Up-to-date detections for TeamPCP malware used in Trivy and Checkmarx compromises available?

[MarekKreul]

Hi, we're currently using the data collected via XDR and other sensors to hunt for IOCs of the recently observed attacks against aquasecurity Trivy Github actions, as well as Checkmarx KICS. This, obviously, focuses mainly on network-based IOCs like C2 domain and IPs, as well as file hashes and version strings in filenames.
However, the attackers could easily change their malicious scripts to have a new hash, or point it to another domain and IP for C2. I'm thus evaluating what other options we'd have to scan for suspicious behaviour, particularly the way the malicious script scans for credentials and exfiltrates the collected information.
How can we get more information if PaloAlto is already working on such (BIOC) detection rules, and when they will be available?

[susekar · Accepted solution]

Hello @MarekKreul ,

Greetings for the day.

Palo Alto Networks has actively researched and implemented behavioral detection rules for the supply chain attacks targeting CI/CD pipelines, such as Aqua Security Trivy and Checkmarx KICS. These attacks are primarily associated with the Shai Hulud (or Arrakis) campaign, which utilizes malicious scripts to scan for credentials and perform exfiltration on GitHub Actions runners.

1. Available Detection and Prevention Rules
Palo Alto Networks provides several rules to detect and block behaviors associated with this threat:

• Malicious Credential Access: The rule ioc.linux.shaihulud.2 is designed to detect activity associated with malicious credential-access tools on Linux systems, specifically targeting GitHub Action runners (e.g., processes running under the github user or within /usr/local/actions-runner/runsvc.sh). This rule aligns with MITRE ATT&CK techniques T1552 (Unsecured Credentials) and T1555 (Credentials from Password Stores).
• Enhanced Blocking Rules: While the initial rules were released in "report" mode to ensure stability, improved detection rules aimed at blocking this attack were shipped in Content Update (CU) 2060.

2. Monitoring for Suspicious Behavior (Credential Scanning and Exfiltration)
Beyond static IOCs, you can leverage the following Cortex XDR features to hunt for the behaviors described:

• Behavioral Indicators of Compromise (BIOCs): You can create custom BIOC rules under the Credential Access and Exfiltration categories to monitor for suspicious patterns, such as unusual file reads in credential directories or large data uploads to external IP addresses.
• Cortex Query Language (XQL) and Correlation Rules: Use XQL to craft specific threat hunting queries for relationship-based events. These queries can be saved as Correlation Rules for continuous, near-real-time monitoring of CI/CD environments.
• Analytics BIOCs (ABIOCs): If enabled, the Analytics engine can detect deviations from baseline behavior, such as a GitHub runner process initiating a network connection or script execution it has never performed before.

===================================

How to Get More Information

• Check Release Notes: Monitor the Cortex XDR Analytics Content Release Notes for the latest updates on global BIOC and Analytics rules. Palo Alto Networks typically releases new content roughly once a week.
• Direct Inquiries: For specific information on emerging threats or to request detection status, you can contact the research team directly at detections@paloaltonetworks.com.
• Unit 42 Research: Refer to Unit 42's technical briefs for deep dives into specific campaigns like Shai Hulud to understand the exact TTPs being targeted.

If you feel this has answered your query, please let us know by clicking like and "Mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar