{"id":18655,"date":"2025-06-13T11:02:47","date_gmt":"2025-06-13T08:02:47","guid":{"rendered":"https:\/\/oberig-it.com\/uncategorized\/frontline-intel-pinpointing-grus-ttps-in-the-recent-campaign\/"},"modified":"2025-07-01T11:26:36","modified_gmt":"2025-07-01T08:26:36","slug":"frontline-intel-pinpointing-grus-ttps-in-the-recent-campaign","status":"publish","type":"post","link":"https:\/\/oberig-it.com\/en\/articles\/frontline-intel-pinpointing-grus-ttps-in-the-recent-campaign\/","title":{"rendered":"Frontline Intel: Pinpointing GRU\u2019s TTPs in the Recent Campaign"},"content":{"rendered":"

Joint Cybersecurity Advisory (CSA) AA25-141A<\/span><\/a> exposes a sustained and multifaceted cyber-espionage campaign attributed to Russia\u2019s GRU Unit 26165, also known as APT28<\/span><\/a>, Fancy Bear, Forest Blizzard, and a host of other monikers. Since early 2022, this group has relentlessly targeted Western logistics and technology companies involved in supporting Ukraine, exploiting both legacy and zero-day vulnerabilities to gain access and siphon sensitive data. Their operations span credential harvesting, spearphishing, exploitation of public-facing services, and even the compromise of surveillance systems used to track aid shipments.<\/p>\n

This blog unpacks the key findings of the advisory and demonstrates how Logpoint\u2019s platform equips security teams with the visibility and tools to detect, investigate, and mitigate such threats across every stage of the attack lifecycle.<\/p>\n

Introduction<\/h4>\n

Russia\u2019s GRU Unit 26165, also known by several aliases, including APT28, is a name synonymous with cyber espionage, having cast a long shadow over the geopolitical landscape for over two decades. Its target sectors, government institutions, militaries, and security organizations, clearly reflect its motives, which are stealing sensitive information for political and military gain. In our previous coverage of APT28, also known as Forest Blizzard, we explored their long-standing espionage capabilities, custom malware arsenal, and disruptive operations across geopolitical hotspots. Our past research outlined how Logpoint empowers defenders to detect this adversary\u2019s toolsets, especially focusing on GooseEgg, multiple credential harvesting techniques.<\/p>\n

In this latest update, our focus shifts to GRU\u2019s recent campaigns targeting Western logistics entities and technology companies, as detailed in the CISA Advisory<\/span><\/a>. These attacks are part of a broader post-invasion escalation by GRU Unit 26165, reflecting a strategic effort to compromise supply chains supporting Ukraine. Since the onset of the Ukraine conflict, cyber operations have become a strategic extension of geopolitical aggression. These operations demonstrate a refined and persistent effort to infiltrate organizations that support Ukrainian aid and defense logistics<\/p>\n

This blog focuses specifically on post-compromise tactics, techniques, and procedures (TTPs), rather than discussing the initial infection vectors. GRU doesn\u2019t always rely on flashy malware; instead, they move quietly, using built-in tools like PowerShell, PsExec, or RDP to explore the network, harvest credentials, and dig deeper into high-value systems.<\/p>\n

What makes these actions dangerous also makes them detectable: they leave behind patterns. Whether it\u2019s suspicious mailbox permission changes, zipped data staged for exfiltration, or logs suddenly being wiped clean, these activities generate signals that defenders can pick up on, with the right visibility. Our goal here is to highlight post-compromise behaviors that are not just common but practical to detect actions that defenders can catch in the real world with good logging, smart rules, and a solid understanding of what normal looks like. For the sake of clarity, we will refer to GRU Unit 26165 as GRU in the following blog.<\/p>\n

Detection<\/h4>\n

Required log sources:<\/p>\n

To follow up on below threat hunting and detection approach below log sources must be configured.<\/p>\n

    \n
  1. Windows
    \n– Process creation with command-line auditing should be enabled.
    \n– Registry Auditing<\/li>\n
  2. Windows Sysmon
    \n– To get started, you can     use our sysmon baseline<\/span><\/a> configuration.<\/li>\n
  3. NDR<\/li>\n
  4. Office365<\/span><\/a><\/li>\n<\/ol>\n

    Initial Access TTPs Discovery<\/h3>\n

    Outlook NTLM vulnerability (CVE-2023-23397)<\/h4>\n

    GRU\u2019s abused an Outlook NTLM flaw: CVE-2023-23397<\/span><\/a> by sending crafted calendar invites that silently harvest NTLM hashes and user credentials. Check out our blog<\/span><\/a> for a deeper dive into this technique and guidance on how to spot it in your environment.<\/p>\n

    Roundcube CVEs<\/h4>\n

    Adversaries have exploited several Roundcube flaws, namely CVE-2020-12641<\/span><\/a>, CVE-2020-35730<\/span><\/a>, and CVE-2021-44026<\/span><\/a>, to launch arbitrary shell commands via Visual Basic scripts. To catch this behavior in your environment, use the Suspicious File Execution Using Wscript or Cscript alert, which flags any unexpected uses of these script hosts.<\/p>\n

      \n
    1. label<\/span>=“Process”<\/span> label<\/span>=Create<\/li>\n
    2. “process”<\/span> IN [“*\\wscript.exe”<\/span>, “*\\cscript.exe”<\/span>]<\/li>\n
    3. command IN [“*.jse*”<\/span>, “*.vbe*”<\/span>, “*.js*”<\/span>, “*.vba*”<\/span>, “*.vbs*”<\/span>]<\/li>\n
    4. -path<\/span> IN [“C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\Health Service State\\*”<\/span>]<\/li>\n
    5. -command<\/span> IN [“*.json*”<\/span>, “*C:\\Windows\\system32\\slmgr.vbs*-rearm*”<\/span>]<\/li>\n<\/ol>\n

      \"Logpoint<\/p>\n

      Exploitation of WinRAR vulnerability (CVE-2023-38831)<\/h4>\n

      GRU has exploited a WinRAR vulnerability (CVE-2023-38831<\/span><\/a>) to gain initial access. To spot this in your environment, look for WinRAR spawning unexpected child processes\u2014for example:<\/p>\n

        \n
      1. label<\/span>=“Process”<\/span> label<\/span>=Create parent_process<\/span>=“*\\winRAR.exe”<\/span><\/li>\n
      2. “process”<\/span> IN [“*\\cmd.exe”<\/span>, “*\\cscript.exe”<\/span>, “*\\mshta.exe”<\/span>, “*\\powershell.exe”<\/span>,<\/li>\n
      3. “*\\pwsh.exe”<\/span>, “*\\regsvr32.exe”<\/span>, “*\\rundll32.exe”<\/span>, “*\\wscript.exe”<\/span>]<\/li>\n<\/ol>\n

        \"Logpoint<\/p>\n

        This alert will flag any unusual script or shell hosts launched by WinRAR. For a deep dive into the CVE-2023-38831 flaw and additional detection guidance, check out our blog<\/span><\/a>:<\/p>\n

        Post-Compromise TTPs Detection<\/h4>\n

        Initial access techniques are countless and constantly evolving\u2014catching every one of them as they hit is like chasing shadows. What really matters is what happens after the attacker lands. By shining a spotlight on post-compromise behaviors\u2014privilege escalation, credential harvesting, lateral movement, data exfiltration\u2014you\u2019ll catch adversaries when they\u2019re most exposed, and stop the attack before real damage is done.<\/p>\n

        Impacket and Psexec Detection<\/h4>\n

        Adversaries frequently lean on built-in Windows tools and popular open-source frameworks, like Impacket and PsExec, to hop laterally through a network. PsExec\u2019s default behavior is to drop an 8-character executable and spin it up as a service with a 4-character name. You can spot this activity with below rule<\/p>\n

          \n
        1. norm_id<\/span>=WinServer label<\/span>=Service label<\/span>=Install label<\/span>=Successful<\/li>\n
        2. | process regex(“(?P<new_file_name>[A-Za-z]{8}\\.exe)”<\/span>, file)<\/li>\n
        3. | process regex(“(?P<new_service>[A-Za-z]{4})”<\/span>, service)<\/li>\n
        4. |filter new_file_name<\/span>=*<\/li>\n
        5. |filter new_service<\/span>=*<\/li>\n
        6. |chart count() by host, new_file_name, new_service, image_file<\/li>\n<\/ol>\n

          \"Logpoint<\/p>\n

          PsExec sets up a named pipe (usually prefixed with RemCom_) to shuttle commands and their output between hosts. You can spot this from Sysmon logs by looking for pipe creation events. This will catch any RemCom\u2010style pipes or the common stdin\/stdout\/stderr pipes PsExec uses.<\/p>\n

            \n
          1. norm_id<\/span>=WindowsSysmon event_id IN [17, 18<\/span>]<\/li>\n
          2. pipe IN<\/span> [“*RemCom*”<\/span>, “*-stdin”<\/span>, “*-stderr”<\/span>, “*-stdout”<\/span>]<\/li>\n<\/ol>\n

            Most Impacket tools ultimately invoke the command prompt to execute the payload. They\u2019ll often be launched by services or admin processes. Below hunting query can be used to detect such events.<\/p>\n

              \n
            1. label<\/span>=“Process”<\/span> label<\/span>=Create<\/li>\n
            2. command<\/span>=“*cmd.exe*”<\/span> command<\/span>=“*\/c*”<\/span> command<\/span>=“*&1*”<\/span><\/li>\n
            3. (parent_process In [“*\\wmiprvse.exe”<\/span>, “*\\mmc.exe”<\/span>, “*\\explorer.exe”<\/span>, “*\\services.exe”<\/span>]<\/li>\n
            4. command<\/span>=“*\/Q*”<\/span> )<\/li>\n
            5. OR (parent_command IN [“*svchost.exe -k netsvcs*”<\/span>, “*taskeng.exe*”<\/span>]<\/li>\n
            6. command<\/span>=“*Windows\\Temp\\*”<\/span>)<\/li>\n<\/ol>\n

              \"Logpoint<\/p>\n

              Active Directory Database Dump via NTDSUTIL<\/h4>\n

              After moving laterally (often over RDP) onto a Domain Controller, GRU operators use Windows\u2019 built-in ntdsutil.exe to extract the NTDS.dit database. CISA describes the exact steps they take:<\/p>\n

                \n
              1. C:\\Windows\\System32\\ntdsutil.exe “activate instance ntds”<\/span> ifm “create full C:\\temp\\<3-letter-folder>”<\/span> quit quit<\/li>\n<\/ol>\n

                For detection, you can leverage our built-in \u201cActive Directory Database Dump Attempt\u201d alert\u2014it\u2019s specifically tuned to catch NTDS.dit dump attempts.<\/p>\n

                  \n
                1. label<\/span>=“Process”<\/span> label<\/span>=Create<\/li>\n
                2. ((“process<\/span>” IN [“*\\NTDSDump.exe”<\/span>, “*\\NTDSDumpEx.exe”<\/span>,“*\\ntdsutil.exe”<\/span>]) OR (command<\/span>=“*ntds.dit*”<\/span> command<\/span>=“*system.hiv*”<\/span>) OR (command<\/span>=“*NTDSgrab.ps1*”<\/span>))<\/li>\n
                3. OR (command<\/span>=“*ac i ntds*”<\/span> command<\/span>=“*create full*”<\/span>)<\/li>\n
                4. OR (command<\/span>=“*\/c copy *”<\/span> command<\/span>=“*\\windows\\ntds\\ntds.dit*”<\/span>)<\/li>\n
                5. OR (command<\/span>=“*activate instance ntds*”<\/span> command<\/span>=“*create full*”<\/span>)<\/li>\n
                6. OR (command<\/span>=“*powershell*”<\/span> command<\/span>=“*ntds.dit*”<\/span>)<\/li>\n
                7. OR (command<\/span>=“*ntds.dit*”<\/span> “process”<\/span> IN [“*\\apache*”<\/span>, “*\\tomcat*”<\/span>, “*\\AppData\\*”<\/span>, “*\\Temp\\*”<\/span>, “*\\Public\\*”<\/span>, “*\\PerfLogs\\*”<\/span>] OR “parent_process”<\/span> IN [“*\\apache*”<\/span>, “*\\tomcat*”<\/span>, “*\\AppData\\*”<\/span>, “*\\Temp\\*”<\/span>, “*\\Public\\*”<\/span>, “*\\PerfLogs\\*”<\/span>])<\/li>\n<\/ol>\n

                  \"SIEM<\/p>\n

                  Post\u2013AD Database Dump Activities<\/h4>\n

                  After dumping the NTDS.dit, GRU\u2019s operators employed two key tools, ADExplorer and Certipy, to harvest and exfiltrate directory data. They also installed Python on compromised hosts to run Certipy.<\/p>\n

                  ADExplorer (a Sysinternals utility) can take \u201csnapshots\u201d of the AD hierarchy. You can detect its use with our alert ADExplorer Snapshot Detection.<\/p>\n

                    \n
                  1. label<\/span>=“Process”<\/span> label<\/span>=Create<\/li>\n
                  2. (“process”<\/span>=“*\\adexplorer.exe”<\/span> OR “file”<\/span>=“AdExp”<\/span>)<\/li>\n
                  3. command=“*snapshot*” <\/span><\/li>\n<\/ol>\n

                    Certipy Execution Detection<\/h4>\n

                    Certipy\u2019s command set (e.g., auth, find, relay, shadow), combined with its BloodHound export flags, makes its usage distinct. Detection can be done using an alert, Certipy Tool Execution for AD CS Abuse.<\/p>\n

                      \n
                    1. label<\/span>=“Process”<\/span> label<\/span>=Create<\/li>\n
                    2. (“process”<\/span>=“*\\Certipy.exe”<\/span> OR file<\/span>=“Certipy.exe”<\/span> OR description<\/span>=“*Certipy*”<\/span>)<\/li>\n
                    3. OR<\/li>\n
                    4. (command IN [“* auth *”<\/span>, “* find *”<\/span>, “* forge *”<\/span>, “* relay *”<\/span>, “* req *”<\/span>, “* shadow *”<\/span>]<\/li>\n
                    5. command IN [“* -bloodhound*”<\/span>, “* -ca-pfx *”<\/span>, “* -dc-ip *”<\/span>, “* -kirbi*”<\/span>, “* -old-bloodhound*”<\/span>, “* -pfx *”<\/span>, “* -target*”<\/span>, “* -username *”<\/span>, “* -vulnerable*”<\/span>, “*auth -pfx*”<\/span>, “*shadow auto*”<\/span>, “*shadow list*”<\/span>])<\/li>\n<\/ol>\n

                      Or a following hunt query can be utilized for Certipy\u2019s activities.<\/p>\n

                        \n
                      1. label<\/span>=”Process” label<\/span>=Create<\/li>\n
                      2. (“process”<\/span>=“*\\Certipy.exe”<\/span> OR file<\/span>=“Certipy.exe”<\/span> OR description<\/span>=“*Certipy*”<\/span>)<\/li>\n
                      3. OR<\/li>\n
                      4. (command IN [“* auth *”<\/span>, “* find *”<\/span>, “* forge *”<\/span>, “* relay *”<\/span>, “* req *”<\/span>, “* shadow *”<\/span>]<\/li>\n
                      5. command IN [“* -bloodhound*”<\/span>, “* -ca-pfx *”<\/span>, “* -dc-ip *”<\/span>, “* -kirbi*”<\/span>, “* -old-bloodhound*”<\/span>, “* -pfx *”<\/span>, “* -target*”<\/span>, “* -username *”<\/span>, “* -vulnerable*”<\/span>, “*auth -pfx*”<\/span>, “*shadow auto*”<\/span>, “*shadow list*”<\/span>])<\/li>\n<\/ol>\n

                        Python Installation Hunting<\/h4>\n

                        Since Certipy runs under Python, spotting unexpected Python installs or launches can pre-empt its use. For example, detect MSI-based installs or direct Python executables:<\/p>\n

                          \n
                        1. label<\/span>=Install label<\/span>=Application label<\/span>=Successful rule_description<\/span>=“*python*”<\/span><\/li>\n
                        2. | chart count() by user,host,rule_description<\/li>\n<\/ol>\n

                          \"SOAR<\/p>\n

                          Mailbox Folder Permission Modification and Multiple Mailbox Access<\/h4>\n

                          According to the Polish Cybercommand blog<\/span><\/a>, the adversary modified folder permissions across mailboxes to gain unfettered access to all users\u2019 mail. In Exchange Online, you can detect this behavior with these alerts:<\/p>\n

                          Exchange Mailbox Folder Delegation Configured<\/h4>\n
                            \n
                          1. norm_id<\/span>=Office365<\/li>\n
                          2. ((action IN [“Add-MailBoxFolderPermission”, “Set-MailBoxFolderPermission”<\/span>] -identity<\/span> IN [“*:\\Calendar”<\/span>, “*:\\Contacts”<\/span>])<\/li>\n
                          3. OR<\/li>\n
                          4. (action IN [“AddFolderPermissions”<\/span>, “ModifyFolderPermissions”<\/span>]<\/li>\n
                          5. item_parent_folder_member_rights<\/span>=“*ReadAny*”<\/span> -item_parent_folder_name<\/span> IN [“Calendar”<\/span>, “Contacts”<\/span>]))<\/li>\n<\/ol>\n

                            \"buy<\/p>\n

                            \u0414\u043e\u0441\u0442\u0443\u043f \u0434\u043e \u0434\u0435\u043a\u0456\u043b\u044c\u043a\u043e\u0445 \u043f\u043e\u0448\u0442\u043e\u0432\u0438\u0445 \u0441\u043a\u0440\u0438\u043d\u044c\u043e\u043a Exchange \u0447\u0435\u0440\u0435\u0437 API \u0437\u0430 \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0439 \u043f\u0440\u043e\u043c\u0456\u0436\u043e\u043a \u0447\u0430\u0441\u0443<\/h4>\n
                              \n
                            1. norm_id<\/span>=Office365 action=“MailItemsAccessed”<\/span> user_type<\/span>=“Application”<\/span><\/li>\n
                            2. | process eval(“match=like(client_information, ‘Client=WebServices;ExchangeWebServices%’)”<\/span>)<\/li>\n
                            3. | process eval(“search_result=if(match) {return 1}<\/span><\/li>\n
                            4. else-if(target_application==’Microsoft Graph’) {return 1}<\/span><\/li>\n
                            5. else {return 0}”<\/span>)<\/li>\n
                            6. | filter search_result<\/span>=1<\/li>\n
                            7. | timechart distinct_count(upn) as user_mailbox_count, distinct_list(user) as user_list, distinct_list(source_address) as source_address by target_application every 10 minutes<\/li>\n
                            8. | filter user_mailbox_count > 5<\/li>\n<\/ol>\n

                              Defense Evasion<\/h4>\n

                              The GRU routinely used native Windows utilities like wevtutil to wipe event logs after gaining access or escalating privileges. This tactic helped them hide their tracks and delay detection during post-compromise activity.<\/p>\n

                              Detection can be done using an alert, Suspicious Eventlog Clear or Configuration Using Wevtutil Detected.<\/p>\n

                                \n
                              1. label<\/span>=“Process”<\/span> label<\/span>=Create<\/li>\n
                              2. (<\/li>\n
                              3. ((“process”<\/span> IN [“*\\powershell.exe”<\/span>,“*\\pwsh.exe*”<\/span>] command IN [“*Clear-EventLog*”<\/span>, “*Remove-EventLog*”<\/span>, “*Limit-EventLog*”<\/span>,“*Clear-WinEvent*”<\/span>])<\/li>\n
                              4. OR
                                \n(“process”<\/span>=“*\\wmic.exe”<\/span> command=“* ClearEventLog *”<\/span>))<\/li>\n
                              5. OR
                                \n(“process”<\/span>=“*\\wevtutil.exe”<\/span> command<\/span> IN [“*clear-log*”<\/span>, “* cl *”<\/span>, “*set-log*”<\/span>, “* sl *”<\/span>,“*lfn: “<\/span>])<\/li>\n
                              6. )<\/li>\n
                              7. -(parent_process IN [“C:\\Windows\\SysWOW64\\msiexec.exe”<\/span>,“C:\\Windows\\System32\\msiexec.exe”<\/span>] command=“* sl *”<\/span>)<\/li>\n<\/ol>\n

                                \"\"<\/p>\n

                                They have also exploited the way Windows loads DLLs<\/span><\/a> by planting malicious ones in directories that are searched first. This lets them execute code through trusted binaries, bypassing traditional security scans.<\/p>\n

                                Detection can be done using an alert, Safe DLL Search Mode Disabled.<\/p>\n

                                  \n
                                1. norm_id<\/span>=WindowSysmon event_id<\/span>=13<\/li>\n
                                2. target_object<\/span>=‘*\\CurrentControlSet\\Control\\Session Manager\\SafeDllSearchMode’<\/span><\/li>\n
                                3. detail<\/span>=“DWORD (0x00000000)”<\/span><\/li>\n<\/ol>\n

                                  Persistence Techniques<\/h4>\n

                                  GRU operators rely on tried-and-true persistence methods to maintain access, including scheduled tasks, Run-key modifications, and Startup folder payloads. Here\u2019s how to spot each:<\/p>\n

                                  Schedule Tasks<\/h4>\n

                                  You can leverage the Scheduled Task Creation Detected alert to catch every new scheduled task created in your environment.<\/p>\n

                                    \n
                                  1. (label<\/span>=“Process”<\/span> label<\/span>=Create “process”<\/span>=“*\\schtasks.exe”<\/span> command<\/span>=“* \/create *”<\/span> -user<\/span> IN EXCLUDED_USERS)<\/li>\n
                                  2. OR<\/li>\n
                                  3. (label<\/span>=“Registry”<\/span> label<\/span>=“Key”<\/span> label<\/span>=“Map” “target_object”<\/span>=“*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\*”<\/span> -target_object<\/span> IN [“*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows\\UpdateOrchestrator*”<\/span>] event_type<\/span>=CreateKey)<\/li>\n
                                  4. OR<\/li>\n
                                  5. (norm_id<\/span>=WinServer event_id<\/span>=4698<\/span><\/li>\n
                                  6. (-command IN [“*MpCmdRun.exe”<\/span>,“*msfeedssync.exe”<\/span>,“*usoclient.exe”<\/span>] OR (-task<\/span>=“\\CreateExplorerShellUnelevatedTask”<\/span> command=“*explorer.exe”<\/span>)))<\/li>\n<\/ol>\n

                                    Because the generic alert covers every new task (and can yield a high volume of results), you can instead use the Suspicious Scheduled Task Creation alert to pinpoint only those tasks originating from locations commonly abused by malware.<\/p>\n

                                      \n
                                    1. norm_id<\/span>=WinServer label<\/span>=Schedule label<\/span>=Task label<\/span>=Create<\/li>\n
                                    2. command IN [“*C:\\Users\\*”<\/span>, “*C:\\Windows\\Temp\\*”<\/span>, “*C:\\ProgramData\\*”<\/span>]<\/li>\n
                                    3. -command<\/span>=“C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\*” <\/span><\/li>\n<\/ol>\n

                                      According to CISA\u2019s IOC section, the threat actor created the scheduled task using an XML file so you can detect this specific technique with the Suspicious Scheduled Task Creation via Masqueraded XML File alert.<\/p>\n

                                        \n
                                      1. label<\/span>=“Process”<\/span> label<\/span>=Create “process”<\/span>=“*\\schtasks.exe”<\/span><\/li>\n
                                      2. command IN [“*\/create*”<\/span>, “*-create*”<\/span>] command IN [“*\/xml*”<\/span>, “*-xml*”<\/span>]<\/li>\n
                                      3. (-integrity_level<\/span>=system OR -integrity_label<\/span>=*system*)<\/li>\n
                                      4. -command<\/span> = *.xml*<\/li>\n
                                      5. ((-parent_process<\/span> IN [“*:\\ProgramData\\OEM\\UpgradeTool\\CareCenter_*\\BUnzip\\Setup_msi.exe”<\/span>,<\/li>\n
                                      6. “*:\\Program Files\\Axis Communications\\AXIS Camera Station\\SetupActions.exe”<\/span>,<\/li>\n
                                      7. “*:\\Program Files\\Axis Communications\\AXIS Device Manager\\AdmSetupActions.exe”<\/span>,<\/li>\n
                                      8. “*:\\Program Files (x86)\\Zemana\\AntiMalware\\AntiMalware.exe”<\/span>,<\/li>\n
                                      9. “*:\\Program Files\\Dell\\SupportAssist\\pcdrcui.exe”<\/span> ] )<\/li>\n
                                      10. OR (-parent_process<\/span> = “*\\rundll32.exe”<\/span> command = “*:\\\\WINDOWS\\\\Installer\\\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc”<\/span> ))<\/li>\n<\/ol>\n

                                        Autorun and Startup<\/h4>\n

                                        Adding entries to the Autorun registry keys or dropping payloads into the Startup folder is a widely abused persistence method\u2014used by both legitimate software and malware\u2014to launch programs at Windows startup. You can catch any of these changes with the Autorun Keys Modification Detected alert, which monitors registry writes and file events against the key Run locations and Startup directories.<\/p>\n

                                          \n
                                        1. label<\/span>=Registry label<\/span>=Set label=Value -event_type<\/span>=info<\/li>\n
                                        2. target_object IN [“*\\software\\Microsoft\\Windows\\CurrentVersion\\Run*”<\/span>,<\/li>\n
                                        3. “*\\software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit*”<\/span>,<\/li>\n
                                        4. “*\\software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell*”<\/span>,<\/li>\n
                                        5. “*\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run”<\/span>,<\/li>\n
                                        6. “*\\software\\Microsoft\\Windows NT\\CurrentVersion\\Windows*”<\/span>,<\/li>\n
                                        7. “*\\software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders*”<\/span>]<\/li>\n
                                        8. detail IN [“*C:\\Windows\\Temp\\*”<\/span>, “*C:\\$Recycle.bin\\*”<\/span>, “*C:\\Temp\\*”<\/span>,<\/li>\n
                                        9. “*C:\\Users\\Public\\*”<\/span>, “*\\C:ProgramData\\*”<\/span>, “*C:\\Users\\Default\\*”<\/span>, “*C:\\Users\\Desktop\\*”<\/span>,<\/li>\n
                                        10. “*\\AppData\\Local\\*”<\/span>, “*Public\\*”<\/span>, “*wscript*”<\/span>, “*cscript*”<\/span>, “*powershell.exe*”<\/span>]<\/li>\n
                                        11. -detail<\/span>=“*\\AppData\\Local\\Microsoft\\Teams\\Update.exe *” <\/span><\/li>\n<\/ol>\n

                                          Impact<\/h4>\n

                                          The GRU employs impact-focused techniques not to destroy systems outright, but rather to erase evidence, disrupt recovery, and maintain stealth during and after their operations. They utilize legitimate Windows utilities such as wevtutil.exe to clear event logs and vssadmin.exe to manipulate volume shadow copies, indicating preparations to disable backup and forensic recovery.<\/p>\n

                                          Detects use of system tools like vssadmin, wbadmin, or PowerShell to create or manipulate shadow copies, potentially for staging data or disabling recovery.<\/p>\n

                                            \n
                                          1. label<\/span>=“Process”<\/span> label<\/span>=Create<\/li>\n
                                          2. (( “process” IN [“*\\vssadmin.exe”<\/span>, “*\\wbadmin.exe”<\/span>, “*\\diskshadow.exe”<\/span>]<\/li>\n
                                          3. OR file IN [“VSSADMIN.EXE”<\/span>, “WBADMIN.EXE”<\/span>, “diskshadow.exe”<\/span>])<\/li>\n
                                          4. command IN [“*create*”<\/span>, “*shadow*”<\/span>, “*resize*”<\/span>, “*shadowstorage*”<\/span>, “*\/MaxSize=*”<\/span>])<\/li>\n
                                          5. OR (“process” IN<\/span> [“*\\powershell.exe”<\/span>, “*\\pwsh.exe”<\/span>]<\/li>\n
                                          6. command IN [“*Get-WmiObject*”<\/span>, “*gwmi*”, “*Get-CimInstance*”, “*gcim*”]<\/li>\n
                                          7. command<\/span>=”*Win32_ShadowCopy*”<\/li>\n
                                          8. command IN [“*Create()*”, “*CreateShadowCopy*”, “*Enable-ComputerRestore*”, “*Checkpoint-Computer*”])<\/li>\n<\/ol>\n

                                            Hunting Malware Families<\/h4>\n

                                            In this campaign, the GRU employed various malware families to perform essential post-compromise functions, such as persistence, credential theft, and data exfiltration. Notable among these were HEADLACE, a multi-stage backdoor recognized for its use of headless browser automation and discreet script execution, and MASEPIE, an exfiltration tool that has been previously observed in GRU operations aimed at Ukrainian interests.<\/p>\n

                                            HEADLACE Execution Traces hunting query<\/h4>\n

                                            Detects use of legitimate utilities with command-line patterns often associated with malicious activity, such as data staging, headless browser automation, or scheduled task creation<\/p>\n

                                              \n
                                            1. label<\/span>=“Process”<\/span> label<\/span>=Create command IN [“*headless-new -disable-gpu*”<\/span>, “*activate instance ntds*”<\/span> ,“*ssh -Nf*”<\/span> ,“*schtasks \/create \/xml*”<\/span>]<\/li>\n<\/ol>\n

                                              \"\"<\/p>\n

                                              HEADLACE Batch Script Artifact Hunting query<\/h4>\n

                                              Detects command-line patterns and batch scripting behavior used in GRU’s HEADLACE malware, including headless browser abuse, system recon, and deletion of local artifacts.<\/p>\n

                                                \n
                                              1. label<\/span>=“Process”<\/span> label<\/span>=Create<\/li>\n
                                              2. command IN [“*headless-new -disable-gpu*”<\/span>, “*chcp 65001*”<\/span>]<\/li>\n
                                              3. command IN [“*taskkill \/im msedge.exe \/f*”<\/span>, “*whoami*%programdata%*”<\/span>, “*timeout*”<\/span>, “*copy*%programdata%*”<\/span>,“*del \/q \/f *%programdata%*”<\/span>,“*del \/q \/f *%userprofile%\\Downloads\\*”<\/span>,“*del \/q \/f*”<\/span>]<\/li>\n<\/ol>\n

                                                Detection via Logpoint Muninn<\/h4>\n

                                                Logpoint\u2019s Network Detection and Response (NDR) Muninn can play a vital role in detecting and responding to post-compromise behaviors commonly employed by the GRU. While many of the group\u2019s techniques rely on built-in system tools and credential abuse, they also generate distinct network patterns that can be detected in real-time with the right behavioral analytics.<\/p>\n

                                                Some of the notifications listed below can be useful in detecting their presence in the network :<\/p>\n