CORESHELL/SOURFACE Implant by APT28

Hunt Hypothesis

The hypothesis is that the detection rule identifies potential CORESHELL/SOURFACE implant activity by APT28, which is a sophisticated and persistent malware used for long-term access and data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threats before they cause significant damage.

YARA Rule

rule IMPLANT_2_v20 {
   meta:
      description = "CORESHELL/SOURFACE Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
   strings:
      $func = { 0F B6 5C 0A FE 8D 34 02 8B 45 D4 03 C2 0F AF D8 8D 7A 01 8D 42
         FF 33 D2 F7 75 F4 C1 EB 07 8B C7 32 1C 0A 33 D2 B9 06 00 00 00 F7 F1
         8A 4D F8 8B 45 0C 80 E9 02 02 4D 0B 32 0C 02 8B 45 F8 33 D2 F7 75 F4
         8B 45 0C 22 0C 02 8B D7 02 D9 30 1E 8B 4D 0C 8D 42 FE 3B 45 E8 8B 45
         D8 89 55 F8 72 A0 }
   condition:
      (uint16(0) == 0x5A4D or uint16(0) == 0xCFD0 or uint16(0) == 0xC3D4 or
      uint32(0) == 0x46445025 or uint32(1) == 0x6674725C) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

References

• https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE
• Source Rule

False Positive Guidance

• Scenario: Scheduled system maintenance task using PowerShell to update system files
  Filter/Exclusion: process.name != "powershell.exe" OR process.args NOT LIKE '%Update-ExecutionPolicy%'

• Scenario: Legitimate use of Microsoft Sysinternals Process Explorer for administrative troubleshooting
  Filter/Exclusion: process.name != "procexp.exe" OR process.args NOT LIKE '%-enable'

• Scenario: Automated backup job using Veeam Backup & Replication that executes scripts
  Filter/Exclusion: process.name != "veeam.exe" OR process.args NOT LIKE '%backup%'

• Scenario: System administrator using Windows Task Scheduler to run a legitimate script for log cleanup
  Filter/Exclusion: process.name != "schtasks.exe" OR process.args NOT LIKE '/create /tn LogCleanup /tr "C:\Scripts\cleanlogs.ps1"'

• Scenario: Use of Windows Event Viewer to manually review logs for troubleshooting
  Filter/Exclusion: process.name != "eventvwr.exe" OR process.args NOT LIKE '/s'