Salt Typhoon / UAT-9244 — TernDoor · PeerTime · BruteEntry

Looks for: the TernDoor loader, payload, and driver filenames being written outside System32. Accomplishes: catches delivery/staging at step 2 before execution.

// HUNT: TernDoor loader/payload/driver file write
// MITRE: T1574.002, T1014 | CONF: high  FP: low  COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten telemetry
// FALSE POSITIVES: none expected (filenames are implant-specific)
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\(WSPrint\.(exe|dll|sys)|BugSplatRc64\.dll)$/i
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, SHA256HashData, ContextBaseFileName], limit=200)

Looks for: any execution or write of the seven Talos Windows hashes. Accomplishes: deterministic confirmation of TernDoor presence.

// HUNT: TernDoor hash match (Windows set)
// MITRE: T1574.002, T1055, T1014 | CONF: high  FP: low  COST: low
// REQUIRES: SHA256HashData on process/file events
#event_simpleName=/^(ProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(SHA256HashData, values=[
    "711d9427ee43bc2186b9124f31cba2db5f54ec9a0d56dc2948e1a4377bada289",
    "3c098a687947938e36ab34b9f09a11ebd82d50089cbfe6e237d810faa729f8ff",
    "f36913607356a32ea106103387105c635fa923f8ed98ad0194b66ec79e379a02",
    "a5e413456ce9fc60bb44d442b72546e9e4118a61894fbe4b5c56e4dfad6055e3",
    "075b20a21ea6a0d2201a12a049f332ecc61348fc0ad3cfee038c6ad6aa44e744",
    "1f5635a512a923e98a90cdc1b2fb988a2da78706e07e419dae9e1a54dd4d682b",
    "2d2ca7d21310b14f5f5641bbf4a9ff4c3e566b1fbbd370034c6844cedc8f0538"])
| table([@timestamp, aid, ComputerName, UserName, #event_simpleName, ImageFileName, SHA256HashData], limit=max)

Looks for: msiexec.exe making outbound 443 connections with no install package on the command line. Accomplishes: catches TernDoor's injected payload (step 3) when the C2 IP is unknown.

// HUNT: msiexec outbound 443 with no MSI argument
// MITRE: T1055, T1071.001 | CONF: medium  FP: medium  COST: low-medium
// REQUIRES: NetworkConnectIP4 + ProcessRollup2 command line
// TUNING: exclude msiexec with .msi // /i // /x // /update; exclude deployment hosts
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^msiexec\.exe$/i
| RemotePort=443
| join(query={
    #event_simpleName=ProcessRollup2
    | ImageFileName=/\\msiexec\.exe$/i
    | CommandLine!=/(\.msi|\s\/i\b|\s\/x\b|\s\/update)/i
  }, field=[aid, ContextProcessId_decimal], key=[aid, TargetProcessId_decimal], include=[CommandLine, ParentBaseFileName])
| table([@timestamp, aid, ComputerName, RemoteAddressIP4, RemotePort, CommandLine, ParentBaseFileName], limit=200)

Looks for: schtasks /create registering the WSPrint task to run from ProgramData as SYSTEM at startup. Accomplishes: catches persistence (step 4) — one of the highest-fidelity signals.

// HUNT: WSPrint onstart SYSTEM scheduled task creation
// MITRE: T1053.005 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 command line
#event_simpleName=ProcessRollup2
| ImageFileName=/\\schtasks\.exe$/i
| CommandLine=/\/create/i
| CommandLine=/WSPrint/i
| CommandLine=/(onstart|ProgramData\\WSPrint)/i
| table([@timestamp, aid, ComputerName, UserName, CommandLine, ParentBaseFileName], limit=200)

Looks for: a Run key whose value resolves into ProgramData\WSPrint. Accomplishes: catches the secondary login persistence the actor sets alongside the task.

// HUNT: Run-key persistence -> ProgramData\WSPrint
// MITRE: T1547.001 | CONF: high  FP: low  COST: low
// REQUIRES: AsepValueUpdate / RegGenericValueUpdate
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName=/\\CurrentVersion\\Run$/i
| RegStringValue=/ProgramData\\WSPrint/i
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue], limit=200)

Looks for: writes to SD / Index under Schedule\TaskCache\Tree\. Accomplishes: catches the task-hiding evasion (step 5), including for renamed variants of the WSPrint task.

// HUNT: TaskCache SD/Index manipulation (hidden task)
// MITRE: T1562.001, T1564 | CONF: medium  FP: medium  COST: low
// REQUIRES: RegGenericValueUpdate
// TUNING: exclude sanctioned RMM/MDM parents; focus on SD deletions + Index=0
#event_simpleName=/^Reg.*Update$/
| RegObjectName=/\\Schedule\\TaskCache\\Tree\\/i
| RegValueName=/^(SD|Index)$/
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue], limit=200)

Looks for: a service whose image path references WSPrint.sys, or registry artifacts of the VMTool device. Accomplishes: catches the process-killer driver (step 6) used for defense evasion.

// HUNT: TernDoor driver service install
// MITRE: T1543.003, T1014 | CONF: high  FP: low  COST: low
// REQUIRES: registry service-key telemetry
// FALSE POSITIVES: none expected (driver name is implant-specific)
#event_simpleName=/^(RegGenericValueUpdate|RegSystemConfigValueUpdate)$/
| RegObjectName=/\\Services\\/i
| RegStringValue=/(WSPrint\.sys|\\Device\\VMTool)/i
| table([@timestamp, aid, ComputerName, RegObjectName, RegValueName, RegStringValue], limit=200)

Looks for: any host connecting to the confirmed C2 IPs and the suspected-infra set. Accomplishes: catches C2 (steps 3/7) across all three implants.

// HUNT: UAT-9244 C2 / infra outbound
// MITRE: T1071.001, T1573 | CONF: high (confirmed) / medium (suspected)  FP: low  COST: low
// REQUIRES: NetworkConnectIP4
// TUNING: confirmed IPs -> alert; suspected IPs -> investigate only
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=[
    "154.205.154.82","207.148.121.95","207.148.120.52","212.11.64.105",
    "185.196.10.38","185.196.10.247",
    "149.28.25.33","154.205.154.194","154.205.154.65","154.205.154.70",
    "154.223.21.130","154.223.21.194","158.247.238.240","216.238.112.222",
    "216.238.123.242","216.238.94.37","38.54.125.134","38.60.199.34",
    "45.32.106.94","45.77.34.194","45.77.41.141","47.76.100.159",
    "64.190.113.170","64.95.10.253"])
| table([@timestamp, aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=max)

Looks for: resolution of the PeerTime C2 / remote-location domains. Accomplishes: catches PeerTime hosts that still use DNS bootstrap before falling back to BitTorrent peers.

// HUNT: PeerTime C2 domain resolution
// MITRE: T1071.001, T1095 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest
#event_simpleName=DnsRequest
| DomainName=/^(bloopencil\.net|xtibh\.com|xcit76\.com)$/i
| table([@timestamp, aid, ComputerName, DomainName, ContextBaseFileName], limit=200)

Looks for: a single Linux host opening many outbound connections to SSH/Postgres/Tomcat ports across many distinct destinations. Accomplishes: catches a host turned into a BruteEntry relay (step 9). Requires the Linux sensor.

// HUNT: BruteEntry ORB outbound scanning
// MITRE: T1110, T1090, T1584.005 | CONF: medium  FP: medium  COST: medium
// REQUIRES: Linux NetworkConnectIP4
// TUNING: exclude known scanner aids; raise distinct-IP threshold to fit environment
#event_simpleName=NetworkConnectIP4
| event_platform=Lin
| in(RemotePort, values=["22","5432","8080","8443"])
| groupBy([aid, ComputerName, RemotePort], function=count(RemoteAddressIP4, distinct=true, as=distinct_targets))
| distinct_targets >= 50
| sort(distinct_targets, order=desc)

Looks for: Docker or BusyBox being used to launch/copy an ELF from a temp/world-writable path. Accomplishes: catches PeerTime/BruteEntry living-off-the-land staging (step 8). Requires the Linux sensor.

// HUNT: PeerTime/BruteEntry Linux LOLbin staging
// MITRE: T1059.004, T1610, T1036 | CONF: medium  FP: medium  COST: medium
// REQUIRES: Linux ProcessRollup2 command line
// TUNING: exclude CI/build hosts; require temp-path execution
#event_simpleName=ProcessRollup2
| event_platform=Lin
| CommandLine=/((\bdocker\b\s+[^\s]*\/(tmp|dev\/shm|var\/tmp)\/)|(\bbusybox\b\s+cp\b)|(\bpgrep\b\s+\/(tmp|var)\/))/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName], limit=200)

# 1) Microsoft Vulnerable Driver Blocklist ON
reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Config" /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 1 /f
# 2) HVCI / Memory Integrity ON (requires reboot)
# HVCI needs VBS enabled as well -- the scenario key alone is inert and the
# control silently never activates. All three values are required.
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v RequirePlatformSecurityFeatures /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v Enabled /t REG_DWORD /d 1 /f
# Prereqs: UEFI + Secure Boot + virtualization extensions. Reboot required.
# PILOT FIRST -- incompatible legacy drivers can block boot under HVCI.
# Verify AFTER reboot (SecurityServicesRunning must contain 2):
#   (Get-CimInstance Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard).SecurityServicesRunning
# Rollback: set both DeviceGuard values and the scenario Enabled back to 0, then reboot.
#   If the host will not boot, revert from Safe Mode or WinRE.
# 3) Verify after reboot
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
  Select-Object -ExpandProperty SecurityServicesRunning   # expect 2 (HVCI) present

# Scheduled task
Get-ScheduledTask -TaskName "WSPrint" -ErrorAction SilentlyContinue | Format-List *
# Run key
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue |
  Select-Object * | Where-Object { $_ -match "WSPrint" }
# Artifacts + driver service
Get-ChildItem "C:\ProgramData\WSPrint" -Force -ErrorAction SilentlyContinue
Get-CimInstance Win32_SystemDriver | Where-Object { $_.PathName -match "WSPrint\.sys" }

# --- Eradicate (only after confirmation + IR sign-off) ---
# Unregister-ScheduledTask -TaskName "WSPrint" -Confirm:$false
# Remove-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "Default" -Force
# sc.exe stop WSPrint ; sc.exe delete WSPrint
# Remove-Item "C:\ProgramData\WSPrint" -Recurse -Force

# SSH: keys only, no root
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
systemctl restart sshd
apt-get install -y fail2ban && systemctl enable --now fail2ban
# Postgres: do not listen on the world
sed -i "s/^#\?listen_addresses.*/listen_addresses = 'localhost'/" /etc/postgresql/*/main/postgresql.conf
systemctl restart postgresql
# Tomcat: remove manager app if unused
rm -rf $CATALINA_HOME/webapps/manager $CATALINA_HOME/webapps/host-manager

from falconpy import IOC
falcon = IOC(client_id="...", client_secret="...", base_url="https://api.crowdstrike.com")  # set per cloud
indicators = (
  [{"type":"sha256","value":h,"action":"prevent","severity":"high","platforms":["windows","linux"],
    "applied_globally":True,"description":"UAT-9244 (Talos)"} for h in [
      "711d9427ee43bc2186b9124f31cba2db5f54ec9a0d56dc2948e1a4377bada289",
      "2d2ca7d21310b14f5f5641bbf4a9ff4c3e566b1fbbd370034c6844cedc8f0538"]]   # extend with §10 set
  + [{"type":"domain","value":d,"action":"detect","severity":"high","applied_globally":True,
      "description":"UAT-9244 C2"} for d in ["bloopencil.net","xtibh.com","xcit76.com"]]
  + [{"type":"ipv4","value":ip,"action":"detect","severity":"high","applied_globally":True,
      "description":"UAT-9244 C2"} for ip in ["154.205.154.82","207.148.121.95","207.148.120.52","212.11.64.105","185.196.10.38","185.196.10.247"]]
)
print(falcon.indicator_create(body={"indicators":indicators,"comment":"UAT-9244 hunt pack"}))