APT Actors Exploiting Static Machine Keys in Public-Facing Web Application

# AzureSentinel-
Analytic Rules

let iocs = externaldata(DateAdded: string, IoC: string, Type: string, TLP: string) [@"https://raw.githubusercontent.com/wcoreironrrtx/APT41-USAHerds-as-well-as-the-recent-blog-post-from-Mandiant/main/README.md"] with (format="csv", ignoreFirstRecord=True);
let domains = (iocs
    | where Type =~ "domainname"
    | project IoC);
let sha256Hashes = (iocs
    | where Type =~ "sha256"
    | project IoC);
let IPList = (iocs
    | where Type =~ "ip"
    | project IoC);
let file_path1 = (iocs
    | where Type =~ "filepath1"
    | project IoC);
let file_path2 = (iocs
    | where Type =~ "filepath2"
    | project IoC);
let file_path3 = (iocs
    | where Type =~ "filepath3"
    | project IoC);
let reg_key = (iocs
    | where Type =~ "regkey"
    | project IoC);
(union isfuzzy=true
    (CommonSecurityLog
    | where DestinationHostName has_any (domains)
        or RequestURL has_any (domains)
        or Message has_any (domains)
    | parse Message with * '(' DNSName ')' *
    | project
        TimeGenerated,
        Message,
        SourceUserID,
        RequestURL,
        DestinationHostName,
        Type,
        SourceIP,
        DestinationIP,
        DNSName
    | extend Alert = 'APT Actors Exploiting Static Machine Keys in Public-Facing Web Application'
    | extend
        timestamp = TimeGenerated,
        AccountCustomEntity = SourceUserID,
        UrlCustomEntity = RequestURL,
        IPCustomEntity = DestinationIP,
        DNSCustomEntity = DNSName
    ),
    (DnsEvents
    | where Name in~ (domains)
    | project TimeGenerated, Computer, IPAddresses, Name, ClientIP, Type
    | extend
        DNSName = Name,
        Host = Computer,
        Alert = 'APT Actors Exploiting Static Machine Keys in Public-Facing Web Application'
    | extend
        timestamp = TimeGenerated,
        HostCustomEntity = Host,
        DNSCustomEntity = DNSName,
        IPCustomEntity = IPAddresses
    ),
    (Event
    | where Source == "Microsoft-Windows-Sysmon"
    | where EventID == 3
    | extend EvData = parse_xml(EventData)
    | extend EventDetail = EvData.DataItem.EventData.Data
    | extend
        SourceIP = tostring(EventDetail.[9].["#text"]),
        DestinationIP = tostring(EventDetail.[14].["#text"]),
        Image = EventDetail.[4].["#text"]
    | where Image has_any (file_path1) or Image has_any (file_path3)
    | project
        TimeGenerated,
        SourceIP,
        DestinationIP,
        Image,
        UserName,
        Computer,
        EventDetail,
        Type
    | extend
        timestamp = TimeGenerated,
        AccountCustomEntity = UserName,
        ProcessCustomEntity = tostring(split(Image, '\\', -1)[-1]),
        HostCustomEntity = Computer,
        IPCustomEntity = DestinationIP,
        Alert = 'APT Actors Exploiting Static Machine Keys in Public-Facing Web Application'
    ),  
    (DeviceNetworkEvents
    | where (RemoteUrl has_any (domains))
        or (InitiatingProcessSHA256 in (sha256Hashes) and InitiatingProcessFolderPath has_any (file_path1))
        or InitiatingProcessFolderPath has_any (file_path3)
    | project
        TimeGenerated,
        ActionType,
        DeviceId,
        DeviceName,
        InitiatingProcessAccountDomain,
        InitiatingProcessAccountName,
        InitiatingProcessCommandLine,
        InitiatingProcessFolderPath,
        InitiatingProcessId,
        InitiatingProcessParentFileName,
        InitiatingProcessFileName,
        RemoteIP,
        RemoteUrl,
        LocalIP,
        Type
    | extend
        timestamp = TimeGenerated,
        IPCustomEntity = RemoteIP,
        HostCustomEntity = DeviceName,
        Alert = 'SOURGUM IOC detected',
        UrlCustomEntity =RemoteUrl
    ),
    (AzureDiagnostics
    | where ResourceType == "AZUREFIREWALLS"
    | where Category == "AzureFirewallDnsProxy"
    | project TimeGenerated, Resource, msg_s, Type
    | parse msg_s with "DNS Request: " ClientIP ":" ClientPort " - " QueryID " " Request_Type " " Request_Class " " Request_Name ". " Request_Protocol " " Request_Size " " EDNSO_DO " " EDNS0_Buffersize " " Responce_Code " " Responce_Flags " " Responce_Size " " Response_Duration
    | where Request_Name has_any (domains)
    | extend
        timestamp = TimeGenerated,
        DNSName = Request_Name,
        IPCustomEntity = ClientIP,
        Alert = 'APT Actors Exploiting Static Machine Keys in Public-Facing Web Application'
    ),
    (Event
    | where Source == "Microsoft-Windows-Sysmon"
    | where EventID == 1
    | extend EvData = parse_xml(EventData)
    | extend EventDetail = EvData.DataItem.EventData.Data
    | parse EventDetail with * 'SHA256=' SHA256 '",' *
    | extend Image = EventDetail.[4].["#text"], CommandLine = EventDetail.[10].["#text"]
    | where (SHA256 has_any (sha256Hashes) and Image has_any (file_path1))
        or (Image has_any (file_path3))
        or (CommandLine has_any (file_path3))
        or (CommandLine has_any (file_path1))
        or (CommandLine has 'reg add' and CommandLine has_any (reg_key) and CommandLine has_any (file_path2)) 
    | project
        TimeGenerated,
        EventDetail,
        UserName,
        Computer,
        Type,
        Source,
        SHA256,
        CommandLine,
        Image
    | extend
        Type = strcat(Type, ": ", Source),
        Alert = 'APT Actors Exploiting Static Machine Keys in Public-Facing Web Application'
    | extend
        timestamp = TimeGenerated,
        HostCustomEntity = Computer,
        AccountCustomEntity = UserName,
        ProcessCustomEntity = tostring(split(Image, '\\', -1)[-1]),
        AlgorithmCustomEntity = "SHA256",
        FileHashCustomEntity = SHA256
    ),
    (DeviceRegistryEvents
    | where RegistryKey has_any (reg_key) and RegistryValueData has_any (file_path2)
    | project
        TimeGenerated,
        ActionType,
        DeviceId,
        DeviceName,
        InitiatingProcessAccountDomain,
        InitiatingProcessAccountName,
        InitiatingProcessCommandLine,
        InitiatingProcessFolderPath,
        InitiatingProcessId,
        InitiatingProcessParentFileName,
        InitiatingProcessFileName,
        InitiatingProcessSHA256,
        Type 
    | extend
        timestamp = TimeGenerated,
        HostCustomEntity = DeviceName,
        AccountCustomEntity = InitiatingProcessAccountName,
        ProcessCustomEntity = InitiatingProcessFileName,
        AlgorithmCustomEntity = "SHA256",
        FileHashCustomEntity = InitiatingProcessSHA256,
        Alert = 'APT Actors Exploiting Static Machine Keys in Public-Facing Web Application'
    ),
    (DeviceProcessEvents
    | where  (InitiatingProcessCommandLine has_any (file_path1))
        or (InitiatingProcessCommandLine has_any (file_path3))
        or (InitiatingProcessCommandLine has 'reg add' and InitiatingProcessCommandLine has_any (reg_key) and InitiatingProcessCommandLine has_any (file_path2))
        or (InitiatingProcessFolderPath has_any (file_path1))
        or (InitiatingProcessFolderPath has_any (file_path3))
        or (FolderPath has_any (file_path1))
        or (FolderPath has_any (file_path3))
    | project
        TimeGenerated,
        ActionType,
        DeviceId,
        DeviceName,
        InitiatingProcessAccountDomain,
        InitiatingProcessAccountName,
        InitiatingProcessCommandLine,
        InitiatingProcessFolderPath,
        InitiatingProcessId,
        InitiatingProcessParentFileName,
        InitiatingProcessFileName,
        InitiatingProcessSHA256,
        FolderPath,
        Type
    | extend
        timestamp = TimeGenerated,
        HostCustomEntity = DeviceName,
        AccountCustomEntity = InitiatingProcessAccountName,
        ProcessCustomEntity = InitiatingProcessFileName,
        AlgorithmCustomEntity = "SHA256",
        FileHashCustomEntity = InitiatingProcessSHA256,
        Alert = 'APT Actors Exploiting Static Machine Keys in Public-Facing Web Application'
    ),
    (DeviceFileEvents
    | where  (InitiatingProcessSHA256 has_any (sha256Hashes) and InitiatingProcessFolderPath has_any (file_path1))
        or (InitiatingProcessFolderPath has_any (file_path3))
        or (FolderPath has_any (file_path1))
        or (FolderPath has_any (file_path3))
        or (InitiatingProcessCommandLine has_any (file_path1))
        or (InitiatingProcessCommandLine has_any (file_path3))
    | project
        TimeGenerated,
        ActionType,
        DeviceId,
        DeviceName,
        InitiatingProcessAccountDomain,
        InitiatingProcessAccountName,
        InitiatingProcessCommandLine,
        InitiatingProcessFolderPath,
        InitiatingProcessId,
        InitiatingProcessParentFileName,
        InitiatingProcessFileName,
        RequestAccountName,
        RequestSourceIP,
        InitiatingProcessSHA256,
        FolderPath,
        Type
    | extend
        timestamp = TimeGenerated,
        HostCustomEntity = DeviceName,
        AccountCustomEntity = RequestAccountName,
        ProcessCustomEntity = InitiatingProcessFileName,
        AlgorithmCustomEntity = "SHA256",
        FileHashCustomEntity = InitiatingProcessSHA256,
        Alert = 'APT Actors Exploiting Static Machine Keys in Public-Facing Web Application'
    ),
    (DeviceEvents
    | where  (InitiatingProcessCommandLine has_any (file_path1))
        or (InitiatingProcessCommandLine has_any (file_path3))
        or (InitiatingProcessCommandLine has 'reg add' and InitiatingProcessCommandLine has_any (reg_key) and InitiatingProcessCommandLine has_any (file_path2))
        or (InitiatingProcessFolderPath has_any (file_path1))
        or (InitiatingProcessFolderPath has_any (file_path3))
        or (FolderPath has_any (file_path1))
        or (FolderPath has_any (file_path3))
    | project
        TimeGenerated,
        ActionType,
        DeviceId,
        DeviceName,
        InitiatingProcessAccountDomain,
        InitiatingProcessAccountName,
        InitiatingProcessCommandLine,
        InitiatingProcessFolderPath,
        InitiatingProcessId,
        InitiatingProcessParentFileName,
        InitiatingProcessFileName,
        InitiatingProcessSHA256,
        FolderPath,
        Type
    | extend
        CommandLine = InitiatingProcessCommandLine,
        Alert = 'APT Actors Exploiting Static Machine Keys in Public-Facing Web Application'
    | extend
        timestamp = TimeGenerated,
        HostCustomEntity = DeviceName,
        AccountCustomEntity = InitiatingProcessAccountName,
        ProcessCustomEntity = InitiatingProcessFileName,
        AlgorithmCustomEntity = "SHA256",
        FileHashCustomEntity = InitiatingProcessSHA256
    ),
    (SecurityEvent
    | where EventID == 4688
    | where (CommandLine has_any (file_path1))
        or (CommandLine has_any (file_path3))
        or (CommandLine has 'reg add' and CommandLine has_any (reg_key) and CommandLine has_any (file_path2))
        or (NewProcessName has_any (file_path1))
        or (NewProcessName has_any (file_path3))
        or (ParentProcessName has_any (file_path1))
        or (ParentProcessName has_any (file_path3))
    | project
        TimeGenerated,
        Computer,
        NewProcessName,
        ParentProcessName,
        Account,
        NewProcessId,
        Type
    | extend
        timestamp = TimeGenerated,
        HostCustomEntity = Computer,
        AccountCustomEntity = Account,
        ProcessCustomEntity = NewProcessName,
        Alert = 'APT Actors Exploiting Static Machine Keys in Public-Facing Web Application'
    )
)