Chinese state-sponsored actors target US critical infrastructure

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

NSA/CISA/FBI detail Chinese state-sponsored tactics exploiting public vulnerabilities in critical and commercial systems worldwide.

NSA, CISA, and FBI assess that People's Republic of China state-sponsored cyber actors pose a major threat to U.S. and allied cyberspace assets. These actors aggressively target political, economic, military, educational, and critical infrastructure personnel and organizations to steal sensitive data, critical technologies, intellectual property, and PII. Priority targets include managed service providers, semiconductor companies, the Defense Industrial Base, universities, and medical institutions. The activity supports China's long-term economic and military development objectives.

The advisory documents observed trends in Chinese state-sponsored operations: actors use rotating virtual private servers and common open-source or commercial penetration tools to mask activities; they consistently scan for and exploit publicly disclosed vulnerabilities in major applications including Pulse Secure, Apache, F5 Big-IP, and Microsoft products within days of disclosure; and they deploy encrypted multi-hop proxies and SOHO devices as operational nodes to evade detection. The full campaign employs reconnaissance, resource development, initial access, execution, persistence, privilege escalation, defense evasion, credential access, discovery, lateral movement, collection, and command-and-control tactics mapped to MITRE ATT&CK.

Defenders should prioritize patching critical and high-severity vulnerabilities on externally facing equipment, implement comprehensive network and endpoint monitoring for C2 activity and credential misuse, deploy anti-malware and intrusion prevention systems, apply domain reputation filtering, enforce strong credentials and multi-factor authentication for remote access, and monitor for phishing and malicious attachments.

title: BITS Job Created via Bitsadmin or PowerShell to Download From Remote URL
description: Detects bitsadmin.exe /transfer (or /addfile) and PowerShell Start-BitsTransfer
  fetching content from an HTTP(S) URL. Generalises on the BITS abuse pattern rather
  than any specific URL or job name.
status: experimental
tags:
- attack.stealth
- attack.persistence
- attack.t1197
logsource:
  category: process_creation
  product: windows
detection:
  selection_bitsadmin:
    Image|endswith: \bitsadmin.exe
    CommandLine|contains:
    - /transfer
    - /addfile
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains: Start-BitsTransfer
  selection_url:
    CommandLine|contains:
    - http://
    - https://
  filter_ms:
    CommandLine|contains:
    - .microsoft.com
    - .windowsupdate.com
  condition: (selection_bitsadmin or selection_ps) and selection_url and not filter_ms
falsepositives:
- Software deployment scripts that use BITS to fetch installers from internal or vendor
  URLs
- Administrators using bitsadmin to download patches
level: medium
id: 54a3b9cd-3d3d-5769-97f8-a932b82c6fef
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200b

title: Scheduled Task Created Running Payload From User-Writable Path
description: Detects schtasks.exe creating a task whose action (/tr) points into user-writable
  directories such as AppData, Temp, Users\Public or ProgramData. Generalises on the
  technique, not on task names or filenames.
status: experimental
tags:
- attack.execution
- attack.persistence
- attack.privilege-escalation
- attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \schtasks.exe
    CommandLine|contains|all:
    - /create
    - /tr
  selection_path:
    CommandLine|contains:
    - \AppData\
    - \Temp\
    - \Users\Public\
    - \ProgramData\
  filter_known:
    CommandLine|contains:
    - OfficeClickToRun
    - GoogleUpdate
    - \Microsoft\Teams\
  condition: selection and selection_path and not filter_known
falsepositives:
- Per-user application updaters registering tasks from AppData
- Software deployment tooling that stages installers in ProgramData or Temp
level: medium
id: 95be796c-18c4-540c-832c-a402d7707640
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200b

title: Local Account Created via Net Command
description: Detects net.exe/net1.exe invoked with 'user' and '/add' to create a local
  account, which attackers use to establish persistent access on compromised hosts.
status: experimental
tags:
- attack.persistence
- attack.t1136.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \net.exe
    - \net1.exe
    CommandLine|contains|all:
    - ' user '
    - ' /add'
  filter_domain:
    CommandLine|contains: ' /domain'
  condition: selection and not filter_domain
falsepositives:
- Administrators or provisioning scripts creating local service or break-glass accounts
- Imaging or lab build scripts
level: medium
id: e5bea512-0993-5630-9c80-f8ca2bedb61f
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200b

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-200b