Gold Open Source

Explore Packages Vulnerabilities CWEs MCP Servers Scan

Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

Explore Everything
Packages
Gold Certified Packages
Container Images
AI Models
MCP Servers
Agent Skills
Chip Manufacturers

Security Data & Tools

Scan Your Dependencies
Trending Threats
Threat RSS Feeds
CVE Database
Actively Exploited (KEV)
SGZ Zero-Days
CWE Index
MITRE ATT&CK
Malicious Packages
Security Glossary
Supply-Chain Report
Developers (API & Badge)
Chrome Extension
Credits & Data Sources

Products

The Platform
ESSCM
Portal
TPRM
OSM
Cowork
Code / Runner
Guard

Use Cases

Know Your Software
Auto-Fix Vulnerabilities
Asset Discovery
AI Governance
MCP Server Security
Supply Chain Compliance
Zero-Day Discovery
All Use Cases

Company

About
Pricing
Blog
Documentation
Safeguard Academy
Contact
Privacy Policy
Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard

Home/ATT&CK/Software/S0192

MITRE ATT&CK Tool

Pupy (S0192)

ShareX LinkedIn Reddit HN

[Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as a payload in several different ways (Windows exe, Python file, PowerShell oneliner/file, Linux elf, APK, Rubber Ducky, etc.). (Citation: GitHub Pupy) [Pupy](https://attack.mitre.org/software/S0192) is publicly available on GitHub. (Citation: GitHub Pupy)

Platforms: Linux, Windows, macOS, Android

▪Techniques implemented (41)

T1569.002Service Execution T1046Network Service Discovery T1113Screen Capture T1552.001Credentials In Files T1105Ingress Tool Transfer T1135Network Share Discovery T1573.002Asymmetric Cryptography T1548.002Bypass User Account Control T1059.001PowerShell T1033System Owner/User Discovery T1136.002Domain Account T1041Exfiltration Over C2 Channel T1555.003Credentials from Web Browsers T1123Audio Capture T1055.001Dynamic-link Library Injection T1016System Network Configuration Discovery T1114.001Local Email Collection T1543.002Systemd Service T1136.001Local Account T1547.013XDG Autostart Entries T1083File and Directory Discovery T1082System Information Discovery T1003.001LSASS Memory T1056.001Keylogging T1071.001Web Protocols T1497.001System Checks T1021.001Remote Desktop Protocol T1550.003Pass the Ticket T1557.001Name Resolution Poisoning and SMB Relay T1087.001Local Account T1059.006Python T1125Video Capture T1685.005Clear Windows Event Logs T1134.001Token Impersonation/Theft T1560.001Archive via Utility T1547.001Registry Run Keys / Startup Folder T1003.005Cached Domain Credentials T1003.004LSA Secrets T1049System Network Connections Discovery T1555Credentials from Password Stores T1057Process Discovery

▪Used by groups (2)

G0059Magic Hound G0064APT33

S0192on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.