generic	test	process_creation	linux	Sysmon	Defense Impairment Disable or Modify Tools Impact Service Stop	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-15	2025-03-18	de25eeb8-3655-4643-ac3a-b662d3f26b6b

Title

Description

Putter Panda G0024

Putter Panda MITRE reference G0024

Standing G0024

Reach

Coverage

Putter Panda detections G0024