Diamond Sleet APT DNS Communication Indicators

 1title: Diamond Sleet APT DNS Communication Indicators
 2id: fba38e0f-4607-4344-bb8f-a4b50cdeef7f
 3status: test
 4description: Detects DNS queries related to Diamond Sleet APT activity
 5references:
 6    - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2023-10-24
 9tags:
10    - attack.command-and-control
11    - detection.emerging-threats
12logsource:
13    product: windows
14    category: dns_query
15detection:
16    selection:
17        QueryName|contains:
18            - '3dkit.org'
19            - 'dersmarketim.com'
20            - 'galerielamy.com'
21            - 'olidhealth.com'
22    condition: selection
23falsepositives:
24    - Might generate some false positive if triggered by a user during investigation for example.
25level: high

References

• Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability | Microsoft Security Blog

  

  Microsoft has observed North Korean threat actors Diamond Sleet and Onyx Sleet exploiting Jet Brains TeamCity CVE-2023-42793 vulnerability.

  
  Read More

Related rules

• DarkGate - Autoit3.EXE File Creation By Uncommon Process
• DPRK Threat Actor - C2 Communication DNS Indicators
• Devil Bait Potential C2 Communication Traffic
• Equation Group C2 Communication
• GALLIUM Artefacts - Builtin