Threat video1:00
Chinese Nation-State Activity Down 41.4% in Trellix Data
Chinese nation-state activity fell 41.4% but stayed above Russia and Iran. Transparent Tribe has 9 detection rules, 10 IOCs and a free Splunk SPL rule.
Read the full threat intel for Chinese Nation-State Activity Down 41.4% in Trellix Data →
Chapters
- 0:00The hookChinese nation-state threat fell 41.4%: still dominant.
- 0:05The storyChinese threat fell 41.4%.
- 0:11Attack pathWeaver Ant exploited internet-facing servers.
- 0:28AttributionAttributed to Gamaredon.
- 0:32Indicators of compromise2 indicators to hunt: 2 file names.
- 0:37MITRE ATT&CK techniques12 ATT&CK techniques, from initial access to command and control.
- 0:42Remediation3 steps now: Hunt for web shells on externally facing IIS/PHP servers, especially.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Chinese nation-state threat fell 41.4%: still dominant.
0:06Chinese threat fell 41.4%.
0:09Yet it leads Russia and Iran.
0:11Weaver Ant exploited internet-facing servers.
0:14Then deployed web shells for persistence.
0:17Ran malware in memory, bypassing defenses.
0:20Patched AMSI, ETW to hide activity.
0:23Moved through networks with stolen hashes.
0:28Attributed to Gamaredon. Confidence: medium.
0:332 indicators to hunt: 2 file names.
0:3812 ATT&CK techniques, from initial access to command and control.
0:433 steps now: Hunt for web shells on externally facing IIS/PHP servers, especially.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.