APT27 - Emissary Panda Activity

calendar Apr 28, 2026 · attack.privilege-escalation attack.persistence attack.execution attack.stealth attack.t1574.001 attack.g0027 detection.emerging-threats  ·
Share on: linkedin copy

Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

Sigma rule (View on GitHub)

 1title: APT27 - Emissary Panda Activity
 2id: 9aa01d62-7667-4d3b-acb8-8cb5103e2014
 3status: test
 4description: Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
 5references:
 6    - https://app.any.run/tasks/579e7587-f09d-4aae-8b07-472833262965
 7    - https://twitter.com/cyb3rops/status/1168863899531132929
 8    - https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/
 9author: Florian Roth (Nextron Systems)
10date: 2018-09-03
11modified: 2023-03-09
12tags:
13    - attack.privilege-escalation
14    - attack.persistence
15    - attack.execution
16    - attack.stealth
17    - attack.t1574.001
18    - attack.g0027
19    - detection.emerging-threats
20logsource:
21    category: process_creation
22    product: windows
23detection:
24    selection_sllauncher:
25        ParentImage|endswith: '\sllauncher.exe'
26        Image|endswith: '\svchost.exe'
27    selection_svchost:
28        ParentImage|contains: '\AppData\Roaming\'
29        Image|endswith: '\svchost.exe'
30        CommandLine|contains: '-k'
31    condition: 1 of selection_*
32falsepositives:
33    - Unlikely
34level: critical

References

Related rules

to-top