Shadow Campaigns Activity Detection
This rule detects several suspicious activities potentially related to the 'Shadow Campaigns' threat actor, including the 'Diaoyu loader' and 'ShadowGuard' malware. It identifies processes created with specific command-line arguments (e.g., 'pic1.png', 'padeqav', 'DiaoYu', 'admin-bar-sprite', 'raw.githubusercontent.com' with 'WordPress') and network connections to known C2 domains (e.g., 'gouvn.me', 'dog3rj.tech', 'zamstats.me', 'msonline.help', 'pickupweb.me', 'servgate.me', 'abwxjp5.me', 'brackusi0n.live', 'emezonhe.me', 'pr0fu5a.me', 'q74vn.live', 'zrheblirsy.me'). The rule also looks for connections to 'mega.nz' or 'mega.co.nz' initiated by common office applications or browsers, which could indicate data exfiltration or download of malicious content. Additionally, it identifies processes created with command-line arguments related to specific security software (e.g., 'Avp.exe', 'SentryEye.exe', 'EPSecurityService.exe', 'SentinelUI.exe', 'NortonSecurity.exe'), which might indicate attempts to disable or interfere with security products. Further, it detects processes created with command-line arguments indicative of Java-based web shells or tunneling tools (e.g., 'rce.jar', 'crowd' and 'jar', 'Behinder', 'Neo-reGeorg', 'Godzilla', 'reGeorg') when initiated by web server processes. Finally, it looks for specific strings ('kill -900', 'kill -901', 'swsecret') in security logs, which could be related to specific attack techniques or tools.
Microsoft Sentinel (KQL)
