S0192: Pupy

S0192: Pupy describes [Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). (Citation: GitHub Pupy) [Pupy](https://attack.mitre.org/software/S0192) is publicly available on GitHub. (Citation: GitHub Pupy)

Executive priority

S0192: Pupy is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S0192: Pupy by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Linux, Windows, macOS, Android), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S0192: Pupy appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Pupy

Pupy is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. [1] It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). [1] Pupy is publicly available on GitHub. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques41 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1569.002	Service ExecutionSub-technique	Pupy uses PsExec to execute a payload or commands on a remote host.[1]
Enterprise	T1046	Network Service Discovery	Pupy has a built-in module for port scanning.[1]
Enterprise	T1113	Screen Capture	Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.[1]
Enterprise	T1552.001	Credentials In FilesSub-technique	Pupy can use Lazagne for harvesting credentials.[1]
Enterprise	T1105	Ingress Tool Transfer	Pupy can upload and download to/from a victim machine.[1]
Enterprise	T1135	Network Share Discovery	Pupy can list local and remote shared drives and folders over SMB.[1]
Enterprise	T1573.002	Asymmetric CryptographySub-technique	Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.[1]
Enterprise	T1548.002	Bypass User Account ControlSub-technique	Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.[1]
Enterprise	T1059.001	PowerShellSub-technique	Pupy has a module for loading and executing PowerShell scripts.[1]
Enterprise	T1033	System Owner/User Discovery	Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.[1]
Enterprise	T1136.002	Domain AccountSub-technique	Pupy can user PowerView to execute “net user” commands and create domain accounts.[1]
Enterprise	T1041	Exfiltration Over C2 Channel	Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.[1]
Enterprise	T1555.003	Credentials from Web BrowsersSub-technique	Pupy can use Lazagne for harvesting credentials.[1]
Enterprise	T1123	Audio Capture	Pupy can record sound with the microphone.[1]
Enterprise	T1055.001	Dynamic-link Library InjectionSub-technique	Pupy can migrate into another process using reflective DLL injection.[1]
Enterprise	T1016	System Network Configuration Discovery	Pupy has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.[1]
Enterprise	T1114.001	Local Email CollectionSub-technique	Pupy can interact with a victim’s Outlook session and look through folders and emails.[1]
Enterprise	T1543.002	Systemd ServiceSub-technique	Pupy can be used to establish persistence using a systemd service.[1]
Enterprise	T1136.001	Local AccountSub-technique	Pupy can user PowerView to execute “net user” commands and create local system accounts.[1]
Enterprise	T1547.013	XDG Autostart EntriesSub-technique	Pupy can use an XDG Autostart to establish persistence.CitationRed Canary Netwire Linux 2022
Enterprise	T1083	File and Directory Discovery	Pupy can walk through directories and recursively search for strings in files.[1]
Enterprise	T1082	System Information Discovery	Pupy can grab a system’s information including the OS version, architecture, etc.[1]
Enterprise	T1003.001	LSASS MemorySub-technique	Pupy can execute Lazagne as well as Mimikatz using PowerShell.[1]
Enterprise	T1056.001	KeyloggingSub-technique	Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.[1]
Enterprise	T1071.001	Web ProtocolsSub-technique	Pupy can communicate over HTTP for C2.[1]
Enterprise	T1497.001	System ChecksSub-technique	Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.[1]
Enterprise	T1021.001	Remote Desktop ProtocolSub-technique	Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.[1]
Enterprise	T1550.003	Pass the TicketSub-technique	Pupy can also perform pass-the-ticket.[1]
Enterprise	T1557.001	Name Resolution Poisoning and SMB RelaySub-technique	Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.[1]
Enterprise	T1087.001	Local AccountSub-technique	Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.[1]
Enterprise	T1059.006	PythonSub-technique	Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.[1]
Enterprise	T1125	Video Capture	Pupy can access a connected webcam and capture pictures.[1]
Enterprise	T1685.005	Clear Windows Event LogsSub-technique	Pupy has a module to clear event logs with PowerShell.[1]
Enterprise	T1134.001	Token Impersonation/TheftSub-technique	Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.[1]
Enterprise	T1560.001	Archive via UtilitySub-technique	Pupy can compress data with Zip before sending it over C2.[1]
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	Pupy adds itself to the startup folder or adds itself to the Registry key `SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run` for persistence.[1]
Enterprise	T1003.005	Cached Domain CredentialsSub-technique	Pupy can use Lazagne for harvesting credentials.[1]
Enterprise	T1003.004	LSA SecretsSub-technique	Pupy can use Lazagne for harvesting credentials.[1]
Enterprise	T1049	System Network Connections Discovery	Pupy has a built-in utility command for `netstat`, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.[1]
Enterprise	T1555	Credentials from Password Stores	Pupy can use Lazagne for harvesting credentials.[1]
Enterprise	T1057	Process Discovery	Pupy can list the running processes and get the process ID and parent process’s ID.[1]

Associated objects

Groups, software, and campaigns

G0059: Magic Hound

Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]

G0064: APT33

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.[1][2]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.2
Object version: 1.3
Created: Apr 18, 2018, 17:59 UTC (UTC+00:00)
Modified: Sep 28, 2023, 21:08 UTC (UTC+00:00)
Raw hash: 58af2c94658cb895...

Imported snapshots across ATT&CK releases(2)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.3	Sep 28, 2023, 21:08 UTC (UTC+00:00)	Current bundle	`58af2c94658c…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.3	Sep 28, 2023, 21:08 UTC (UTC+00:00)	Older bundle	`58af2c94658c…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
GitHub Pupy
Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
Open source URL
[2]
mitre-attackS0192
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use