check-for-shadowhammer-activity-implant

Description

This query was originally published in the threat analytics report, ShadowHammer supply chain attack Operation ShadowHammer was an attack against ASUS computer hardware, using the company's own update infrastructure to deliver malware to the company's products. The campaign ran from June to November, 2018. ASUS has since responded with updates that protect their Live Update system, and diagnostic tools to check affected systems. The following query checks for activity associated with the ShadowHammer implant or container over the past 30 days. References: https://www.vice.com/en_us/article/pan9wn/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers https://www.asus.com/News/hqfgVUyZ6uyAyJe1

Query · kql

// Event types that may be associated with the implant or container
union DeviceProcessEvents , DeviceNetworkEvents , DeviceFileEvents , DeviceImageLoadEvents 
| where Timestamp > ago(30d)
// File SHAs for implant and container
| where InitiatingProcessSHA1 in("e01c1047001206c52c87b8197d772db2a1d3b7b4",
"e005c58331eb7db04782fdf9089111979ce1406f", "69c08086c164e58a6d0398b0ffdcb957930b4cf2")
Raw source check-for-shadowhammer-activity-implant · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: fb6f89ae-4af3-4c37-8f12-d719e882e8a5
name: check-for-shadowhammer-activity-implant
description: |
  This query was originally published in the threat analytics report, ShadowHammer supply chain attack
  Operation ShadowHammer was an attack against ASUS computer hardware, using the company's own update infrastructure to deliver malware to the company's products. The campaign ran from June to November, 2018. ASUS has since responded with updates that protect their Live Update system, and diagnostic tools to check affected systems.
  The following query checks for activity associated with the ShadowHammer implant or container over the past 30 days.
  References:
  https://www.vice.com/en_us/article/pan9wn/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers
  https://www.asus.com/News/hqfgVUyZ6uyAyJe1
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
  - DeviceNetworkEvents
  - DeviceFileEvents
  - DeviceImageLoadEvents
tactics:
- Execution
- Persistence
- Command and control
query: |
  // Event types that may be associated with the implant or container
  union DeviceProcessEvents , DeviceNetworkEvents , DeviceFileEvents , DeviceImageLoadEvents 
  | where Timestamp > ago(30d)
  // File SHAs for implant and container
  | where InitiatingProcessSHA1 in("e01c1047001206c52c87b8197d772db2a1d3b7b4",
  "e005c58331eb7db04782fdf9089111979ce1406f", "69c08086c164e58a6d0398b0ffdcb957930b4cf2")

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.