AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0006 · 24 ATT&CK techniques · 2 correlated reports

APT1

Aliases: APT1, Comment Crew, Comment Group, Comment Panda

[APT1](https://attack.mitre.org/groups/G0006) is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Cover Designator (MUCD) as Unit 61398. (Citation: Mandiant APT1)

Open interactive actor investigation

ATT&CK techniques

T1003.001T1005T1007T1016T1021.001T1036.005T1049T1057T1059.003T1087.001T1114.001T1114.002T1119T1135T1550.002T1560.001T1566.001T1566.002T1583.001T1584.001T1585.002T1588.001T1588.002

Correlated CTI and IR reports

CTI Kill Chain An Analyst Guide With Real World Evidence
1200km Medium · authored report mention Threat Hunting with the Pyramid of Pain
1200km Medium · authored report mention

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research

Attack tools, simulations and detection rules

Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.

Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
pwdump tool reference — Explicit actor uses software relationship in pinned ATT&CK
gsecdump tool reference — Explicit actor uses software relationship in pinned ATT&CK
PsExec tool reference — Explicit actor uses software relationship in pinned ATT&CK
Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
Tasklist tool reference — Explicit actor uses software relationship in pinned ATT&CK
ipconfig tool reference — Explicit actor uses software relationship in pinned ATT&CK
Cachedump tool reference — Explicit actor uses software relationship in pinned ATT&CK
Lslsass tool reference — Explicit actor uses software relationship in pinned ATT&CK
Pass-The-Hash Toolkit tool reference — Explicit actor uses software relationship in pinned ATT&CK
xCmd tool reference — Explicit actor uses software relationship in pinned ATT&CK
T1003.001 LSASS Memory simulation — Exact active technique ID
T1003.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1005 Data from Local System simulation — Exact active technique ID
T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1007 System Service Discovery simulation — Exact active technique ID
T1007 detection rules — Exact active technique ID; not actor-specific detector coverage
T1016 System Network Configuration Discovery simulation — Exact active technique ID
T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
T1049 System Network Connections Discovery simulation — Exact active technique ID
T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
T1057 Process Discovery simulation — Exact active technique ID
T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
T1059.003 Windows Command Shell simulation — Exact active technique ID
T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
T1087.001 Local Account simulation — Exact active technique ID
T1087.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1114.001 Local Email Collection simulation — Exact active technique ID
T1114.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1114.002 Remote Email Collection simulation — Exact active technique ID
T1114.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1119 Automated Collection simulation — Exact active technique ID
T1119 detection rules — Exact active technique ID; not actor-specific detector coverage
T1135 Network Share Discovery simulation — Exact active technique ID
T1135 detection rules — Exact active technique ID; not actor-specific detector coverage
T1550.002 Pass the Hash simulation — Exact active technique ID
T1550.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1560.001 Archive via Utility simulation — Exact active technique ID
T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1566.001 Spearphishing Attachment simulation — Exact active technique ID
T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1566.002 Spearphishing Link simulation — Exact active technique ID
T1566.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1583.001 Domains simulation — Exact active technique ID
T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1584.001 Domains simulation — Exact active technique ID
T1584.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1585.002 Email Accounts simulation — Exact active technique ID
T1585.002 detection rules — Exact active technique ID; not actor-specific detector coverage
T1588.001 Malware simulation — Exact active technique ID
T1588.001 detection rules — Exact active technique ID; not actor-specific detector coverage
T1588.002 Tool simulation — Exact active technique ID
T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.

Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-id Module 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-id Module 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-id Module 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-name Module 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-name Module 7 — Intelligence Products Sharing
Cyber Threat Intelligence (CTI) · explicit-name Module 9 — Tools of the Trade
Cyber Threat Intelligence (CTI) · explicit-name Module 2 — Reconnaissance and attack-surface mapping
Red Team & Offensive Security · explicit-name Module 6 — Active Directory and identity attack paths
Red Team & Offensive Security · explicit-name Module 13 — Red-team infrastructure and operations
Red Team & Offensive Security · explicit-name Network behavior, protocols, and configuration recovery
Malware Analysis & Reverse Engineering · explicit-name Shared responsibility, governance, and service ownership
Cloud Security · explicit-name