X-Agent/CHOPSTICK Implant by APT28

Hunt Hypothesis

The detection identifies potential X-Agent/CHOPSTICK implant activity associated with APT28, indicating a sophisticated adversary establishing a persistent foothold in the network. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate advanced persistent threats before they exfiltrate data or escalate further.

YARA Rule

rule IMPLANT_3_v1 {
   meta:
      description = "X-Agent/CHOPSTICK Implant by APT28"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
   strings:
      $STR1 = ">process isn't exist<" ascii wide
      $STR2 = "shell\\open\\command=\"System Volume Information\\USBGuard.exe\" install" ascii wide
      $STR3 = "User-Agent: Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0" ascii wide
      $STR4 = "webhp?rel=psy&hl=7&ai=" ascii wide
      $STR5 = {0f b6 14 31 88 55 ?? 33 d2 8b c1 f7 75 ?? 8b 45 ?? 41 0f b6 14
         02 8a 45 ?? 03 fa}
   condition:
      any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

Microsoft Defender for Endpoint — Custom indicators / advanced hunting
Email Gateway — Attachment scanning
File Share Monitoring — Periodic scanning of shared drives
YARA CLI — Manual threat hunting on endpoints

This rule contains 5 string patterns in its detection logic.

References

False Positive Guidance

Scenario: Scheduled System Maintenance Task
Description: A legitimate system maintenance task using schtasks.exe to run a script that mimics the behavior of the X-Agent/CHOPSTICK implant.
Filter/Exclusion: Exclude processes initiated by scheduled tasks with known maintenance scripts or those running under the SYSTEM account with a known schedule.
Scenario: Admin PowerShell Script for Log Collection
Description: An administrator uses PowerShell to collect logs from multiple servers, which may include commands similar to those used by the X-Agent/CHOPSTICK implant.
Filter/Exclusion: Exclude PowerShell scripts executed by users with the Administrators group and containing known log collection commands like Get-EventLog or Get-WinEvent.
Scenario: Antivirus Quarantine Process
Description: A legitimate antivirus tool (e.g., Bitdefender, Kaspersky) is quarantining a file that matches the X-Agent/CHOPSTICK signature, triggering the rule.
Filter/Exclusion: Exclude processes associated with known antivirus tools or files marked as quarantined by the endpoint protection platform.
Scenario: Database Backup Job Using SQLCMD
Description: A database backup job using sqlcmd.exe is executing a script that includes command-line arguments resembling those used by the X-Agent/CHOPSTICK implant.
Filter/Exclusion: Exclude processes initiated by SQL Server Agent jobs or scripts that are known to be part of routine database maintenance.
Scenario: User-Initiated File Copy via Robocopy
Description: A user is copying files using robocopy.exe between servers, which may involve command-line arguments that resemble the implant’s behavior.
Filter/Exclusion: Exclude processes initiated by standard user accounts with known file transfer scripts or those involving legitimate file synchronization tasks.