Name:Windows SoftEther VPN Masquerading as Legitimate Binary id:69fe4cb7-807e-4012-a17f-cd288215b038 version:2 date:None author:Raven Tait, Splunk status:production type:TTP Description:Flax Typhoon actors have been identified downloading and using SoftEther VPN software to obfuscate their activity.
This searches for the SoftEther VPN binary running with the obfuscated binary names they use for the process. Data_source:
-Sysmon EventID 1
search:`sysmon` EventID=1 process IN ( "*conhost.exe*", "*dllhost.exe*" ) AND ( Company="*SoftEther*" OR OriginalFileName="vpnbridge*.exe" ) | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by Computer EventID Company process action dest original_file_name parent_process parent_process_exec parent_process_guid parent_process_id parent_process_name parent_process_path process_hash process_integrity_level user user_id vendor_product
how_to_implement:The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives:Some legitimate users may run SoftEther VPN for remote access or privacy purposes. Exclude known approved VPN usage to reduce false alerts. References: -https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/ drilldown_searches: earliest_offset:'$info_min_time$' latest_offset:'$info_max_time$' name:'View the detection results for - "$user$" and "$dest$"' search:'%original_detection_search% | search user = "$user$" dest = "$dest$"' name:'View risk events for the last 7 days for - "$user$" and "$dest$"' search:'| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset:'7d' latest_offset:'0' analytic_story:['Flax Typhoon', 'Linux Persistence Techniques', 'Linux Privilege Escalation']
