Chinese APTs target US critical infrastructure amid tensions

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

CISA warns of Chinese state-sponsored cyber threat to US critical infrastructure; recommends heightened awareness and patching known exploited vulnerabilities.

CISA issued a cybersecurity alert in October 2020 regarding potential Chinese cyber response to heightened US–China tensions. The advisory documents Chinese state-sponsored cyber activity targeting US critical infrastructure, intellectual property, and sensitive government and military information. Chinese threat actors, primarily operating under PLA Unit 61398 and Ministry of State Security direction, have demonstrated sustained capability to infiltrate networks across healthcare, financial services, defense industrial base, energy, government facilities, critical manufacturing, communications, IT, education, and law enforcement sectors.

The alert details common TTPs employed by Chinese APTs including APT1, APT3, APT10, APT19, APT40, and APT41. Attack vectors include exploitation of known vulnerabilities in internet-facing systems (particularly Citrix, BIG-IP, and Microsoft products), phishing and spearphishing campaigns, compromised managed service providers, password spraying, and deployment of commodity tools such as Cobalt Strike, Mimikatz, and China Chopper webshells. The advisory references multiple high-profile incidents including the 2017 Equifax breach, targeting of COVID-19 research organizations via large-scale password spraying, and systematic IP theft from companies in 12+ countries.

CISA recommends immediate patching of critical vulnerabilities, implementation of rigorous configuration management, network monitoring for C2 activity, enhanced email security, and endpoint protection capabilities. Organizations are advised to increase vigilance, exercise incident response plans, and maintain heightened personnel availability.

title: Cobalt Strike Default Named Pipe Created
description: Detects creation of named pipes that match default Cobalt Strike SMB
  beacon and post-exploitation pipe names. Cobalt Strike is named in the report as
  a commodity tool used by Chinese APTs. Operators who change the malleable profile
  will evade this rule.
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
  category: pipe_created
  product: windows
detection:
  selection_prefix:
    PipeName|startswith: \WkSvcPipeMgr_
  selection_msse:
    PipeName|re: ^\\MSSE-.*-server$
  selection_exact:
    PipeName:
    - \hashdump
    - \334485
    - \461092
  condition: 1 of selection_*
falsepositives:
- Legitimate software that coincidentally uses a pipe name beginning with MSSE- and
  ending in -server
- Red team or penetration test exercises using default Cobalt Strike profiles
level: high
id: db07611e-e5f7-54c6-bf4d-34b5df5a82a8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-275a

title: Mimikatz-Named Pipe Created
description: Detects creation of a named pipe whose name contains mimikatz, indicating
  use of Mimikatz or a derivative (for example remote execution modules). Mimikatz
  is named in the report as a commodity tool used by Chinese APTs.
tags:
- attack.credential-access
- attack.t1003.001
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName|contains: mimikatz
  condition: selection
falsepositives:
- Security testing and red team exercises that run Mimikatz
level: high
id: 466676e5-88c7-5c38-adda-95c0b08a954c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-275a

title: PowerShell Base64 Decode Combined with In-Memory Execution
description: Detects PowerShell command lines that decode Base64 data with FromBase64String
  and then execute it through IEX, Invoke-Expression or a download cradle. This is
  a typical loader pattern for commodity post-exploitation tooling such as Cobalt
  Strike stagers.
tags:
- attack.execution
- attack.t1059.001
- attack.stealth
- attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_decode:
    CommandLine|contains: FromBase64String
  selection_exec:
    CommandLine|contains:
    - IEX
    - Invoke-Expression
    - DownloadString
    - Net.WebClient
  condition: selection_img and selection_decode and selection_exec
falsepositives:
- Administrative deployment scripts that decode embedded Base64 payloads and invoke
  them
- Software installers that bootstrap via PowerShell
level: medium
id: 375097de-17d2-5f4a-9c73-151395fc189b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-275a

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-275a