Kimsuky-Style Tradecraft Mapped to Windows Logs in Controlled Emulation
Summary
A controlled emulation of Kimsuky-style activity generated 3,087 Windows audit events on a domain controller. The article checks LogTotal alerts against raw events and outlines detection, containment, credential-reset, and logging steps.
Key points
- The 3,087-event sample came from a controlled emulation on one domain controller, not a live intrusion.
- The article identifies 49 process-creation events (4688) with command lines, plus service, scheduled-task, account, Active Directory, audit-policy, and log-clearing events.
- Emulated behaviors included a dot-padded PDF-themed LNK, script hosts running from user-writable folders, hidden PowerShell, a temporary HTA, a masquerading executable, and new services and scheduled tasks.
- LogTotal processed the events in 16.4 seconds, matched 73 rules against 105 lines, and grouped the matches into nine attack chains; the article says its verdict was suspicious and required investigation.
- The article recommends checking alerts against raw events and monitoring process creation, service and task creation, account changes, and Security log clearing on domain controllers.
- Suggested response steps include collecting relevant files, verifying cleanup, restoring audit settings, enabling PowerShell Script Block Logging and AMSI telemetry, and resetting credentials.
Article Details
- Defense Focus
- Detect and respond to Kimsuky-style activity in Windows Security telemetry, while distinguishing the analyzed controlled emulation from a live intrusion.
- Detection Methods
- Inspect process-creation events and command lines for script hosts launched from user-writable folders, hidden PowerShell, and suspicious execution paths.
- Correlate service installation, scheduled-task, account and group management, Active Directory object-change, audit-policy, and Security-log-clearing events.
- Hunt for dot-padded LNK filenames, scripts or HTA files in user-writable locations, and system-process names outside System32.
- Confirm detection-rule findings against raw events; the article notes that LogTotal's findings were checked against the underlying event records.
- Treat Security event 1102 on a domain controller as an incident trigger and use other sources to investigate activity before the log was cleared.
- Data Sources
- Windows Security process-creation events (4688), including command lines
- Windows Security service-installation events (4697)
- Windows Security scheduled-task events (4698, 4702, 4699)
- Windows Security account and group management events (4720–4738)
- Windows Security Active Directory object-change events (5136)
- Windows Security audit-policy-change events (4719)
- Windows Security log-clearing event (1102)
- Native EVTX event data converted to JSON
- Rule Types
- LogTotal threat-detection rules applied to EVTX-derived JSON event records
- Platforms
- Windows Security auditing
- Active Directory domain controller
- LogTotal
- Defensive Actions
- Isolate the affected host and capture memory and disk images.
- Verify and remove suspicious scheduled tasks; check and restore the audit policy.
- Enable PowerShell Script Block Logging and collect AMSI telemetry.
- Apply allowlisting or restrictions for WScript, CScript, and PowerShell.
- Collect and hash files from C:\Users\Public\Downloads\ and %TEMP%, including LNK, JScript, PowerShell, HTA, and masquerading executable files.
- Verify cleanup of suspicious services, tasks, accounts, and groups; revert registry changes that hide accounts.
- Reset affected credentials, including the Administrator password; plan a double krbtgt reset for a domain-controller incident.
- Hunt domain-wide for dot-padded LNK names and script hosts launched from user-writable folders.
- Keep process-creation auditing with command lines enabled; alert on service installations, scheduled-task creation, and Security-log clearing on domain controllers.
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe emulation places a fake smss.Exe under Public\Downloads\system32, outside the normal System32 location.T1053.005 · Scheduled TaskA logon-triggered scheduled task named \OrbitalHealthCheck runs svc_update.ps1 in the emulation.T1059.001 · PowerShellThe emulation includes hidden PowerShell launched with -ExecutionPolicy Bypass and a PowerShell script run by a scheduled task.T1059.007 · JavaScriptIn the emulation, wscript.exe runs DefenderUpdate.Js from C:\Users\Public\Downloads.T1070.001 · Clear Windows Event LogsSecurity event 1102 records that the Security log was cleared during the emulation.T1098.007 · Additional Local or Domain GroupsThe emulation creates admingroupz and adds the newly created account to the group.T1112 · Modify RegistryThe emulation changes Winlogon\SpecialAccounts\UserList to hide the Administrator account.T1136.001 · Local AccountThe emulation creates the local account adminuserz.T1218.005 · MshtaThe emulation includes mshta.exe running an HTA file from %TEMP%.T1543.003 · Windows ServiceThe emulation installs the OrbitalTestSvc service, which launches hidden PowerShell.T1566.001 · Spearphishing AttachmentThe article describes a published Kimsuky campaign impersonating diplomats to deliver LNK files.
Threat Actors
KimsukyThe article identifies Kimsuky as a North Korean state-sponsored APT group associated with intelligence collection and describes campaigns using spear-phishing, LNK files, and PowerShell. The analyzed log sample is a controlled emulation, not a live intrusion.SpringtailThe article lists Springtail as another name used for Kimsuky, the group it describes as conducting espionage and intelligence collection.
Products
Tools
Countries
JapanMost Kimsuky operations hit South Korea, with others reaching the United States, Japan, Europe, and Russia.North KoreaIts activity is believed to align with North Korea’s Reconnaissance General Bureau.RussiaMost Kimsuky operations hit South Korea, with others reaching the United States, Japan, Europe, and Russia.South KoreaMost Kimsuky operations hit South Korea, with others reaching the United States, Japan, Europe, and Russia.United StatesMost Kimsuky operations hit South Korea, with others reaching the United States, Japan, Europe, and Russia.
Industries
CryptocurrencyBeyond government and policy targets, victims include academics and the cryptocurrency sector.DefenseSuspicious LOLBAS MSHTA Defense Evasion Behavior mshta.exe running %TEMP%\D.21_SEOUL.htaGovernmentBeyond government and policy targets, victims include academics and the cryptocurrency sector.