Analytics Story: Scattered Spider

Date: 2025-07-29 ID: 3df97513-d898-4168-927a-ed3595d6ea41 Author: Michael Haag, Splunk Product: Splunk Enterprise Security

Description

Detects tactics, techniques, and procedures (TTPs) associated with Scattered Spider (UNC3944, Octo Tempest, Storm-0875), a sophisticated cybercriminal group targeting large enterprises through advanced social engineering and legitimate tool abuse. This analytic story provides comprehensive detection coverage for their complete attack chain, from initial social engineering campaigns through data exfiltration and ransomware deployment. The group is known for bypassing traditional security controls by abusing legitimate remote access tools like TeamViewer, AnyDesk, and Ngrok, while conducting sophisticated vishing operations to compromise IT helpdesks and steal MFA tokens.

Recent intelligence from the July 2025 CISA advisory reveals significant evolution in their capabilities, including deployment of DragonForce ransomware, enhanced Snowflake database targeting for rapid data exfiltration, and advanced cloud infrastructure exploitation. The analytics in this story detect their signature behaviors including MFA bombing attacks, unauthorized remote access tool deployment, cloud API abuse, credential harvesting with tools like Mimikatz, and their unique operational security practices of monitoring victim communications to evade detection. Coverage includes process monitoring, network analytics, cloud API detection, and behavioral correlation rules designed to identify the subtle indicators that traditional signature-based tools miss while providing actionable intelligence for incident response teams.

Why it matters

Scattered Spider represents a critical threat to enterprise security, utilizing sophisticated social engineering to bypass technical controls and gain initial access to large organizations. Unlike traditional cybercriminals who rely on malware, this group exploits human psychology and abuses legitimate administrative tools, making detection extremely challenging. Their attacks result in significant business disruption through data theft, ransomware deployment, and operational downtime. Recent evolution includes advanced cloud targeting capabilities and VMware ESXi encryption, posing escalating risks to critical infrastructure and cloud-dependent organizations. Organizations must implement behavioral detection capabilities and enhanced user training to defend against these advanced persistent social engineering campaigns.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Attacker Tools On Endpoint	OS Credential Dumping, Match Legitimate Resource Name or Location, Active Scanning	TTP
BITSAdmin Download File	BITS Jobs, Ingress Tool Transfer	TTP
Clear Unallocated Sector Using Cipher App	File Deletion	TTP
Detect Mimikatz With PowerShell Script Block Logging	OS Credential Dumping, PowerShell	TTP
Detect Remote Access Software Usage File	Remote Access Tools	Anomaly
Detect Remote Access Software Usage FileInfo	Remote Access Tools	Anomaly
Detect Remote Access Software Usage Process	Remote Access Tools	Anomaly
Detect Remote Access Software Usage Registry	Remote Access Tools	Anomaly
Exchange PowerShell Module Usage	PowerShell	TTP
Malicious PowerShell Process - Encoded Command	Obfuscated Files or Information	Hunting
PowerShell 4104 Hunting	PowerShell	Hunting
Recon Using WMI Class	Gather Victim Host Information, PowerShell	Anomaly
Sc exe Manipulating Windows Services	Windows Service	TTP
Scheduled Task Deleted Or Created via CMD	Scheduled Task	TTP
Script Execution via WMI	Windows Management Instrumentation	TTP
Sdelete Application Execution	File Deletion, Data Destruction	TTP
Suspicious Scheduled Task from Public Directory	Scheduled Task	Anomaly
Suspicious wevtutil Usage	Clear Windows Event Logs	TTP
Windows Credential Access From Browser Password Store	Query Registry	Anomaly
Windows Mimikatz Binary Execution	OS Credential Dumping	TTP
Windows MSExchange Management Mailbox Cmdlet Usage	PowerShell	Anomaly
Windows Password Managers Discovery	Password Managers	Anomaly
Windows PowerShell ScheduleTask	Scheduled Task, PowerShell	Anomaly
Cisco Secure Firewall - Remote Access Software Usage Traffic	Remote Access Tools	Anomaly
Detect Remote Access Software Usage DNS	Remote Access Tools	Anomaly
Detect Remote Access Software Usage Traffic	Remote Access Tools	Anomaly

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
Cisco Secure Firewall Threat Defense Connection Event	N/A	`cisco:sfw:estreamer`	`not_applicable`
CrowdStrike ProcessRollup2	N/A	`crowdstrike:events:sensor`	`crowdstrike`
Palo Alto Network Traffic	Network	`pan:traffic`	`screenconnect_palo_traffic`
Powershell Script Block Logging 4104	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-PowerShell/Operational`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 22	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4663	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

Source: GitHub | Version: 1