Deep Panda uses net.exe to connect to network shares using

Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.(Citation: CrowdStrike Deep Panda Web Shells)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Deep Panda uses the Microsoft

Tasklist utility to list processes running on systems.(Citation: Alperovitch 2014)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

Deep Panda has used regsvr32.exe to execute a server variant of

Derusbi in victim networks.(Citation: RSA Shell Crew)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|The

Deep Panda group is known to utilize WMI for lateral movement.(Citation: Alperovitch 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.005|Indicator Removal from Tools|

Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.(Citation: Symantec Black Vine)|