headless_bee

detections/endpoint/any_powershell_downloadfile.yml

@@ -1,7 +1,7 @@
 name: Any Powershell DownloadFile
 id: 1a93b7ea-7af7-11eb-adb5-acde48001122
-version: 11
-date: '2025-02-10'
+version: '12'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -71,18 +71,19 @@ rba:
     type: process_name
 tags:
   analytic_story:
-  - Data Destruction
   - Ingress Tool Transfer
-  - DarkCrystal RAT
-  - PXA Stealer
-  - Braodo Stealer
-  - Phemedrone Stealer
-  - Log4Shell CVE-2021-44228
-  - Malicious PowerShell
-  - Hermetic Wiper
+  - China-Nexus Threat Activity
   - Crypto Stealer
-  - Nexus APT Threat Activity
+  - Hermetic Wiper
+  - DarkCrystal RAT
+  - Malicious PowerShell
   - Earth Estries
+  - Phemedrone Stealer
+  - Braodo Stealer
+  - PXA Stealer
+  - Nexus APT Threat Activity
+  - Data Destruction
+  - Log4Shell CVE-2021-44228
   asset_type: Endpoint
   cve:
   - CVE-2021-44228
@@ -97,7 +98,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog

detections/endpoint/detect_rare_executables.yml

@@ -60,7 +60,7 @@ tags:
   analytic_story:
   - SnappyBee
   - Rhysida Ransomware
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Crypto Stealer
   - Earth Estries
   - Unusual Processes

detections/endpoint/detect_renamed_psexec.yml

@@ -1,7 +1,7 @@
 name: Detect Renamed PSExec
 id: 683e6196-b8e8-11eb-9a79-acde48001122
-version: 11
-date: '2025-02-10'
+version: '12'
+date: '2025-02-24'
 author: Michael Haag, Splunk, Alex Oberkircher, Github Community
 status: production
 type: Hunting
@@ -39,18 +39,19 @@ references:
 - https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
   - BlackByte Ransomware
-  - DHS Report TA18-074A
-  - DarkSide Ransomware
-  - SamSam Ransomware
-  - CISA AA22-320A
   - HAFNIUM Group
-  - Sandworm Tools
+  - DHS Report TA18-074A
+  - CISA AA22-320A
+  - DarkSide Ransomware
   - Active Directory Lateral Movement
-  - Nexus APT Threat Activity
   - DarkGate Malware
-  - Earth Estries
+  - Sandworm Tools
   - Rhysida Ransomware
+  - Nexus APT Threat Activity
+  - Earth Estries
+  - SamSam Ransomware
   asset_type: Endpoint
   mitre_attack_id:
   - T1569.002
@@ -62,7 +63,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog

detections/endpoint/detect_renamed_winrar.yml

@@ -1,7 +1,7 @@
 name: Detect Renamed WinRAR
 id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122
-version: 9
-date: '2025-02-10'
+version: '10'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
@@ -38,10 +38,11 @@ references:
 - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md
 tags:
   analytic_story:
-  - Collection and Staging
-  - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - CISA AA22-277A
+  - Collection and Staging
+  - Nexus APT Threat Activity
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1560.001
@@ -53,7 +54,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -95,7 +95,7 @@ tags:
   - Amadey
   - DarkCrystal RAT
   - Remcos
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   - Rhysida Ransomware
   - RedLine Stealer

detections/endpoint/executables_or_script_creation_in_temp_path.yml

@@ -94,7 +94,7 @@ tags:
   - Amadey
   - DarkCrystal RAT
   - Remcos
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   - Rhysida Ransomware
   - RedLine Stealer

detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml

@@ -1,8 +1,8 @@
 name: Linux Auditd File Permission Modification Via Chmod
 id: 5f1d2ea7-eec0-4790-8b24-6875312ad492
-version: 7
-date: '2025-02-10'
-author: Teoderick Contreras, Splunk, Ivar Nygård
+version: '8'
+date: '2025-02-24'
+author: "Teoderick Contreras, Splunk, Ivar Nyg\xE5rd"
 status: production
 type: Anomaly
 description: The following analytic detects suspicious file permission modifications
@@ -58,11 +58,12 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
-  - Linux Living Off The Land
-  - Compromised Linux Host
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
   - XorDDos
+  - Linux Privilege Escalation
+  - Compromised Linux Host
+  - Linux Living Off The Land
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -76,7 +77,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log
     source: /var/log/audit/audit.log
     sourcetype: linux:audit

detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml

@@ -1,7 +1,7 @@
 name: Linux Auditd Nopasswd Entry In Sudoers File
 id: 651df959-ad17-4b73-a323-90cb96d5fa1b
-version: 5
-date: '2025-02-10'
+version: '6'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -57,9 +57,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
   - Linux Privilege Escalation
   - Compromised Linux Host
-  - Linux Persistence Techniques
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -73,7 +74,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log
     source: /var/log/audit/audit.log
     sourcetype: linux:audit

detections/endpoint/linux_auditd_possible_access_to_credential_files.yml

@@ -1,7 +1,7 @@
 name: Linux Auditd Possible Access To Credential Files
 id: 0419cb7a-57ea-467b-974f-77c303dfe2a3
-version: 5
-date: '2025-02-10'
+version: '6'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -59,9 +59,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
   - Linux Privilege Escalation
   - Compromised Linux Host
-  - Linux Persistence Techniques
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -75,7 +76,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log
     source: /var/log/audit/audit.log
     sourcetype: linux:audit

detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml

@@ -1,7 +1,7 @@
 name: Linux Auditd Possible Access To Sudoers File
 id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834
-version: 5
-date: '2025-02-10'
+version: '6'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -56,9 +56,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
   - Linux Privilege Escalation
   - Compromised Linux Host
-  - Linux Persistence Techniques
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -72,7 +73,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log
     source: /var/log/audit/audit.log
     sourcetype: linux:audit

detections/endpoint/linux_auditd_preload_hijack_library_calls.yml

@@ -1,7 +1,7 @@
 name: Linux Auditd Preload Hijack Library Calls
 id: 35c50572-a70b-452f-afa9-bebdf3c3ce36
-version: 5
-date: '2025-02-10'
+version: '6'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -57,9 +57,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
   - Linux Privilege Escalation
   - Compromised Linux Host
-  - Linux Persistence Techniques
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -73,7 +74,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_ldpreload/linux_auditd_ldpreload.log
     source: /var/log/audit/audit.log
     sourcetype: linux:audit

detections/endpoint/linux_common_process_for_elevation_control.yml

@@ -1,7 +1,7 @@
 name: Linux Common Process For Elevation Control
 id: 66ab15c0-63d0-11ec-9e70-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Hunting
@@ -44,9 +44,10 @@ references:
 - https://github.com/microsoft/MSTIC-Sysmon/blob/main/linux/configs/attack-based/privilege_escalation/T1548.001_ElevationControl_CommonProcesses.xml
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - Linux Persistence Techniques
   - Linux Privilege Escalation
   - Linux Living Off The Land
-  - Linux Persistence Techniques
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -60,7 +61,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux

detections/endpoint/linux_file_creation_in_init_boot_directory.yml

@@ -1,7 +1,7 @@
 name: Linux File Creation In Init Boot Directory
 id: 97d9cfb2-61ad-11ec-bb2d-acde48001122
-version: 7
-date: '2025-02-10'
+version: '8'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -49,10 +49,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
+  - China-Nexus Threat Activity
   - Backdoor Pingpong
   - Linux Persistence Techniques
   - XorDDos
+  - Linux Privilege Escalation
   - Nexus APT Threat Activity
   asset_type: Endpoint
   mitre_attack_id:
@@ -65,7 +66,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux

detections/endpoint/linux_iptables_firewall_modification.yml

@@ -1,7 +1,7 @@
 name: Linux Iptables Firewall Modification
 id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7
-version: 8
-date: '2025-02-10'
+version: '9'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -66,10 +66,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Sandworm Tools
+  - China-Nexus Threat Activity
   - Backdoor Pingpong
-  - Nexus APT Threat Activity
   - Cyclops Blink
+  - Sandworm Tools
+  - Nexus APT Threat Activity
   asset_type: Endpoint
   mitre_attack_id:
   - T1562.004
@@ -81,7 +82,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux

detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml

@@ -1,7 +1,7 @@
 name: Linux NOPASSWD Entry In Sudoers File
 id: ab1e0d52-624a-11ec-8e0b-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -58,10 +58,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
-  - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
+  - Linux Privilege Escalation
+  - Nexus APT Threat Activity
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1548.003
@@ -73,7 +74,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux

detections/endpoint/linux_possible_access_to_credential_files.yml

@@ -1,7 +1,7 @@
 name: Linux Possible Access To Credential Files
 id: 16107e0e-71fc-11ec-b862-acde48001122
-version: 7
-date: '2025-02-10'
+version: '8'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -57,9 +57,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
   - XorDDos
+  - Linux Privilege Escalation
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint
@@ -73,7 +74,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux

detections/endpoint/linux_possible_access_to_sudoers_file.yml

@@ -1,7 +1,7 @@
 name: Linux Possible Access To Sudoers File
 id: 4479539c-71fc-11ec-b2e2-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -57,10 +57,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
-  - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
+  - Linux Privilege Escalation
+  - Nexus APT Threat Activity
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1548.003
@@ -72,7 +73,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux

detections/endpoint/linux_preload_hijack_library_calls.yml

@@ -1,7 +1,7 @@
 name: Linux Preload Hijack Library Calls
 id: cbe2ca30-631e-11ec-8670-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -57,10 +57,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
-  - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
+  - Linux Privilege Escalation
+  - Nexus APT Threat Activity
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1574.006
@@ -72,7 +73,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux

detections/endpoint/linux_sudoers_tmp_file_creation.yml

@@ -1,7 +1,7 @@
 name: Linux Sudoers Tmp File Creation
 id: be254a5c-63e7-11ec-89da-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -51,10 +51,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Linux Privilege Escalation
-  - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Linux Persistence Techniques
+  - Linux Privilege Escalation
+  - Nexus APT Threat Activity
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1548.003
@@ -66,7 +67,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log
     source: Syslog:Linux-Sysmon/Operational
     sourcetype: sysmon:linux

detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml

@@ -1,7 +1,7 @@
 name: Malicious PowerShell Process - Execution Policy Bypass
 id: 9be56c82-b1cc-4318-87eb-d138afaaca39
-version: 10
-date: '2025-02-10'
+version: '11'
+date: '2025-02-24'
 author: Rico Valdez, Mauricio Velazco, Splunk
 status: production
 type: Anomaly
@@ -60,11 +60,12 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - DHS Report TA18-074A
-  - AsyncRAT
-  - DarkCrystal RAT
+  - China-Nexus Threat Activity
   - HAFNIUM Group
+  - DHS Report TA18-074A
+  - DarkCrystal RAT
   - Nexus APT Threat Activity
+  - AsyncRAT
   - Earth Estries
   - Volt Typhoon
   asset_type: Endpoint
@@ -78,7 +79,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/encoded_powershell/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog

detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml

@@ -58,7 +58,7 @@ tags:
   - FIN7
   - Earth Estries
   - Warzone RAT
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - Remcos
   - RedLine Stealer

detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml

@@ -55,7 +55,7 @@ tags:
   - CISA AA23-347A
   - 3CX Supply Chain Attack
   - Azorult
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Warzone RAT
   - AgentTesla
   - RedLine Stealer

detections/endpoint/powershell_4104_hunting.yml

@@ -1,7 +1,7 @@
 name: PowerShell 4104 Hunting
 id: d6f2b006-0041-11ec-8885-acde48001122
-version: 11
-date: '2025-02-10'
+version: '12'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: Hunting
@@ -59,19 +59,20 @@ references:
 - https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
 tags:
   analytic_story:
-  - Data Destruction
+  - China-Nexus Threat Activity
+  - CISA AA24-241A
+  - Nexus APT Threat Activity
+  - Malicious PowerShell
   - Flax Typhoon
   - CISA AA23-347A
-  - Braodo Stealer
-  - Cleo File Transfer Software
-  - Malicious PowerShell
-  - Hermetic Wiper
   - DarkGate Malware
-  - Lumma Stealer
-  - Nexus APT Threat Activity
   - Earth Estries
+  - Cleo File Transfer Software
+  - Braodo Stealer
+  - Lumma Stealer
   - Rhysida Ransomware
-  - CISA AA24-241A
+  - Data Destruction
+  - Hermetic Wiper
   asset_type: Endpoint
   mitre_attack_id:
   - T1059.001
@@ -83,7 +84,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: XmlWinEventLog

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -84,7 +84,7 @@ tags:
   - Chaos Ransomware
   - WinDealer RAT
   - Warzone RAT
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   - SnappyBee
   - Windows Persistence Techniques

detections/endpoint/remote_process_instantiation_via_wmi.yml

@@ -1,7 +1,7 @@
 name: Remote Process Instantiation via WMI
 id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da
-version: 11
-date: '2025-01-27'
+version: '12'
+date: '2025-02-24'
 author: Rico Valdez, Mauricio Velazco, Splunk
 status: production
 type: TTP
@@ -65,10 +65,11 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - CISA AA23-347A
+  - China-Nexus Threat Activity
   - Ransomware
-  - Suspicious WMI Use
   - Active Directory Lateral Movement
+  - CISA AA23-347A
+  - Suspicious WMI Use
   - Nexus APT Threat Activity
   - Earth Estries
   asset_type: Endpoint

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -1,7 +1,7 @@
 name: Scheduled Task Deleted Or Created via CMD
 id: d5af132c-7c17-439c-9d31-13d55340f36c
-version: 12
-date: '2025-02-10'
+version: '13'
+date: '2025-02-24'
 author: Bhavin Patel, Splunk
 status: production
 type: TTP
@@ -66,32 +66,33 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Windows Persistence Techniques
   - DHS Report TA18-074A
   - Trickbot
-  - CISA AA23-347A
-  - Qakbot
-  - Azorult
-  - ShrinkLocker
-  - AsyncRAT
-  - Phemedrone Stealer
-  - NjRAT
-  - Prestige Ransomware
-  - Scheduled Tasks
-  - AgentTesla
-  - MoonPeak
   - NOBELIUM Group
-  - Living Off The Land
-  - CISA AA22-257A
+  - Prestige Ransomware
+  - Earth Estries
+  - ShrinkLocker
+  - NjRAT
   - CISA AA24-241A
-  - Amadey
   - DarkCrystal RAT
   - Sandworm Tools
-  - Winter Vivern
+  - Living Off The Land
   - Nexus APT Threat Activity
-  - Earth Estries
-  - Rhysida Ransomware
+  - AsyncRAT
+  - Scheduled Tasks
+  - AgentTesla
+  - Windows Persistence Techniques
   - RedLine Stealer
+  - Rhysida Ransomware
+  - Winter Vivern
+  - China-Nexus Threat Activity
+  - Qakbot
+  - CISA AA22-257A
+  - MoonPeak
+  - CISA AA23-347A
+  - Phemedrone Stealer
+  - Azorult
+  - Amadey
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
@@ -103,7 +104,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog

detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml

@@ -1,7 +1,7 @@
 name: Suspicious Regsvr32 Register Suspicious Path
 id: 62732736-6250-11eb-ae93-0242ac130002
-version: 12
-date: '2025-02-10'
+version: '13'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -73,13 +73,14 @@ rba:
     type: process_name
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
+  - IcedID
   - Qakbot
+  - Derusbi
+  - Living Off The Land
+  - Nexus APT Threat Activity
   - Earth Estries
   - Suspicious Regsvr32 Activity
-  - IcedID
-  - Derusbi
-  - Nexus APT Threat Activity
-  - Living Off The Land
   asset_type: Endpoint
   mitre_attack_id:
   - T1218.010
@@ -91,7 +92,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog

detections/endpoint/suspicious_scheduled_task_from_public_directory.yml

@@ -1,7 +1,7 @@
 name: Suspicious Scheduled Task from Public Directory
 id: 7feb7972-7ac3-11eb-bac8-acde48001122
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: Anomaly
@@ -65,19 +65,20 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Windows Persistence Techniques
-  - CISA AA23-347A
-  - Ransomware
-  - DarkCrystal RAT
-  - Scheduled Tasks
-  - Azorult
+  - China-Nexus Threat Activity
   - Crypto Stealer
-  - Nexus APT Threat Activity
-  - Living Off The Land
+  - Ransomware
   - MoonPeak
-  - Ryuk Ransomware
-  - Earth Estries
+  - DarkCrystal RAT
   - CISA AA24-241A
+  - CISA AA23-347A
+  - Windows Persistence Techniques
+  - Living Off The Land
+  - Nexus APT Threat Activity
+  - Azorult
+  - Ryuk Ransomware
+  - Scheduled Tasks
+  - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
@@ -89,7 +90,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog

detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml

@@ -65,7 +65,7 @@ tags:
   - AsyncRAT
   - Derusbi
   - PlugX
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - Earth Estries
   asset_type: Endpoint

detections/endpoint/windows_anonymous_pipe_activity.yml

@@ -37,7 +37,7 @@ drilldown_searches:
 tags:
   analytic_story:
   - SnappyBee
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:

detections/endpoint/windows_archive_collected_data_via_rar.yml

@@ -1,7 +1,7 @@
 name: Windows Archive Collected Data via Rar
 id: 2015de95-fe91-413d-9d62-2fe011b67e82
-version: 6
-date: '2025-02-10'
+version: '7'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -61,9 +61,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - DarkGate Malware
+  - China-Nexus Threat Activity
   - Earth Estries
   - Nexus APT Threat Activity
-  - DarkGate Malware
   asset_type: Endpoint
   mitre_attack_id:
   - T1560.001
@@ -75,7 +76,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: XmlWinEventLog

detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml

@@ -61,7 +61,7 @@ tags:
   - Amadey
   - PXA Stealer
   - Warzone RAT
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - RedLine Stealer
   - Earth Estries

detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml

@@ -62,7 +62,7 @@ tags:
   - Amadey
   - PXA Stealer
   - Warzone RAT
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - RedLine Stealer
   - Earth Estries

detections/endpoint/windows_curl_download_to_suspicious_path.yml

@@ -1,7 +1,7 @@
 name: Windows Curl Download to Suspicious Path
 id: c32f091e-30db-11ec-8738-acde48001122
-version: 8
-date: '2025-01-27'
+version: '9'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -71,11 +71,12 @@ rba:
 tags:
   analytic_story:
   - Ingress Tool Transfer
-  - Forest Blizzard
+  - China-Nexus Threat Activity
   - IcedID
   - Nexus APT Threat Activity
-  - Compromised Windows Host
+  - Forest Blizzard
   - Earth Estries
+  - Compromised Windows Host
   asset_type: Endpoint
   mitre_attack_id:
   - T1105

detections/endpoint/windows_query_registry_browser_list_application.yml

@@ -54,7 +54,7 @@ tags:
   - SnappyBee
   - RedLine Stealer
   - Earth Estries
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   asset_type: Endpoint
   mitre_attack_id:
   - T1012

detections/endpoint/windows_replication_through_removable_media.yml

@@ -1,7 +1,7 @@
 name: Windows Replication Through Removable Media
 id: 60df805d-4605-41c8-bbba-57baa6a4eb97
-version: 7
-date: '2025-01-27'
+version: '8'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: TTP
@@ -60,12 +60,13 @@ rba:
     type: file_name
 tags:
   analytic_story:
-  - PlugX
+  - NjRAT
+  - China-Nexus Threat Activity
   - Chaos Ransomware
   - Derusbi
+  - PlugX
   - Nexus APT Threat Activity
   - Earth Estries
-  - NjRAT
   asset_type: Endpoint
   mitre_attack_id:
   - T1091

detections/endpoint/windows_service_creation_on_remote_endpoint.yml

@@ -65,7 +65,7 @@ tags:
   - SnappyBee
   - CISA AA23-347A
   - Active Directory Lateral Movement
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:

detections/endpoint/windows_service_creation_using_registry_entry.yml

@@ -57,7 +57,7 @@ tags:
   - Brute Ratel C4
   - CISA AA23-347A
   - Suspicious Windows Registry Activities
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Derusbi
   - PlugX
   - Windows Registry Abuse

detections/endpoint/windows_snappybee_create_test_registry.yml

@@ -49,7 +49,7 @@ rba:
 tags:
   analytic_story:
   - SnappyBee
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:

detections/endpoint/windows_suspicious_process_file_path.yml

@@ -103,7 +103,7 @@ tags:
   - MoonPeak
   - ValleyRAT
   - Meduza Stealer
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   - SnappyBee
   asset_type: Endpoint

detections/endpoint/windows_svchost_exe_parent_process_anomaly.yml

@@ -60,7 +60,7 @@ rba:
 tags:
   analytic_story:
   - SnappyBee
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - Earth Estries
   asset_type: Endpoint
   mitre_attack_id:

detections/endpoint/windows_unsigned_dll_side_loading.yml

@@ -1,7 +1,7 @@
 name: Windows Unsigned DLL Side-Loading
 id: 5a83ce44-8e0f-4786-a775-8249a525c879
-version: 7
-date: '2025-01-27'
+version: '8'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 status: production
 type: Anomaly
@@ -52,10 +52,11 @@ rba:
 tags:
   analytic_story:
   - Warzone RAT
+  - NjRAT
+  - China-Nexus Threat Activity
   - Derusbi
   - Nexus APT Threat Activity
   - Earth Estries
-  - NjRAT
   asset_type: Endpoint
   mitre_attack_id:
   - T1574.002

detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml

@@ -56,7 +56,7 @@ tags:
   analytic_story:
   - PlugX
   - Derusbi
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - Earth Estries
   - SnappyBee

detections/endpoint/windows_unsigned_ms_dll_side_loading.yml

@@ -1,7 +1,7 @@
 name: Windows Unsigned MS DLL Side-Loading
 id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c
-version: 7
-date: '2025-01-27'
+version: '8'
+date: '2025-02-24'
 author: Teoderick Contreras, Splunk
 data_source:
 - Sysmon EventID 7
@@ -64,9 +64,10 @@ rba:
     type: file_name
 tags:
   analytic_story:
+  - China-Nexus Threat Activity
   - Derusbi
-  - APT29 Diplomatic Deceptions with WINELOADER
   - Nexus APT Threat Activity
+  - APT29 Diplomatic Deceptions with WINELOADER
   - Earth Estries
   group:
   - APT29

detections/endpoint/windows_unusual_syswow64_process_run_system32_executable.yml

@@ -53,7 +53,7 @@ rba:
     type: process_name
 tags:
   analytic_story:
-  - Nexus APT Threat Activity
+  - China-Nexus Threat Activity
   - DarkGate Malware
   - Earth Estries
   asset_type: Endpoint

detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml

@@ -1,7 +1,7 @@
 name: WinEvent Scheduled Task Created to Spawn Shell
 id: 203ef0ea-9bd8-11eb-8201-acde48001122
-version: 9
-date: '2025-02-10'
+version: '10'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -54,16 +54,17 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Windows Persistence Techniques
-  - Ransomware
-  - Windows Error Reporting Service Elevation of Privilege Vulnerability
-  - Scheduled Tasks
-  - Winter Vivern
-  - Nexus APT Threat Activity
-  - Compromised Windows Host
-  - Ryuk Ransomware
-  - Earth Estries
+  - China-Nexus Threat Activity
   - CISA AA22-257A
+  - Windows Error Reporting Service Elevation of Privilege Vulnerability
+  - Compromised Windows Host
+  - Ransomware
+  - Windows Persistence Techniques
+  - Nexus APT Threat Activity
+  - Ryuk Ransomware
+  - Scheduled Tasks
+  - Earth Estries
+  - Winter Vivern
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
@@ -75,7 +76,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
     source: XmlWinEventLog:Security
     sourcetype: XmlWinEventLog

detections/endpoint/winevent_scheduled_task_created_within_public_path.yml

@@ -1,7 +1,7 @@
 name: WinEvent Scheduled Task Created Within Public Path
 id: 5d9c6eee-988c-11eb-8253-acde48001122
-version: 9
-date: '2025-02-10'
+version: '10'
+date: '2025-02-24'
 author: Michael Haag, Splunk
 status: production
 type: TTP
@@ -54,22 +54,23 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
-  - Data Destruction
-  - Windows Persistence Techniques
-  - AsyncRAT
-  - Industroyer2
-  - CISA AA23-347A
-  - Ransomware
-  - Prestige Ransomware
-  - Scheduled Tasks
+  - China-Nexus Threat Activity
   - IcedID
-  - Winter Vivern
-  - Active Directory Lateral Movement
-  - Nexus APT Threat Activity
-  - Compromised Windows Host
-  - Ryuk Ransomware
-  - Earth Estries
   - CISA AA22-257A
+  - Compromised Windows Host
+  - Ransomware
+  - Nexus APT Threat Activity
+  - Active Directory Lateral Movement
+  - CISA AA23-347A
+  - Windows Persistence Techniques
+  - Earth Estries
+  - Prestige Ransomware
+  - Industroyer2
+  - Ryuk Ransomware
+  - AsyncRAT
+  - Scheduled Tasks
+  - Data Destruction
+  - Winter Vivern
   asset_type: Endpoint
   mitre_attack_id:
   - T1053.005
@@ -81,7 +82,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: 
-      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log
     source: XmlWinEventLog:Security
     sourcetype: XmlWinEventLog

detections/network/detect_large_outbound_icmp_packets.yml

@@ -1,7 +1,7 @@
 name: Detect Large Outbound ICMP Packets
 id: e9c102de-4d43-42a7-b1c8-8062ea297419
-version: 9
-date: '2025-01-27'
+version: '10'
+date: '2025-02-24'
 author: Rico Valdez, Dean Luxton, Splunk
 status: production
 type: TTP
@@ -66,9 +66,10 @@ rba:
   threat_objects: []
 tags:
   analytic_story:
+  - Command And Control
+  - China-Nexus Threat Activity
   - Backdoor Pingpong
   - Nexus APT Threat Activity
-  - Command And Control
   asset_type: Endpoint
   mitre_attack_id:
   - T1095

stories/china_nexus_threat_activity.yml

@@ -0,0 +1,22 @@
+name: China-Nexus Threat Activity
+id: 43f8062d-4da0-4f48-8cad-6a20e108961b
+version: 2
+date: '2025-02-24'
+author: Teoderick Contreras, Splunk
+status: production
+description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, Chinese state-nexus adversaries known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss.
+narrative: Chinese state-nexus threat group are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors.
+references:
+- https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/
+- https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=oe1KKi&reflink=desktopwebshare _permalink
+- https://www.judiciary.senate.gov/imo/media/doc/2024-11-19_pm_-_testimony_-_meyers.pdf
+- https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf
+- https://www.crowdstrike.com/adversaries/envoy-panda/
+tags:
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection

stories/nexus_apt_threat_activity.yml

@@ -1,21 +0,0 @@
-name: Nexus APT Threat Activity
-id: 43f8062d-4da0-4f48-8cad-6a20e108961b
-version: 1
-date: '2025-01-27'
-author: Teoderick Contreras, Splunk
-status: production
-description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, an advanced persistent threat (APT) group known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss.
-narrative: Chinese state-nexus threat actors are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors.
-references:
-- https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/
-- https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=oe1KKi&reflink=desktopwebshare _permalink
-- https://www.judiciary.senate.gov/imo/media/doc/2024-11-19_pm_-_testimony_-_meyers.pdf
-- https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf
-tags:
-  category:
-  - Malware
-  product:
-  - Splunk Enterprise
-  - Splunk Enterprise Security
-  - Splunk Cloud
-  usecase: Advanced Threat Detection