Bear Activity GTR 2019

Hunt Hypothesis

Adversaries may be using custom PowerShell scripts to execute malicious payloads, leveraging the Bear Activity GTR 2019 tactic to evade detection. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify potential APT activity and prevent lateral movement within the network.

KQL Query

DeviceProcessEvents 
| where Timestamp > ago(7d) 
| where (FileName =~ "xcopy.exe" and ProcessCommandLine has @" /S /E /C /Q /H \") 
     or (FileName =~ "adexplorer.exe" and ProcessCommandLine has @" -snapshot """" c:\users\")
| top 100 by Timestamp desc

Analytic Rule Definition

id: 376d30db-e3ab-49fb-852a-00d1ade65a54
name: Bear Activity GTR 2019
description: |
  Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_bear_activity_gtr19.yml.
  Questions via Twitter: @janvonkirchheim.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
query: |
  DeviceProcessEvents 
  | where Timestamp > ago(7d) 
  | where (FileName =~ "xcopy.exe" and ProcessCommandLine has @" /S /E /C /Q /H \") 
       or (FileName =~ "adexplorer.exe" and ProcessCommandLine has @" -snapshot """" c:\users\")
  | top 100 by Timestamp desc

Required Data Sources

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Campaigns/Bear Activity GTR 2019.yaml)

False Positive Guidance

• Scenario: Scheduled System Maintenance Task
  Description: A legitimate scheduled task running via Task Scheduler to perform system updates or disk cleanup.
  Filter/Exclusion: process.name != "schtasks.exe" or process.name != "taskhost.exe"

• Scenario: Admin Performing Disk Cleanup
  Description: An administrator using the built-in Disk Cleanup tool (cleanmgr.exe) to free up disk space.
  Filter/Exclusion: process.name != "cleanmgr.exe"

• Scenario: PowerShell Script for Log Rotation
  Description: A PowerShell script (powershell.exe) used to rotate and archive log files as part of standard operations.
  Filter/Exclusion: process.name != "powershell.exe" or process.args not contains "logrotate"

• Scenario: Antivirus Scan Using Windows Defender
  Description: Windows Defender performing a scheduled scan, which may trigger file access patterns similar to malicious activity.
  Filter/Exclusion: process.name != "WindowsDefender.exe" or process.name != "MsMpEng.exe"

• Scenario: Database Backup Job
  Description: A database backup job using SQL Server Agent or another scheduler to back up databases, which may involve file system access.
  Filter/Exclusion: process.name != "sqlservr.exe" or process.name != "sqlagent.exe"