MikeGPT CyberSecurity

# Actionable Guidance for IBM QRadar to Detect Today's Threats # Disclaimer: This guidance is based on general platform knowledge. Verify against current IBM documentation. # --- Immediate Actions --- # # 1. Create a Custom Rule for DLL Sideloading Behavior: # - Navigate to the 'Offenses' tab and click 'Rules'. # - Create a new rule that triggers when a known legitimate process (e.g., vetysafe.exe) # spawns a child process from an unusual path (e.g., %APPDATA%, %TEMP%). # - Rule Test: 'when the event matches QID <ProcessCreate_QID> and when the event context is Local to Remote' # - Rule Condition: 'and when the process name is one of the following 'vetysafe.exe'' # 'and when the child process path contains any of 'AppData', 'Temp'' # 2. Enable and Prioritize X-Force Threat Intelligence Feed: # - In the Admin tab, go to 'System Settings' -> 'Threat Intelligence'. # - Ensure the 'X-Force Threat Intelligence' feed is enabled and configured. # - Create a rule that increases the magnitude of any offense involving an IP, URL, or hash from this feed. # 3. Build a Search for Anomalous Java RMI Traffic (for CVE-2025-20354): # - In the 'Log Activity' tab, create an AQL search. # - Search for traffic to TCP port 1099 on your Cisco CCX servers from sources outside of your trusted management network. # - AQL: 'SELECT sourceip, destinationip FROM events WHERE destinationport = 1099 AND destinationip IN (<Your_CCX_IPs>) AND NOT sourceip IN (<Your_Trusted_Net_CIDR>) START <timeframe>' # --- Verification Steps --- # # 1. Test the Custom Rule: # - Use a test endpoint to simulate the creation of a file in %APPDATA% by a process named 'vetysafe.exe'. # - Verify that a new offense is generated in QRadar. # 2. Verify Feed Correlation: # - Check the 'Threat Intelligence' dashboard to confirm that events are being successfully correlated against the X-Force feed.

rule China_Linked_Actor_Vetysafe_Loader { meta: description = "Detects the vetysafe.exe executable used for DLL sideloading by a China-linked actor." author = "Threat Rundown" date = "2025-11-10" reference = "https://securityaffairs.com/?p=184351" severity = "high" tlp = "white" strings: $mz = { 4D 5A } // MZ header $s1 = "vetysafe.exe" ascii wide condition: $mz at 0 and filesize < 1MB and $s1 }

index=firewall sourcetype="pan:traffic" OR sourcetype="cisco:asa" (dest_port=1099) AND (dest_ip IN (list_of_cisco_ccx_servers)) NOT (src_ip IN (list_of_trusted_management_ips)) | stats count by _time, src_ip, dest_ip, dest_port, user | where count > 5 | eval risk_score=case( src_ip IN (known_threat_intel_feed), 100, 1==1, 75) | table _time, src_ip, dest_ip, user, risk_score | sort -_time

# Hunt for vetysafe.exe process and file artifacts $suspiciousProcess = "vetysafe.exe" $searchPaths = @("$env:ProgramFiles", "$env:ProgramFiles(x86)", "$env:windir", "$env:APPDATA", "$env:LOCALAPPDATA", "$env:TEMP") Write-Host "[*] Searching for running process: $suspiciousProcess" $running = Get-Process -Name $suspiciousProcess -ErrorAction SilentlyContinue if ($running) { Write-Host "[!] FOUND suspicious process running:" $running | Format-List Path, Id, StartTime } else { Write-Host "[-] No running process found." } Write-Host "\n[*] Searching for file artifacts on disk..." foreach ($path in $searchPaths) { Get-ChildItem -Path $path -Filter $suspiciousProcess -Recurse -ErrorAction SilentlyContinue | ForEach-Object { Write-Host "[!] FOUND file artifact: $($_.FullName)" } } Write-Host "[*] Hunt complete."