UAT-8837 China-Nexus APT - Multi-Stage Attack Chain
This rule detects a multi-stage attack chain associated with UAT-8837, a China-nexus APT group. It correlates several distinct activities: initial reconnaissance (pinging google.com, system enumeration via tasklist, netstat, whoami, quser, hostname, net user), modification of RDP RestrictedAdmin settings, Earthworm tunneling to public IP addresses on specific ports (1433, 443, 447, 448, 80), the use of Active Directory enumeration tools (SharpHound, Certipy, dsquery, dsget, setspn), deployment of post-compromise tools in staging directories (Desktop, Temp, public\music, Users\public\videos, Users\public\Music) often masquerading with .ico extensions, and the creation of backdoored user accounts or localgroup additions. The rule requires either Earthworm tunneling, a combination of AD reconnaissance and post-compromise tool deployment, or at least two distinct stages from initial reconnaissance, RDP modification, AD reconnaissance, post-compromise tools, and backdoored accounts to trigger a detection. This correlation aims to reduce false positives and identify advanced persistent threat activity.
Sigma
