Operation Wocao Activity - Security

Status: test
Severity: high
Log source: product windows, service security
Author: Florian Roth (Nextron Systems), frack113
Source: github.com/SigmaHQ/sigma

Detects activity mentioned in Operation Wocao report

Known false positives

Administrators that use checkadmin.exe tool to enumerate local administrators

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task `T1059.001` Command and Scripting Interpreter: PowerShell
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task
Stealth	`T1027` Obfuscated Files or Information `T1036.004` Masquerading: Masquerade Task or Service
Discovery	`T1012` Query Registry

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4799: A security-enabled local group membership was enumerated.

Rule body

title: Operation Wocao Activity - Security
id: 74ad4314-482e-4c3e-b237-3f7ed3b9ca8d
status: test
description: Detects activity mentioned in Operation Wocao report
references:
    - https://web.archive.org/web/20200226212615/https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
    - https://web.archive.org/web/20200226212615/https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf
    - https://twitter.com/SBousseaden/status/1207671369963646976
author: Florian Roth (Nextron Systems), frack113
date: 2019-12-20
modified: 2022-11-27
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.discovery
    - attack.stealth
    - attack.t1012
    - attack.t1036.004
    - attack.t1027
    - attack.execution
    - attack.t1053.005
    - attack.t1059.001
    - detection.emerging-threats
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4799
        TargetUserName|startswith: 'Administr'
        CallerProcessName|endswith: '\checkadmin.exe'
    condition: selection
falsepositives:
    - Administrators that use checkadmin.exe tool to enumerate local administrators
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    EventID: 4799
    TargetUserName|startswith: 'Administr'
    CallerProcessName|endswith: '\checkadmin.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CallerProcessName`	ends_with	`\checkadmin.exe`	`field:"CallerProcessName" kind:ends_with value:"\checkadmin.exe"`
`TargetUserName`	starts_with	`Administr` corpus 2 (sigma 2)	`field:"TargetUserName" kind:starts_with value:"Administr"`

Operation Wocao Activity - Security

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`