Sigma rule to detect RedDelta DLL hijacking attempts to load PlugX:

title: Potential RedDelta APT DLL Hijacking Attempt

id: a8535c40-4e04-4ff6-baea-479ea6b0adea

status: stable

description: Detects DLL potential hijacking of LDeviceDetectionHelper.exe in a subdirectory of AppData\Local. Used by RedDelta APT to load PlugX.

author: MGUT, Insikt Group, Recorded Future

date: 2024/09/06

references:

• https://tria.ge/240803-bmgessseme/behavioral1/analog?q=lDevice&image=C%3A%5CUsers%5CAdmin%5CAppData%5CLocal%5CaPGfRwbjwQD%5CLDeviceDetectionHelper.exe

tags:

  - attack.t1574.001 # Hijack Execution Flow: DLL Search Order Hijacking

logsource:

    product: windows

    category: process_creation

detection:

    image_start:

      Image|startswith:

      - 'C:\Users\'

    image_end:

      Image|endswith:

      - '\AppData\Local\*\LDeviceDetectionHelper.exe'

    condition:

      image_start and image_end

level: critical

falsepositives:

  - Unlikely

YARA rule to detect RedDelta loaders written in NIM:

import "pe"

rule APT_CN_RedDelta_Nim_Loader_DEC23 {

    meta:

        author = "JGrosfelt, Insikt Group, Recorded Future"

        date = "2023-12-21"

        description = "Detects RedDelta RC4 Implementation in Nim Loaders"

        version = "1.0"

        RF_THREATACTOR = "RedDelta"

        RF_THREATACTOR_ID = "en_T6N"

        strings:

                /*

                RedDelta Custom RC4 Implementation (from RC4)

                8B 8D E0 FB FF FF                               mov     ecx, [ebp+var_420]

                89 F2                                           mov     edx, esi

                32 54 3B 08                                     xor     dl, [ebx+edi+8]

                0F BE D2                                        movsx   edx, dl

                E8 E7 C5 FF FF                                  call    sub_6DB03E5C

                89 85 E0 FB FF FF                               mov     [ebp+var_420], eax

                89 F8                                           mov     eax, edi

                83 C0 01                                        add     eax, 1

                89 C7                                           mov     edi, eax

                0F 81 8E FE FF FF                               jno     loc_6DB07716

                */

                $s1 = { 8B 8D E0 FB FF FF 89 F2 32 54 3B 08 0F BE D2 E8 ?? ?? ?? ?? 89 85 E0 FB FF FF 89 F8 83 C0 01 89 C7 0F }

        condition:

                (uint16 (0) == 0x5a4d)

                and $s1

        }

rule APT_CN_RedDelta_Nim_Loader_Aug24 {

    meta:

        author = "MGUT, Insikt Group, Recorded Future"

        date = "2024-09-06"

        description = "Detects RedDelta MSI files used to load PlugX via DLL hijacking"

        version = "1.0"

        hash = "49c32f39d420b836a2850401c134fece4946f440c535d4813362948c2de3996f"

        hash = "c5aa22163eb302ef72c553015ae78f1efe79e0167acad10047b0b25844087205"

        RF_THREATACTOR = "RedDelta"

        RF_THREATACTOR_ID = "en_T6N"

  strings:

        $func = "winimConverterVarObjectToPtrObject"

  condition:

        uint16be(0) == 0x4d5a

        and filesize < 500KB

        and pe.number_of_exports == 2

        and pe.exports("HidD_GetHidGuid")

        and pe.exports("NimMain")

        and $func

}

YARA rule to detect MSI executables used to load PlugX:

rule APT_CN_RedDelta_MSI_Aug24 {

    meta:

        author = "MGUT, Insikt Group, Recorded Future"

        date = "2024-09-06"

        description = "Detects RedDelta MSI files used to load PlugX via DLL hijacking"

        version = "1.0"

        hash = "30fbf917d0a510b8dac3bacb0f4948f9d55bbfb0fa960b07f0af20ba4f18fc19"

        hash = "2d884fd8cfa585adec7407059064672d06a6f4bdc28cf4893c01262ef15ddb99"

        RF_THREATACTOR = "RedDelta"

        RF_THREATACTOR_ID = "en_T6N"

  strings:

        $s1 = "TARGETDIR[%LOCALAPPDATA]"

        $s2 = "\\LDeviceDetectionHelper.exe"

        $s3 = "hid.dll"

  condition:

        uint32be(0) == 0xd0cf11e0 and all of them

}

YARA rule to detect LNK files used to load PlugX (applies to infection chain from  2023):

rule APT_CN_RedDelta_LNK_Oct23 {

  meta:

    author = "Mkelly, Insikt Group, Recorded Future"

    date = "2023-10-13"

    description = "Detects RedDelta LNK files used to retrieve and install .msi files via Powershell"

    version = "1.0"

    hash = "a0a3eeb6973f12fe61e6e90fe5fe8e406a8e00b31b1511a0dfe9a88109d0d129"

    hash = "74f3101e869cedb3fc6608baa21f91290bb3db41c4260efe86f9aeb7279f18a1"

    RF_THREATACTOR = "RedDelta"

    RF_THREATACTOR_ID = "en_T6N"

  strings:

    $s1 = "install.InstallProduct" wide

    $s2 = "install=New-Object" wide

    $s3 = "install.uilevel = 2" wide  

    $s4 = "REMOVE=ALL" wide

  condition:

    uint16(0) == 0x004c

    and filesize < 5MB

    and 3 of them

}