AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
menuPass
Aliases: APT10, BRONZE RIVERSIDE, CVNX, Cicada, HOGFISH, POTASSIUM, Red Apollo, Stone Panda, menuPass
[menuPass](https://attack.mitre.org/groups/G0045) is a threat group that has been active since at least 2006. Individual members of [menuPass](https://attack.mitre.org/groups/G0045) are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018) [menuPass](https://attack.mitre.org/groups/G0045) has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.(Citation: Palo Alto menuPass Feb 2017)(Citation: Crowdstrike CrowdCast Oct 2013)(Citation: FireEye Poison Ivy)(Citation: PWC Cloud Hopper April 2017)(Citation: FireEye APT10 April 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)
Open interactive actor investigation
ATT&CK techniques
T1003.002T1003.003T1003.004T1005T1016T1018T1021.001T1021.004T1027.013T1036T1036.003T1036.005T1039T1046T1047T1049T1053.005T1055.012T1056.001T1059.001T1059.003T1070.003T1070.004T1074.001T1074.002T1078T1083T1087.002T1090.002T1105T1106T1119T1140T1190T1199T1204.002T1210T1218.004T1553.002T1560T1560.001T1566.001T1568.001T1574.001T1583.001T1588.002
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Mimikatz tool reference — Explicit actor uses software relationship in pinned ATT&CK
- pwdump tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PsExec tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Ping tool reference — Explicit actor uses software relationship in pinned ATT&CK
- cmd tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Cobalt Strike tool reference — Explicit actor uses software relationship in pinned ATT&CK
- certutil tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PowerSploit tool reference — Explicit actor uses software relationship in pinned ATT&CK
- QuasarRAT tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Impacket tool reference — Explicit actor uses software relationship in pinned ATT&CK
- esentutl tool reference — Explicit actor uses software relationship in pinned ATT&CK
- AdFind tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003.002 Security Account Manager simulation — Exact active technique ID
- T1003.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.003 NTDS simulation — Exact active technique ID
- T1003.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.004 LSA Secrets simulation — Exact active technique ID
- T1003.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1005 Data from Local System simulation — Exact active technique ID
- T1005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1016 System Network Configuration Discovery simulation — Exact active technique ID
- T1016 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.001 Remote Desktop Protocol simulation — Exact active technique ID
- T1021.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.004 SSH simulation — Exact active technique ID
- T1021.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.013 Encrypted/Encoded File simulation — Exact active technique ID
- T1027.013 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036 Masquerading simulation — Exact active technique ID
- T1036 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.003 Rename Legitimate Utilities simulation — Exact active technique ID
- T1036.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.005 Match Legitimate Resource Name or Location simulation — Exact active technique ID
- T1036.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1039 Data from Network Shared Drive simulation — Exact active technique ID
- T1039 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1046 Network Service Discovery simulation — Exact active technique ID
- T1046 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1047 Windows Management Instrumentation simulation — Exact active technique ID
- T1047 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1049 System Network Connections Discovery simulation — Exact active technique ID
- T1049 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1055.012 Process Hollowing simulation — Exact active technique ID
- T1055.012 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1056.001 Keylogging simulation — Exact active technique ID
- T1056.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.003 Windows Command Shell simulation — Exact active technique ID
- T1059.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.003 Clear Command History simulation — Exact active technique ID
- T1070.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.001 Local Data Staging simulation — Exact active technique ID
- T1074.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.002 Remote Data Staging simulation — Exact active technique ID
- T1074.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1083 File and Directory Discovery simulation — Exact active technique ID
- T1083 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.002 External Proxy simulation — Exact active technique ID
- T1090.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1105 Ingress Tool Transfer simulation — Exact active technique ID
- T1105 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1106 Native API simulation — Exact active technique ID
- T1106 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1119 Automated Collection simulation — Exact active technique ID
- T1119 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1140 Deobfuscate/Decode Files or Information simulation — Exact active technique ID
- T1140 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1199 Trusted Relationship simulation — Exact active technique ID
- T1199 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1204.002 Malicious File simulation — Exact active technique ID
- T1204.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1210 Exploitation of Remote Services simulation — Exact active technique ID
- T1210 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.004 InstallUtil simulation — Exact active technique ID
- T1218.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1553.002 Code Signing simulation — Exact active technique ID
- T1553.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560 Archive Collected Data simulation — Exact active technique ID
- T1560 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1560.001 Archive via Utility simulation — Exact active technique ID
- T1560.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1566.001 Spearphishing Attachment simulation — Exact active technique ID
- T1566.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1568.001 Fast Flux DNS simulation — Exact active technique ID
- T1568.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1574.001 DLL simulation — Exact active technique ID
- T1574.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1583.001 Domains simulation — Exact active technique ID
- T1583.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-nameModule 7 — Intelligence Products Sharing
Cyber Threat Intelligence (CTI) · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 11 — Mobile and thick-client security
Red Team & Offensive Security · explicit-nameModule 5 — Analysis Techniques Tradecraft
Cyber Threat Intelligence (CTI) · explicit-nameModule 7 — Intelligence Products Sharing
Cyber Threat Intelligence (CTI) · explicit-name