Analytics Story: Earth Estries

Date: 2025-01-27 ID: 608135e2-eb6b-41bf-9f0c-b12f41a1376a Author: Teoderick Contreras, Splunk Product: Splunk Enterprise Security

Description

Leverage searches that allow you to detect and investigate unusual activities that might relate to Earth Estries, a sophisticated threat actor targeting various sectors with espionage-focused campaigns. Monitor for indicators such as spear-phishing emails, unauthorized access attempts, and lateral movement within your network. Investigate anomalous data exfiltration patterns and command-and-control (C2) traffic consistent with known tactics, techniques, and procedures (TTPs) of this group. Combining threat intelligence with advanced monitoring tools helps identify potential Earth Estries activity early, enabling swift response to mitigate risks effectively.

Why it matters

Earth Estries is a highly capable threat actor known for conducting targeted espionage campaigns against diverse sectors, including government, technology, and critical infrastructure. This group leverages sophisticated tactics such as spear-phishing, credential theft, and exploiting software vulnerabilities to gain initial access. Once inside a network, Earth Estries demonstrates expertise in lateral movement, privilege escalation, and covert data exfiltration. Their use of custom malware and command-and-control (C2) infrastructures highlights their adaptability. Detecting their activity requires robust threat intelligence and proactive monitoring of unusual behaviors and network anomalies.

Detections

Name ▲▼ Technique ▲▼ Type ▲▼
Any Powershell DownloadFile PowerShell, Ingress Tool Transfer TTP
Detect Rare Executables User Execution Anomaly
Detect Renamed PSExec Service Execution Hunting
Detect Renamed WinRAR Archive via Utility Hunting
Executables Or Script Creation In Suspicious Path Masquerading Anomaly
Executables Or Script Creation In Temp Path Masquerading Anomaly
Linux Auditd File Permission Modification Via Chmod Linux and Mac File and Directory Permissions Modification Anomaly
Linux Auditd Nopasswd Entry In Sudoers File Sudo and Sudo Caching Anomaly
Linux Auditd Possible Access To Credential Files /etc/passwd and /etc/shadow Anomaly
Linux Auditd Possible Access To Sudoers File Sudo and Sudo Caching Anomaly
Linux Auditd Preload Hijack Library Calls Dynamic Linker Hijacking TTP
Linux Common Process For Elevation Control Setuid and Setgid Hunting
Linux NOPASSWD Entry In Sudoers File Sudo and Sudo Caching Anomaly
Linux Possible Access To Credential Files /etc/passwd and /etc/shadow Anomaly
Linux Possible Access To Sudoers File Sudo and Sudo Caching Anomaly
Linux Preload Hijack Library Calls Dynamic Linker Hijacking TTP
Linux Sudoers Tmp File Creation Sudo and Sudo Caching Anomaly
Malicious PowerShell Process - Execution Policy Bypass PowerShell Anomaly
Non Chrome Process Accessing Chrome Default Dir Credentials from Web Browsers Anomaly
Non Firefox Process Access Firefox Profile Dir Credentials from Web Browsers Anomaly
PowerShell 4104 Hunting PowerShell Hunting
Registry Keys Used For Persistence Registry Run Keys / Startup Folder TTP
Remote Process Instantiation via WMI Windows Management Instrumentation TTP
Scheduled Task Deleted Or Created via CMD Scheduled Task TTP
Suspicious Regsvr32 Register Suspicious Path Regsvr32 TTP
Suspicious Scheduled Task from Public Directory Scheduled Task Anomaly
Windows Access Token Manipulation SeDebugPrivilege Create Process with Token Anomaly
Windows Anonymous Pipe Activity Inter-Process Communication Hunting
Windows Archive Collected Data via Rar Archive via Utility Anomaly
Windows Credential Access From Browser Password Store Query Registry Anomaly
Windows Credentials from Password Stores Chrome LocalState Access Query Registry Anomaly
Windows Credentials from Password Stores Chrome Login Data Access Query Registry Anomaly
Windows Curl Download to Suspicious Path Ingress Tool Transfer TTP
Windows Process Execution From ProgramData Match Legitimate Name or Location Anomaly
Windows Query Registry Browser List Application Query Registry Anomaly
Windows Replication Through Removable Media Replication Through Removable Media TTP
Windows Service Created with Suspicious Service Path Service Execution TTP
Windows Service Creation on Remote Endpoint Windows Service TTP
Windows Service Creation Using Registry Entry Services Registry Permissions Weakness Anomaly
Windows SnappyBee Create Test Registry Modify Registry TTP
Windows Suspicious Process File Path Create or Modify System Process, Match Legitimate Name or Location TTP
Windows Svchost.exe Parent Process Anomaly Break Process Trees Anomaly
Windows Unsigned DLL Side-Loading DLL Side-Loading Anomaly
Windows Unsigned DLL Side-Loading In Same Process Path DLL Side-Loading TTP
Windows Unsigned MS DLL Side-Loading DLL Side-Loading, Boot or Logon Autostart Execution Anomaly
Windows Unusual SysWOW64 Process Run System32 Executable Break Process Trees Anomaly
WinEvent Scheduled Task Created to Spawn Shell Scheduled Task TTP
WinEvent Scheduled Task Created Within Public Path Scheduled Task TTP

Data Sources

Name ▲▼ Platform ▲▼ Sourcetype ▲▼ Source ▲▼
CrowdStrike ProcessRollup2 N/A crowdstrike:events:sensor crowdstrike
Linux Auditd Execve Linux icon Linux auditd auditd
Linux Auditd Path Linux icon Linux auditd auditd
Linux Auditd Proctitle Linux icon Linux auditd auditd
Powershell Script Block Logging 4104 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
Sysmon EventID 1 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 11 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 13 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 17 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 18 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon EventID 7 Windows icon Windows xmlwineventlog XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
Sysmon for Linux EventID 1 Linux icon Linux sysmon:linux Syslog:Linux-Sysmon/Operational
Sysmon for Linux EventID 11 Linux icon Linux sysmon:linux Syslog:Linux-Sysmon/Operational
Windows Event Log Security 4663 Windows icon Windows xmlwineventlog XmlWinEventLog:Security
Windows Event Log Security 4688 Windows icon Windows xmlwineventlog XmlWinEventLog:Security
Windows Event Log Security 4698 Windows icon Windows xmlwineventlog XmlWinEventLog:Security
Windows Event Log Security 4703 Windows icon Windows xmlwineventlog XmlWinEventLog:Security
Windows Event Log System 7045 Windows icon Windows xmlwineventlog XmlWinEventLog:System

References

Source: GitHub | Version: 1