071. Squid Werewolf (APT37): Detection Opportunities

Hello everyone! I hope you checked this report on APT37 (we track this activity cluster as Squid Werewolf) already. As always, let's look at detection opporrunities!

The adversary leveraged a malicious LNK file to execute PowerShell with "-nop" argument, of course, we can use it for detection\hunting:

proc_p_file_path: "explorer.exe" 

AND 

proc_file_name: "powershell.exe" 

AND 

cmdline: "nop" 

Also, the threat actors abuse dfsvc.exe, and use renamed executable to run the malicious code. For example, we can search for renamed files:

event_type: "processcreatewin" 

AND 

proc_file_originalfilename: "dfsvc.exe" 

AND NOT 

proc_file_name: "dfsvc.exe"

One more opportunity - abusing timeapi[.]io to check Internet connection:

event_type: "dnsreq" 

AND 

dns_rname: "timeapi.io"

Which detection and hunting opportunities have you spotted?

See you tomorrow!