Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to

Aquatic Panda has used WinRAR to compress memory dumps prior to exfiltration.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Aquatic Panda has deleted malicious executables from compromised machines.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Aquatic Panda has downloaded additional malware onto compromised hosts.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|

Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.(Citation: CrowdStrike AQUATIC PANDA December 2021)|