Analytics Story: China-Nexus Threat Activity

Updated Date: 2026-05-13 ID: ac8b8e7c-ed27-428b-871f-ceb9400c733a Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, Chinese state-nexus adversaries known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss. This includes TTPs for groups such as APT31, APT40, and more. Also covers UNC groups such as UNC3886.

Why it matters

As described by Crowdstrike, Chinese state-nexus threat group or adversary are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Internal Horizontal Port Scan NMAP Top 20	Network Service Discovery	TTP
Executables Or Script Creation In Temp Path	Masquerading	Anomaly
Linux Preload Hijack Library Calls	Dynamic Linker Hijacking	TTP
Windows Gdrive Binary Activity	Exfiltration Over Web Service	TTP
Registry Keys Used For Persistence	Registry Run Keys / Startup Folder	TTP
Windows Query Registry Browser List Application	Query Registry	Anomaly
Malicious PowerShell Process - Execution Policy Bypass	PowerShell	Anomaly
Windows SnappyBee Create Test Registry	Modify Registry	TTP
Linux Gdrive Binary Activity	Exfiltration Over Web Service	TTP
Windows Credentials from Password Stores Chrome Login Data Access	Query Registry	Anomaly
Internal Horizontal Port Scan	Network Service Discovery	TTP
Linux Auditd Install Kernel Module Using Modprobe Utility	Kernel Modules and Extensions	Anomaly
Detect Rare Executables	User Execution	Anomaly
Windows Curl Download to Suspicious Path	Ingress Tool Transfer	TTP
Linux Common Process For Elevation Control	Setuid and Setgid	Hunting
Executables Or Script Creation In Suspicious Path	Masquerading	Anomaly
WinEvent Scheduled Task Created Within Public Path	Scheduled Task	TTP
Windows Unusual SysWOW64 Process Run System32 Executable	Break Process Trees	Anomaly
Detect Renamed PSExec	Service Execution	Hunting
Windows Suspicious Process File Path	Match Legitimate Resource Name or Location, Create or Modify System Process	TTP
Linux Auditd Possible Access To Credential Files	/etc/passwd and /etc/shadow	Anomaly
Remote Process Instantiation via WMI	Windows Management Instrumentation	TTP
ESXi VM Discovery	Virtual Machine Discovery	TTP
Windows Replication Through Removable Media	Replication Through Removable Media	TTP
Linux File Creation In Init Boot Directory	RC Scripts	Anomaly
Windows Access Token Manipulation SeDebugPrivilege	Create Process with Token	Anomaly
Windows Unsigned DLL Side-Loading	DLL	Anomaly
PowerShell 4104 Hunting	PowerShell	Hunting
Suspicious Scheduled Task from Public Directory	Scheduled Task	Anomaly
Linux Iptables Firewall Modification	Disable or Modify System Firewall	Anomaly
Windows Anonymous Pipe Activity	Inter-Process Communication	Hunting
Suspicious Regsvr32 Register Suspicious Path	Regsvr32	TTP
Linux Auditd File Permission Modification Via Chmod	Linux and Mac Permissions	Anomaly
Windows Credentials from Password Stores Chrome LocalState Access	Query Registry	Anomaly
Windows Service Creation on Remote Endpoint	Windows Service	TTP
ESXi Firewall Disabled	Disable or Modify System Firewall	TTP
Linux Service File Created In Systemd Directory	Systemd Timers	Anomaly
Detect Renamed WinRAR	Archive via Utility	Hunting
WinEvent Scheduled Task Created to Spawn Shell	Scheduled Task	TTP
Linux Sudoers Tmp File Creation	Sudo and Sudo Caching	Anomaly
Windows Archive Collected Data via Rar	Archive via Utility	Anomaly
Detect Large ICMP Traffic	Non-Application Layer Protocol	TTP
ESXi VIB Acceptance Level Tampering	Disable or Modify Tools	TTP
Linux Auditd Possible Access To Sudoers File	Sudo and Sudo Caching	Anomaly
Non Chrome Process Accessing Chrome Default Dir	Credentials from Web Browsers	Anomaly
Scheduled Task Deleted Or Created via CMD	Scheduled Task	Anomaly
Windows Service Creation Using Registry Entry	Services Registry Permissions Weakness	Anomaly
Linux Install Kernel Module Using Modprobe Utility	Kernel Modules and Extensions	Anomaly
Windows Process Execution From ProgramData	Match Legitimate Resource Name or Location	Hunting
Windows Svchost.exe Parent Process Anomaly	Break Process Trees	Anomaly
Linux Auditd Nopasswd Entry In Sudoers File	Sudo and Sudo Caching	Anomaly
Linux NOPASSWD Entry In Sudoers File	Sudo and Sudo Caching	Anomaly
Internal Vertical Port Scan	Network Service Discovery	TTP
Windows Unsigned MS DLL Side-Loading	Boot or Logon Autostart Execution, DLL	Anomaly
Linux Medusa Rootkit	Rootkit, Credentials	TTP
Linux Possible Access To Credential Files	/etc/passwd and /etc/shadow	Anomaly
ESXi Malicious VIB Forced Install	vSphere Installation Bundles	TTP
Windows Unsigned DLL Side-Loading In Same Process Path	DLL	TTP
Windows Service Created with Suspicious Service Path	Service Execution	TTP
Linux Auditd Preload Hijack Library Calls	Dynamic Linker Hijacking	TTP
Non Firefox Process Access Firefox Profile Dir	Credentials from Web Browsers	Anomaly
Windows Credential Access From Browser Password Store	Query Registry	Anomaly
ESXi Sensitive Files Accessed	/etc/passwd and /etc/shadow, Data from Local System	TTP
Windows Suspicious VMWare Tools Child Process	Command and Scripting Interpreter	TTP
Linux Possible Access To Sudoers File	Sudo and Sudo Caching	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
AWS CloudWatchLogs VPCflow	AWS	`aws:cloudwatchlogs:vpcflow`	`aws_cloudwatchlogs_vpcflow`
Cisco Secure Firewall Threat Defense Connection Event	Other	`cisco:sfw:estreamer`	`not_applicable`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon for Linux EventID 1	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4663	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Linux Auditd Syscall	Linux	`auditd`	`auditd`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
Windows Event Log Security 4698	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Linux Auditd Proctitle	Linux	`auditd`	`auditd`
VMWare ESXi Syslog	Other	`vmw-syslog`	`vmware:esxlog`
Sysmon for Linux EventID 11	Linux	`sysmon:linux`	`Syslog:Linux-Sysmon/Operational`
Windows Event Log Security 4703	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Sysmon EventID 7	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Sysmon EventID 18	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 17	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Palo Alto Network Traffic	Network	`pan:traffic`	`not_applicable`
Cisco Secure Access Firewall	Other	`cisco:cloud_security:firewall`	`cisco_secure_access:firewall`
Linux Auditd Path	Linux	`auditd`	`auditd`
Linux Auditd Cwd	Linux	`auditd`	`auditd`
Windows Event Log System 7045	Windows	`XmlWinEventLog`	`XmlWinEventLog:System`
Linux Auditd Execve	Linux	`auditd`	`auditd`

References

Source: GitHub | Version: 4