Onion Duke Implant by APT29

Hunt Hypothesis

The detection identifies potential Onion Duke Implant activity by APT29, characterized by suspicious fileless execution and lateral movement patterns. SOC teams should proactively hunt for this behavior to detect and mitigate advanced persistent threats leveraging this sophisticated implant in their Azure Sentinel environment.

YARA Rule

rule IMPLANT_9_v1 {
   meta:
      description = "Onion Duke Implant by APT29"
      author = "US CERT"
      reference = "https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE"
      date = "2017-02-10"
      score = 85
   strings:
      $STR1 = { 8B 03 8A 54 01 03 32 55 FF 41 88 54 39 FF 3B CE 72 EE }
      $STR2 = { 8B C8 83 E1 03 8A 54 19 08 8B 4D 08 32 54 01 04 40 88 54 38 FF
         3B C6 72 E7 }
      $STR3 = { 8B 55 F8 8B C8 83 E1 03 8A 4C 11 08 8B 55 FC 32 0C 10 8B 17 88
         4C 02 04 40 3B 06 72 E3 }
   condition:
      (uint16(0) == 0x5A4D or uint16(0)) and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

References

• https://www.us-cert.gov/ncas/current-activity/2017/02/10/Enhanced-Analysis-GRIZZLY-STEPPE
• Source Rule

False Positive Guidance

• Scenario: Scheduled System Maintenance Task
  Description: A legitimate scheduled task runs a script that uses curl or wget to download a file from an internal or external server, mimicking the behavior of the Onion Duke implant.
  Filter/Exclusion: Exclude processes initiated by schtasks.exe or tasks scheduled under the Task Scheduler service.

• Scenario: Software Update via Proxy
  Description: A system performs a software update using a proxy server, which may involve downloading files from a known malicious domain (e.g., update.example.com) that is falsely flagged by the rule.
  Filter/Exclusion: Exclude traffic originating from known update servers or use a proxy IP list for whitelisting.

• Scenario: Admin User Performing Remote Code Execution (RCE)
  Description: An admin user uses Invoke-Command or PowerShell to execute a remote script that downloads a file from a legitimate external repository (e.g., GitHub) that matches the rule’s signature.
  Filter/Exclusion: Exclude PowerShell scripts executed by users with admin privileges or those sourced from trusted repositories.

• Scenario: Internal Threat Hunting Tool
  Description: A threat hunting tool (e.g., CrowdStrike Falcon, Microsoft Defender for Endpoint) uses a custom script to download and analyze a file that matches the Onion Duke implant signature.
  Filter/Exclusion: Exclude processes initiated by known threat hunting tools or those running under a specific hunting user account.

• Scenario: Legacy System Patching Process
  Description: A legacy system is being patched using a script that downloads a patch file from an internal server, which may trigger the rule due to similar file download behavior.
  Filter/Exclusion: Exclude file downloads from internal servers or those associated with known patching processes.