Intruvent Technologies
Contact us
Critical Nation-State APT TLP:CLEAR

APT44 / Sandworm

Threat Hunting Guide • 4-6 hours

Russian GRU Unit 74455 - one of the most dangerous cyber threat actors globally. Responsible for NotPetya ($10B+ damages), Ukraine power grid attacks, and Olympic Destroyer. Specializes in ICS/SCADA targeting and destructive wiper operations.

🎯
Hunt Modules
10
⏱️
Duration
4-6 hrs
⚔️
MITRE Techniques
80+
🏛️
Attribution
GRU
📅
Active Since
2009
📄

Download Full Hunting Guide

Complete guide with 10 hunt modules, ICS/SCADA detection queries, wiper malware indicators, and IOCs.

10 Hunt Modules

1
Initial Access - Spearphishing Detection
30 min • High
2
PowerShell Abuse & LOTL Techniques
30 min • Critical
3
Credential Dumping (Mimikatz/LSASS)
30 min • Critical
4
Lateral Movement via SMB/Admin Shares
30 min • High
5
Group Policy Object Abuse
30 min • Critical
6
Scheduled Task Persistence
30 min • High
7
Wiper Malware Indicators
45 min • Critical
8
ICS/SCADA Environment Monitoring
45 min • Critical
9
Defense Evasion & Log Clearing
30 min • High
10
C2 Communication Patterns
30 min • High

Detection Rules

Copy these queries to detect APT44/Sandworm activity in your environment.

Office Document Spawning Suspicious Process

index=windows sourcetype=WinEventLog:Security EventCode=4688
| where (ParentImage="*\\WINWORD.EXE" OR ParentImage="*\\EXCEL.EXE")
| where (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\wscript.exe")
| stats count by ParentImage, Image, CommandLine, ComputerName

Windows Event Log Clearing

index=windows (EventCode=1102 OR EventCode=104)
| stats count by ComputerName, User, EventCode
| where count > 0

Wiper Pre-Encryption Commands

index=windows sourcetype=WinEventLog CommandLine=*
| where (CommandLine="*vssadmin*delete*" OR CommandLine="*bcdedit*" OR CommandLine="*wbadmin*delete*")
| stats count by ComputerName, User, CommandLine

Need More Detection Rules?

The full guide includes 25+ additional detection signatures for ICS/SCADA and wiper malware.

Download Full Guide

Disclaimer: These detection rules are provided for defensive security purposes. Always test rules in a non-production environment before deployment. Rules may require tuning for your specific environment. Sources: Mandiant APT44 Report, CISA Ukraine Cyber Advisory.

Notable Operations

NotPetya (2017)

Disguised as ransomware but designed for destruction. $10B+ global damages via supply chain compromise of M.E.Doc software.

Ukraine Power Grid (2015/2016/2022)

First confirmed cyber attacks causing power outages. Industroyer/CrashOverride ICS malware development.

Olympic Destroyer (2018)

PyeongChang Winter Olympics disruption. False flags planted to frame North Korea and China.

Wiper Arsenal

CaddyWiper, AcidRain, AcidPour, ORCSHRED, SOLOSHRED, AWFULSHRED, HermeticWiper
← Back to Threat Hunting Guides
🛡️

Protect Critical Infrastructure

BRACE monitors for APT44 indicators including wiper malware signatures, ICS/SCADA targeting patterns, and destructive attack precursors.