Netskope Threat Labs

PingCastle

ATP Sandbox Adv. HeuristicsAV

PingCastle is a legitimate Active Directory security audit tool that cyberattackers can abuse for reconnaissance.

First seen
June 2025
Last seen
October 2026
Alert Name
ByteCode-MSIL.Trojan.PingCastle
Generic.Application.PingCastle.A.054AE4C7
Generic.Application.PingCastle.A.069A3B47
Generic.Application.PingCastle.A.18093AB3
Generic.Application.PingCastle.A.35499D4B
Generic.Application.PingCastle.A.39627EAC
Generic.Application.PingCastle.A.4483554F
Generic.Application.PingCastle.A.49E7D877
Generic.Application.PingCastle.A.51EA86E8
Generic.Application.PingCastle.A.58B464E7