Volt Typhoon targets US critical infrastructure with living-off-land tactics

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

PRC state-sponsored Volt Typhoon uses built-in Windows tools to evade detection across US critical infrastructure sectors worldwide.

The NSA, CISA, FBI, and international cyber authorities have jointly published guidance on a People's Republic of China state-sponsored cyber actor known as Volt Typhoon. The actor targets critical infrastructure networks across U.S. sectors and uses primarily living-off-the-land techniques—leveraging built-in Windows administration tools like wmic, ntdsutil, netsh, and PowerShell—to blend with legitimate system activity and evade endpoint detection and response solutions.

Volt Typhoon gains initial access by exploiting known vulnerabilities in widely deployed software (CVE-2021-40539 in ManageEngine ADSelfService Plus, CVE-2021-27860 in FatPipe products) and SOHO network devices (ASUS, Cisco RV, Draytek Vigor, Fortinet FortiGate, Netgear ProSafe, Zyxel USG). Once compromised, the actor uses compromised SOHO devices as intermediate infrastructure to obscure command-and-control traffic, then employs webshells for persistence. Post-compromise activity focuses on credential theft—particularly targeting ntds.dit and SYSTEM registry hives for offline password cracking—using tools including Impacket, mimikatz, and Fast Reverse Proxy (FRP).

The advisory provides detailed hunting guidance, including command-line signatures, file paths, and registry artifacts defenders should monitor. A defender who finds evidence of ntds.dit exfiltration should assume the entire domain is compromised and follow CISA's eviction guidance. The actor selectively clears Windows Event Logs to remove evidence of intrusion.

title: NTDS.dit Extraction via ntdsutil IFM or VSS Snapshot Copy
description: Detects ntdsutil using the 'ac i ntds' and 'ifm' / 'create full' sequence,
  or copying ntds.dit from a volume shadow copy path. Generalises on the technique
  pattern rather than the output directory.
tags:
- attack.credential-access
- attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_ntdsutil:
    Image|endswith: \ntdsutil.exe
    CommandLine|contains|all:
    - ntds
    - ifm
  selection_ntdsutil_create:
    Image|endswith: \ntdsutil.exe
    CommandLine|contains|all:
    - ac i ntds
    - create full
  selection_vss_copy:
    CommandLine|contains|all:
    - HarddiskVolumeShadowCopy
    - ntds.dit
  condition: 1 of selection_*
falsepositives:
- Domain administrators creating IFM media to build a new domain controller
- Backup or DR tooling that copies ntds.dit from a snapshot
level: high
id: babd2ee5-db0e-5716-9299-c7eef25701c1
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a

title: Security Event Log Cleared via wevtutil or PowerShell
description: Detects command-line clearing of Windows event logs via wevtutil (cl
  / clear-log) or PowerShell Clear-EventLog / Remove-EventLog, used for selective
  log deletion after intrusion activity.
tags:
- attack.stealth
- attack.t1070
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil:
    Image|endswith: \wevtutil.exe
    CommandLine|contains:
    - ' cl '
    - clear-log
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - Clear-EventLog
    - Remove-EventLog
    - ClearLog
  condition: 1 of selection_*
falsepositives:
- Administrators clearing logs during system re-imaging or lab resets
- Build pipelines that reset event logs on test machines
level: high
id: a04df725-71cc-56f6-923b-049693289f46
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a

title: WMIC Used for Remote or Local Reconnaissance and Shadow Copy Creation
description: Detects wmic.exe invoking shadowcopy creation or querying logical disks/OS/computer
  system details in LOTL discovery. Matches argument patterns rather than specific
  output files.
tags:
- attack.execution
- attack.t1047
- attack.discovery
- attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \wmic.exe
  selection_shadow:
    CommandLine|contains|all:
    - shadowcopy
    - create
  selection_recon:
    CommandLine|contains:
    - logicaldisk get
    - computersystem get
    - os get
    - useraccount list
    - process list
  condition: selection_img and 1 of selection_s* or selection_img and selection_recon
falsepositives:
- Legacy inventory or monitoring scripts that call wmic for OS and disk information
- Backup software creating shadow copies through wmic
level: medium
id: 6c77550d-a2f5-50c9-8b6a-6535973dac9e
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a