Shai Hulud: NPM Worm Supply Chain Data Theft
Indicators of Compromise
Campaign Guidance
Remediation, mitigation, notes, history and related intelligence
REMEDIATION
T1195-Supply Chain Compromise
ID | Data Source | Data Component | Detects |
Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity. ((sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=15) OR (sourcetype="WinEventLog:Security" EventCode=4663)) OR (source="/var/log/audit/audit.log" SYSCALL="open" path IN ("/bin", "/usr/bin", "/etc"))| eval risk_score=case( like(path, "%system32%"), 7, like(path, "%/usr/local/bin%"), 6, like(path, "%Program Files%"), 5)| where risk_score >= 5| stats count by host, user, path, process, risk_score| table _time, host, user, path, process, risk_score | |||
Perform physical inspection of hardware to look for potential tampering. Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes and compare against known good baseline behavior. (EventCode=7045 OR EventCode=1116)OR (source="/var/log/system.log" message="Blocked binary execution")| eval risk_score=case( like(Image, "%Temp%"), 7, like(Image, "%AppData%"), 6, like(Image, "%C:\Users\Public%"), 8)| where risk_score >= 6| stats count by host, user, Image, CommandLine, risk_score| table _time, host, user, Image, CommandLine, risk_score |
T1195.001-Supply Chain Compromise: Compromise Software Dependencies and Development Tools
ID | Data Source | Data Component | Detects |
Use verification of distributed binaries through hash checking or other integrity checking mechanisms. Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity. (EventCode=15 OR EventCode=4663) OR (source="/var/log/audit/audit.log" SYSCALL="open" path IN ("/usr/bin/gcc", "/usr/bin/make", "/usr/local/bin/node", "/opt/build-tools/"))| eval risk_score=case( like(path, "%npm%"), 7, like(path, "%python%"), 6, like(path, "%gcc%"), 6, like(path, "%make%"), 5)| where risk_score >= 5| stats count by host, user, path, process, risk_score| table _time, host, user, path, process, risk_score |
T1528-Steal Application Access Token
ID | Data Source | Data Component | Detects |
Monitor M365 Audit logs for the Operations Add app role assignment grant to user and/or Consent to application occurring against AzureActiveDirectory Workloads. Analytic 1 - Unusual app role assignments or consents to applications. index=security sourcetype="WinEventLog:Security" EventCode=5136 OR (index=azuread sourcetype="azure:activity" operationName="Add member to role" OR operationName="Update application" OR operationName="Update servicePrincipal") OR(index=gsuite sourcetype="gsuite:admin" event_type="UPDATE_GROUP" OR event_type="UPDATE_USER") OR(index=o365 sourcetype="o365:management:activity" operation IN ("Add member to role", "Update user", "Update group")) | |||
Administrators should set up monitoring to trigger automatic alerts when policy criteria are met. For example, using a Cloud Access Security Broker (CASB), admins can create a "High severity app permissions" policy that generates alerts if apps request high severity permissions or send permissions requests for too many users. Security analysts can hunt for malicious apps using the tools available in their CASB, identity provider, or resource provider (depending on platform.) For example, they can filter for apps that are authorized by a small number of users, apps requesting high risk permissions, permissions incongruous with the app’s purpose, or apps with old "Last authorized" fields. A specific app can be investigated using an activity log displaying activities the app has performed, although some activities may be mis-logged as being performed by the user. App stores can be useful resources to further investigate suspicious apps. Administrators can set up a variety of logs and leverage audit tools to monitor actions that can be conducted as a result of OAuth 2.0 access. For instance, audit reports enable admins to identify privilege escalation actions such as role creations or policy modifications, which could be actions performed after initial access. Analytic 1 - Unauthorized app permissions or unusual activity patterns in app logs. (index=security sourcetype="WinEventLog:Security" EventCode=4720 OR EventCode=4722 OR EventCode=4738) OR(index=azuread sourcetype="azure:activity" operationName IN ("Add member to role", "Update user", "Update group")) OR(index=gsuite sourcetype="gsuite:admin" event_type IN ("UPDATE_USER", "ADD_USER_TO_GROUP")) OR(index=o365 sourcetype="o365:management:activity" operation IN ("Add member to role", "Update user", "Update group")) |
T1566 - Phishing (Initial Access)
ID | Data Source | Data Component | Detects |
Monitor for third-party application logging, messaging, and/or other artifacts that may send phishing messages to gain access to victim systems. Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.[20][21] URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites. Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link. Monitor call logs from corporate devices to identify patterns of potential voice phishing, such as calls to/from known malicious phone numbers. Correlate these records with system events. Analytic 1 - Detecting Malicious Phishing Emails (source="o365_message_trace" OR source="gmail_security_logs" OR source="/var/log/maillog")| search ("dkim=fail" OR "spf=fail" OR "dmarc=fail" OR "suspicious attachment")| eval risk_score=case( like(subject, "%password reset%"), 8, like(subject, "%urgent action required%"), 7, like(subject, "%invoice%"), 6)| where risk_score >= 6| stats count by _time, src_email, dest_email, subject, attachment_name, risk_score | |||
Monitor for creation of suspicious email attachments in download directories, execution of phishing attachments (e.g., .docm, .lnk, .hta, .vbs), or files extracted from .zip, .rar, .iso containers that execute scripts. Analytic 1 - Detecting Malicious File Creation from Phishing Emails (EventCode=11 OR EventCode=1116)OR (source="/var/log/audit/audit.log" SYSCALL="open" path IN ("/home/user/Downloads", "C:\Users\Public\Downloads"))| eval risk_score=case( like(path, "%.vbs"), 8, like(path, "%.lnk"), 7, like(path, "%.exe"), 6)| where risk_score >= 6| stats count by _time, host, path, user, risk_score | |||
Monitor for clicking on malicious links leading to credential phishing, traffic to newly registered or suspicious domains, malicious redirect chains embedded in emails, or downloading of executables from phishing sites. Analytic 1 - Detecting Phishing Link Clicks in Emails (EventCode=3)OR (source="zeek_http_logs" uri IN (malicious_url_list))OR (source="proxy_logs" url IN (malicious_url_list))| eval risk_score=case( domain IN ("bit.ly", "tinyurl.com"), 8, domain IN (".xyz", ".top"), 7, uri IN (malicious_url_list), 9)| where risk_score >= 7| stats count by _time, host, user, uri, domain, risk_score | |||
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analytic 1 - Detecting Malicious Network Traffic Post-Phishing Execution (EventCode=3)OR (source="zeek_conn.log" dest_ip IN (malicious_ip_list))OR (source="proxy_logs" url IN (malicious_url_list))| eval risk_score=case( dest_ip IN (malicious_ip_list), 9, dest_port IN (4444, 1337, 8080), 8, user_agent LIKE "%curl%", 7)| where risk_score >= 7| stats count by _time, host, user, dest_ip, dest_port, risk_score |
T1041-Exfiltration Over C2 Channel
ID | Data Source | Data Component | Detects |
Monitor executed commands and arguments that may steal data by exfiltrating it over an existing command and control channel. Analytic 1 - Detecting C2 Tool Execution Related to Exfiltration (EventCode=1 OR source="/var/log/audit/audit.log" type="execve")| where (command IN ("powershell -enc", "python -c", "curl -d", "wget --post-file", "certutil -encode", "base64 -w 0"))| eval risk_score=case( command IN ("powershell -enc", "certutil -encode"), 9, command IN ("python -c", "curl -d"), 8)| where risk_score >= 8| stats count by _time, host, user, command, risk_score | |||
Monitor for suspicious files (i.e. .pdf, .docx, .jpg, etc.) viewed in isolation that may steal data by exfiltrating it over an existing command and control channel. Analytic 1 - Detecting File Access Before C2 Exfiltration (EventCode=11 OR EventCode=4663 OR source="/var/log/audit/audit.log" type="open")| where (file_path IN ("/tmp/", "/var/tmp/", "/home//Downloads/", "C:\Users\\Documents\exfil"))| eval risk_score=case( file_path IN ("/tmp/", "/var/tmp/"), 9, file_path IN ("/home//Downloads/*"), 8)| where risk_score >= 8| stats count by _time, host, user, file_path, risk_score | |||
Monitor for newly constructed network connections that are sent or received by untrusted hosts. Note: Network Analysis frameworks such as Zeek can be used to capture, decode, and alert on TCP network connection creation. Analytic 1 - Detecting Outbound Network Connections for C2 Exfiltration (EventCode=3 OR source="zeek_conn.log" OR source="firewall_logs")| where (bytes_out > 1000000 AND bytes_out > bytes_in * 5) // High outbound traffic| bucket span=1h _time| stats count by _time, host, process, dest_ip, bytes_out| where count > 5| stats count by host, dest_ip, count, earliest(_time), latest(_time)| where count >= 5| eval risk_score=case( count >= 10, 9, count >= 5, 8)| where risk_score >= 8| table host, dest_ip, count, earliest, latest, risk_score | |||
Hidden or encoded data inside normal C2 traffic (e.g., Base64, XOR, custom encoding).HTTP/S payloads with unusual long strings in GET/POST requests.DNS tunneling techniques used to bypass security controls. Analytic 1 - Detecting Encoded or Hidden Data in C2 Channels (EventCode=3 OR source="zeek_http.log" OR source="dns.log")| where (uri_length > 200 OR request_body_length > 5000)| eval encoded_data=if(match(uri, "([A-Za-z0-9+/=]{100,})") OR match(request_body, "([A-Za-z0-9+/=]{100,})"), 1, 0)| where encoded_data=1| stats count by _time, host, user, uri, request_body_length, risk_score| eval risk_score=case( request_body_length > 10000, 9, request_body_length > 5000, 8)| where risk_score >= 8| table host, uri, request_body_length, risk_score | |||
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. |