GitHub Repo

Analytics Story: CISA AA23-347A

Updated Date: 2026-05-13 ID: 257a2f28-fcbe-4226-8d1f-957880098331 Author: Teoderick Contreras, Rod Soto, Splunk Product: Splunk Enterprise Security

Description

Leverage searches that allow you to detect and investigate unusual activities that might be related to the SVR cyber activity tactics and techniques. While SVR followed a similar playbook in each compromise, they also adjusted to each operating environment and not all presented steps or actions below were executed on every host.

Why it matters

SVR cyber operations pose a persistent threat to public and private organizations' networks globally. Since 2013, cybersecurity companies and governments have reported on SVR operations targeting victim networks to steal confidential and proprietary information. A decade later, the authoring agencies can infer a long-term targeting pattern aimed at collecting, and enabling the collection of, foreign intelligence, a broad concept that for Russia encompasses information on the politics, economics, and military of foreign states; science and technology; and foreign counterintelligence. The SVR also conducts cyber operations targeting technology companies that enable future cyber operations. The SVR's recent operation has targeted networks hosting TeamCity servers, further underscoring its persistent focus on technology companies. By leveraging CVE-2023-42793, a vulnerability within a software development program, the SVR seeks to gain access to victims, potentially compromising numerous software developers' networks. JetBrains responded to this threat by issuing a patch in mid-September 2023, limiting the SVR's ability to exploit Internet-accessible TeamCity servers lacking the necessary updates. Despite this mitigation, the SVR has yet to utilize its acquired access to software developers' networks for breaching customer systems. It appears that the SVR is still in the preparatory stages of its operation.

Windows Common Abused Cmd Shell Risk Behavior

1| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count FROM datamodel=Risk.All_Risk
2  WHERE source IN ("*Windows Cmdline Tool Execution From Non-Shell Process*", "*Windows System Network Config Discovery Display DNS*", "*Local Account Discovery With Wmic*", "*Windows Group Discovery Via Net*", "*Windows Create Local Administrator Account Via Net*", "*Windows User Discovery Via Net*", "*Icacls Deny Command*", "*ICACLS Grant Command*", "*Windows Proxy Via Netsh*", "*Processes launching netsh*", "*Disabling Firewall with Netsh*", "*Windows System Network Connections Discovery Netsh*", "*Network Connection Discovery With Arp*", "*Windows System Discovery Using ldap Nslookup*", "*Windows System Shutdown CommandLine*")
3  BY All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic
4| `drop_dm_object_name(All_Risk)`
5| `security_content_ctime(firstTime)`
6| `security_content_ctime(lastTime)`
7| where source_count >= 4
8| `windows_common_abused_cmd_shell_risk_behavior_filter`

Detections

Name ▲▼ Technique ▲▼ Type ▲▼
Windows DISM Remove Defender Disable or Modify Tools TTP
Windows Service Stop Win Updates Service Stop Anomaly
Windows Mimikatz Crypto Export File Extensions Steal or Forge Authentication Certificates Anomaly
Network Connection Discovery With Netstat System Network Connections Discovery Hunting
Domain Controller Discovery with Nltest Remote System Discovery TTP
Disable UAC Remote Restriction Bypass User Account Control TTP
Windows Suspicious Process File Path Match Legitimate Resource Name or Location, Create or Modify System Process TTP
Services Escalate Exe Abuse Elevation Control Mechanism TTP
Windows WMI Process Call Create Windows Management Instrumentation Hunting
Windows PowerView Constrained Delegation Discovery Remote System Discovery TTP
Suspicious Scheduled Task from Public Directory Scheduled Task Anomaly
Windows Account Discovery With NetUser PreauthNotRequire Account Discovery Hunting
Windows Modify Registry Disable Restricted Admin Modify Registry TTP
Rubeus Kerberos Ticket Exports Through Winlogon Access Pass the Ticket TTP
Windows Disable Windows Group Policy Features Through Registry Modify Registry Anomaly
Unload Sysmon Filter Driver Disable or Modify Tools TTP
Windows Account Discovery for None Disable User Account Local Account Hunting
Windows Excessive Disabled Services Event Disable or Modify Tools TTP
Rubeus Command Line Parameters Pass the Ticket, Kerberoasting, AS-REP Roasting TTP
Disable Defender Enhanced Notification Disable or Modify Tools TTP
Executables Or Script Creation In Temp Path Masquerading Anomaly
Get ADUser with PowerShell Domain Account Hunting
Disable ETW Through Registry Disable or Modify Tools TTP
Windows Possible Credential Dumping LSASS Memory TTP
Windows Disable Notification Center Modify Registry Anomaly
Executables Or Script Creation In Suspicious Path Masquerading Anomaly
Windows Scheduled Task Created Via XML Scheduled Task Anomaly
Get ADUser with PowerShell Script Block Domain Account Hunting
Windows PowerView Unconstrained Delegation Discovery Remote System Discovery TTP
Remote Process Instantiation via WMI Windows Management Instrumentation TTP
Windows Sensitive Registry Hive Dump Via CommandLine Security Account Manager TTP
Disable AMSI Through Registry Disable or Modify Tools TTP
JetBrains TeamCity RCE Attempt Exploit Public-Facing Application TTP
Windows Account Discovery for Sam Account Name Account Discovery Anomaly
Windows Access Token Manipulation SeDebugPrivilege Create Process with Token Anomaly
Windows DisableAntiSpyware Registry Disable or Modify Tools TTP
Windows Impair Defenses Disable Win Defender Auto Logging Disable or Modify Tools Anomaly
Get DomainUser with PowerShell Domain Account TTP
Windows Process Commandline Discovery Process Discovery Hunting
System User Discovery With Whoami System Owner/User Discovery Hunting
Windows PowerView SPN Discovery Kerberoasting TTP
Disable Windows Behavior Monitoring Disable or Modify Tools TTP
Windows Mimikatz Binary Execution OS Credential Dumping TTP
Windows Modify Registry Disable Windows Security Center Notif Modify Registry Anomaly
Windows Modify Registry Disabling WER Settings Modify Registry TTP
Short Lived Scheduled Task Scheduled Task TTP
Disabling FolderOptions Windows Feature Disable or Modify Tools TTP
Windows Disable Windows Event Logging Disable HTTP Logging IIS Components, Disable or Modify Windows Event Log Anomaly
Get ADUserResultantPasswordPolicy with Powershell Password Policy Discovery TTP
Windows Modify Registry Suppress Win Defender Notif Modify Registry Anomaly
Windows Scheduled Task with Highest Privileges Scheduled Task TTP
Detect Credential Dumping through LSASS access LSASS Memory TTP
Windows Remote Create Service Windows Service Anomaly
Windows System User Privilege Discovery System Owner/User Discovery Hunting
Windows Domain Account Discovery Via Get-NetComputer Domain Account Anomaly
Windows Hunting System Account Targeting Lsass LSASS Memory Hunting
PowerShell 4104 Hunting PowerShell Hunting
Disabled Kerberos Pre-Authentication Discovery With Get-ADUser AS-REP Roasting TTP
Windows Service Creation on Remote Endpoint Windows Service TTP
Windows Modify Registry Disable WinDefender Notifications Modify Registry TTP
Scheduled Task Deleted Or Created via CMD Scheduled Task Anomaly
Get DomainUser with PowerShell Script Block Domain Account TTP
Disable Defender Spynet Reporting Disable or Modify Tools TTP
Disable Defender Submit Samples Consent Feature Disable or Modify Tools TTP
Suspicious wevtutil Usage Clear Windows Event Logs TTP
PowerShell Domain Enumeration PowerShell TTP
Windows Eventlog Cleared Via Wevtutil Clear Windows Event Logs Anomaly
Disable Windows SmartScreen Protection Disable or Modify Tools TTP
Windows Service Initiation on Remote Endpoint Windows Service TTP
Windows Cmdline Tool Execution From Non-Shell Process JavaScript Anomaly
Windows Modify Registry DisableSecuritySettings Modify Registry TTP
CMD Carry Out String Command Parameter Windows Command Shell Hunting
Get ADUserResultantPasswordPolicy with Powershell Script Block Password Policy Discovery TTP
Registry Keys Used For Persistence Registry Run Keys / Startup Folder TTP
Windows Archive Collected Data via Powershell Archive Collected Data Anomaly
Windows Modify Registry Disable Win Defender Raw Write Notif Modify Registry Anomaly
AdsiSearcher Account Discovery Domain Account TTP
Access LSASS Memory for Dump Creation LSASS Memory TTP
Windows Modify Registry No Auto Update Modify Registry Anomaly
Windows LSA Secrets NoLMhash Registry LSA Secrets TTP
Disable Defender BlockAtFirstSeen Feature Disable or Modify Tools TTP
WinRM Spawning a Process Exploit Public-Facing Application TTP
Disable Security Logs Using MiniNt Registry Modify Registry TTP
Disable Logs Using WevtUtil Clear Windows Event Logs TTP
Remote WMI Command Attempt Windows Management Instrumentation TTP
Windows Service Created with Suspicious Service Name Service Execution Anomaly
Mimikatz PassTheTicket CommandLine Parameters Pass the Ticket TTP
Windows Service Creation Using Registry Entry Services Registry Permissions Weakness Anomaly
Non Chrome Process Accessing Chrome Default Dir Credentials from Web Browsers Anomaly
ETW Registry Disabled Trusted Developer Utilities Proxy Execution, Disable or Modify Tools TTP
Services LOLBAS Execution Process Spawn Windows Service TTP
Windows Non-System Account Targeting Lsass LSASS Memory TTP
Detect Mimikatz With PowerShell Script Block Logging OS Credential Dumping, PowerShell TTP
Windows Credentials from Password Stores Chrome Extension Access Query Registry Anomaly
Windows Service Created with Suspicious Service Path Service Execution TTP
Windows Registry Entries Exported Via Reg Query Registry Hunting
Non Firefox Process Access Firefox Profile Dir Credentials from Web Browsers Anomaly
WinEvent Scheduled Task Created Within Public Path Scheduled Task TTP
Windows Known GraphicalProton Loaded Modules DLL Anomaly

Data Sources

Name ▲▼ Platform ▲▼ Sourcetype ▲▼ Source ▲▼
Windows Event Log Security 4688 Windows icon Windows XmlWinEventLog XmlWinEventLog:Security
Sysmon EventID 1 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
CrowdStrike ProcessRollup2 Other crowdstrike:events:sensor crowdstrike
Windows Event Log System 7040 Windows icon Windows XmlWinEventLog XmlWinEventLog:System
Sysmon EventID 11 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 13 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Powershell Script Block Logging 4104 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
Sysmon EventID 10 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Suricata Other suricata not_applicable
Windows Event Log Security 4703 Windows icon Windows XmlWinEventLog XmlWinEventLog:Security
Windows Event Log Security 4698 Windows icon Windows XmlWinEventLog XmlWinEventLog:Security
Windows Event Log Security 4699 Windows icon Windows XmlWinEventLog XmlWinEventLog:Security
Windows Event Log System 7045 Windows icon Windows XmlWinEventLog XmlWinEventLog:System
Windows Event Log Security 4663 Windows icon Windows XmlWinEventLog XmlWinEventLog:Security
Sysmon EventID 7 Windows icon Windows XmlWinEventLog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

References

Source: GitHub | Version: 4