APT CL-STA-1062: Defending Southeast Asian Critical Infrastructure Against TinyRCT Attacks

---
title: Potential CL-STA-1062 Open-Source Tool Usage
id: 8c4d2a1e-5f3b-4a2c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects execution of common open-source reconnaissance tools often used by CL-STA-1062 during initial access phases.
references:
  - https://attack.mitre.org/techniques/T1016/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1016
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\adfind.exe'
      - '\nmap.exe'
      - '\fping.exe'
  filter_legit:
    ParentImage|contains:
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection_tools and not filter_legit
falsepositives:
  - Authorized administrative audits
level: high
---
title: Suspicious Service Installation TinyRCT Persistence
id: 9d5e3b2f-6a4c-5b3d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects creation of new services via sc.exe or PowerShell from unusual parent processes, indicative of custom malware like TinyRCT establishing persistence.
references:
  - https://attack.mitre.org/techniques/T1543.003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_sc:
    Image|endswith:
      - '\sc.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'create'
      - 'New-Service'
  selection_suspicious_parent:
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\mshta.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate software installation
  - System administrator automation
level: high

// Hunt for network connections from processes typically abused by CL-STA-1062
// Look for connections to non-standard high ports often used for custom C2
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in (~"powershell.exe", ~"cmd.exe", ~"wscript.exe", ~"cscript.exe")
| where RemotePort >= 40000 and RemotePort <= 65000
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemotePort
| order by Timestamp desc


// Hunt for persistence via service creation matching the Sigma rule logic
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in (~"sc.exe", ~"powershell.exe")
| where ProcessCommandLine has_any ("create", "New-Service", "binPath=")
| where InitiatingProcessFileName !in (~"services.exe", ~"svchost.exe", ~"msiexec.exe")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

-- Hunt for services pointing to binaries in non-standard paths (TinyRCT persistence)
SELECT Name, DisplayName, ImagePath, StartType, State
FROM services()
WHERE ImagePath NOT LIKE 'C:\Windows\%' 
   AND ImagePath NOT LIKE 'C:\Program Files\%'
   AND ImagePath NOT LIKE 'C:\Program Files (x86)%'
   AND State != 'Stopped'


-- Hunt for recently modified binaries in System32 that could be custom malware
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs="C:\Windows\System32\*.exe")
WHERE Mtime > now() - 30
   AND NOT FullPath IN ("C:\Windows\System32\cmd.exe", "C:\Windows\System32\powershell.exe", "C:\Windows\System32\regsvr32.exe")

# Audit for suspicious services often used by CL-STA-1062 for persistence
Write-Host "[+] Auditing services for suspicious paths..." -ForegroundColor Cyan

$suspiciousServices = Get-WmiObject Win32_Service | Where-Object { 
    $_.PathName -notmatch 'System32' -and 
    $_.PathName -notmatch 'Program Files' -and 
    $_.State -ne 'Stopped' 
}

if ($suspiciousServices) {
    Write-Host "[!] WARNING: Found services running outside standard directories:" -ForegroundColor Red
    foreach ($svc in $suspiciousServices) {
        Write-Host "Name: $($svc.Name) | Path: $($svc.PathName) | State: $($svc.State)" -ForegroundColor Yellow
    }
} else {
    Write-Host "[-] No suspicious services found." -ForegroundColor Green
}

# Check for recent execution of open-source recon tools
Write-Host "[+] Checking for recent execution of common recon tools..." -ForegroundColor Cyan

$events = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4688)]] and *[EventData[Data[@Name='NewProcessName']='*adfind.exe' or Data[@Name='NewProcessName']='*nmap.exe']]" -ErrorAction SilentlyContinue

if ($events) {
    Write-Host "[!] Found execution events for reconnaissance tools." -ForegroundColor Red
    $events | Select-Object TimeCreated, Message | Format-List
} else {
    Write-Host "[-] No suspicious recon tool execution found in Security logs." -ForegroundColor Green
}