Skip to content
skopnix
Detections
← All detectionsLinked actor

Chimera

18 rules6 findings

The Chimera dossier →

  1. Behaviour (ATT&CK technique)

    NTDS.dit copy via ntdsutil IFM (T1003.003)

    Matches only ntdsutil with both 'ifm' and 'create'; routine ntdsutil maintenance (metadata cleanup, snapshot listing) does not match.

    APT10 · APT15 · APT28 · Chimera · ENERGETIC BEAR · FIN13 · 10 more

    T1003.003conf 85SIGAQLXQL

  2. Behaviour (ATT&CK technique)

    certutil used to download a remote file (T1105)

    Needs certutil, a download switch and an http(s) URL together; certutil hashing, encoding or CA administration does not match.

    APT-C-36 · APT10 · APT15 · APT18 · APT23 · APT27 · 76 more

    T1105conf 80SIGAQLXQL

  3. Behaviour (ATT&CK technique)

    PowerShell download cradle executed from the command line (T1059.001)

    All three conditions must hold (PowerShell binary, a download method, an execute verb); plain Invoke-WebRequest file downloads and encoded management scripts do not match.

    APT-C-36 · APT10 · APT19 · APT27 · APT28 · APT29 · 71 more

    T1059.001conf 80SIGAQLXQL

  4. Behaviour (ATT&CK technique)

    Windows event log cleared with wevtutil (T1685.005)

    Only the clear verbs match; wevtutil queries, exports and log configuration do not.

    APT28 · APT32 · Chimera · ENERGETIC BEAR · FIN5 · FIN8 · 5 more

    T1685.005conf 80SIGAQLXQL

  5. Behaviour (ATT&CK technique)

    AdFind domain trust or controller enumeration (T1482)

    Requires adfind plus a trust / DC enumeration switch; generic LDAP queries with other tools do not match.

    APT35 · blackbyte · Chimera · Earth Lusca · FIN8 · LOTUS PANDA · 4 more

    T1482conf 70SIGAQLXQL

  6. Behaviour (ATT&CK technique)

    rclone copy or sync to remote storage (T1567.002)

    Matches only rclone running copy/sync; listing, config and mount do not match. Renamed rclone binaries are not covered by the Cortex/QRadar versions (Sigma also checks the PE description).

    APT27 · APT31 · APT40 · BRONZE STARLIGHT · Chimera · Confucius · 17 more

    T1567.002conf 70SIGAQLXQL

How to deploy

SIGSigma

  1. 1.Convert for your SIEM with sigma-cli / pySigma, e.g. sigma convert -t splunk -p sysmon rule.yml.
  2. 2.Run it as a hunt first: every rule ships as status experimental.
  3. 3.Promote to an alert once a week of results is clean on your data.

Check · The processing pipeline must map the logsource (firewall, dns, proxy, webserver, process_creation) to your field names.

AQLIBM QRadar

  1. 1.Create the reference set from its spec (Reference Data API, or Admin > Reference Set Management) and schedule the skopnix feed load.
  2. 2.Paste the AQL into Log Activity > Advanced Search to hunt the last seven days.
  3. 3.For alerting, build the CRE rule from the test stack shown and exclude your known-good building block.

Check · Custom properties ("URL Host", "URL", "File Hash", "Process CommandLine") come from your DSMs and content extensions; rename them if yours differ.

XQLCortex XDR

  1. 1.Paste the XQL into Incident Response > Investigation > Query Builder > XQL Search.
  2. 2.To alert, save it as a Correlation Rule and set the MITRE tactic and technique printed with the rule.
  3. 3.Schedule it on the interval you hunt at; keep the fields stage for the alert's columns.

Check · CVE rules read PAN-OS URL logs (panw_ngfw_url_raw), which need the NGFW integration and, for HTTPS, decryption.