China-Linked APT Deploys 8 Autonomous AI Agents Against Taiwan Government Network — Detection and Hardening Guide

---
title: Rapid Sequential Discovery Command Execution (Agent- Tempo)
id: 8f3c2a17-4b6d-4e91-a7c2-9d1e5f8b3a06
status: experimental
description: Detects multiple distinct discovery commands executed in rapid succession from a single process tree, consistent with autonomous AI-agent reconnaissance behavior observed in the reported Taiwan government intrusion. Human operators rarely chain this many discovery utilities back-to-back without pauses or errors.
references:
  - https://securityaffairs.com/197079/apt/china-linked-hackers-use-ai-agents-in-autonomous-attack-on-taiwan.html
  - https://attack.mitre.org/techniques/T1087/
  - https://attack.mitre.org/techniques/T1018/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.discovery
  - attack.t1087
  - attack.t1018
  - attack.t1033
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent_shell:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wmic.exe'
  selection_commands:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
      - '\ipconfig.exe'
      - '\arp.exe'
      - '\quser.exe'
      - '\qwinsta.exe'
      - '\systeminfo.exe'
      - '\whoami.exe'
      - '\nslookup.exe'
      - '\dsquery.exe'
  condition: selection_parent_shell and selection_commands
falsepositives:
  - IT administrator scripts and inventory tools (baseline and exclude known automation accounts)
  - Legitimate RMM platforms — profile expected parent processes
level: medium
---
title: LSASS Memory Access by Non-System Process (Credential Theft)
id: 2e7b91d4-6c3f-4a58-b9e1-4d8c2f6a1e07
status: experimental
description: Detects non-standard processes accessing LSASS memory, a core credential-access step in the account-compromise phase of the reported autonomous intrusion against the Taiwan government network.
references:
  - https://securityaffairs.com/197079/apt/china-linked-hackers-use-ai-agents-in-autonomous-attack-on-taiwan.html
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1438'
      - '0x143a'
      - '0x1fffff'
  filter_legitimate:
    SourceImage|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Program Files\Microsoft Monitoring Agent\'
      - 'C:\ProgramData\Microsoft\Windows Defender\'
  condition: selection and not filter_legitimate
falsepositives:
  - EDR/AV products and backup agents accessing LSASS — whitelist by signed binary hash, not path alone
level: high
---
title: Batch Archive Staging Followed by Outbound Transfer (Agent Exfiltration Pattern)
id: 5a1d8e36-9f42-4c7b-b3a8-6e2d4c9f1b05
status: experimental
description: Detects creation of compressed archives in non-standard staging directories, consistent with automated data collection prior to exfiltration as reported in the AI-agent intrusion against the Taiwan government network.
references:
  - https://securityaffairs.com/197079/apt/china-linked-hackers-use-ai-agents-in-autonomous-attack-on-taiwan.html
  - https://attack.mitre.org/techniques/T1560/001/
  - https://attack.mitre.org/techniques/T1074/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.collection
  - attack.t1560.001
  - attack.t1074.001
  - attack.exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\makecab.exe'
      - '\tar.exe'
  selection_args:
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' u -r'
      - 'Compress-Archive'
  selection_staging:
    CommandLine|contains:
      - '\ProgramData\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - 'C:\Temp\'
      - 'C:\Perflogs\'
  condition: selection_tool and selection_args and selection_staging
falsepositives:
  - Software deployment and log collection tooling — exclude by known signer and service account
level: high

// Hunt: Machine-tempo kill chain — one identity or host performing discovery,
// privileged access, and archive staging within a compressed window.
// Consistent with autonomous AI-agent operation reported against Taiwan govt network.
// Tune the 2h window and action count to your environment baseline.
let DiscoveryCmds = dynamic(["net.exe","net1.exe","nltest.exe","quser.exe","qwinsta.exe","systeminfo.exe","dsquery.exe","arp.exe"]);
let ArchiveTools  = dynamic(["rar.exe","7z.exe","7za.exe","makecab.exe"]);
let Discovery = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ (DiscoveryCmds)
    | summarize DiscoveryCount = count(), DiscoveryCmds = make_set(FileName),
                FirstDiscovery = min(TimeGenerated)
        by DeviceId, InitiatingProcessAccountName, bin(TimeGenerated, 2h);
let Staging = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ (ArchiveTools) or ProcessCommandLine has "Compress-Archive"
    | where ProcessCommandLine has_any ("ProgramData", "Users\\Public", "AppData\\Local\\Temp", "Perflogs")
    | summarize StagingCount = count(), FirstStaging = min(TimeGenerated)
        by DeviceId, InitiatingProcessAccountName, bin(TimeGenerated, 2h);
Discovery
| join kind=inner Staging on DeviceId, TimeGenerated
| where DiscoveryCount >= 5 and StagingCount >= 1
| extend KillChainGapMinutes = datetime_diff("minute", FirstStaging, FirstDiscovery)
| project DeviceId, InitiatingProcessAccountName, DiscoveryCount, DiscoveryCmds,
          FirstDiscovery, FirstStaging, KillChainGapMinutes
| sort by KillChainGapMinutes asc;

// Second hunt: burst authentication — one source authenticating to many hosts
// in a short window (agent-driven lateral movement / account compromise spray).
SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4624 and LogonType in (3, 10)
| summarize DistinctTargets = dcount(Computer), Targets = make_set(Computer)
    by Account, IpAddress, bin(TimeGenerated, 15m)
| where DistinctTargets >= 8
| sort by DistinctTargets desc;

-- Hunt: Autonomous-agent behavioral artifacts on endpoints.
-- Looks for discovery-tool bursts from a single parent, archives staged in
-- non-standard directories, and recent LSASS-adjacent tooling drops.
-- Deploy as a Velociraptor hunt across the fleet.

-- 1) Processes chaining discovery utilities (agent-tempo reconnaissance)
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(net1?|nltest|quser|qwinsta|dsquery|systeminfo|arp)\.exe'
  AND CreateTime > now() - 86400

-- 2) Archive staging in suspicious directories (pre-exfiltration collection)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/ProgramData/**/*.rar',
  'C:/ProgramData/**/*.7z',
  'C:/ProgramData/**/*.zip',
  'C:/Users/Public/**/*.rar',
  'C:/Users/Public/**/*.7z',
  'C:/Perflogs/**/*.zip'
])
WHERE Mtime > now() - 604800
  AND Size > 1000000

-- 3) Active remote sessions and lateral-movement connections
SELECT Pid, Name, Path, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE RemotePort IN (445, 3389, 5985, 5986)
  AND Status = 'ESTABLISHED'
  AND NOT RemoteAddress =~ '^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)' || Name =~ '(?i)(powershell|pwsh|cmd|wmic|rundll32|regsvr32)\.exe'

# Verify and harden: identity controls, audit coverage, and exfil tripwires.
# Run on Domain Controllers and critical servers. Review output before changes.

# 1) Confirm advanced audit policy coverage for the behaviors above
Write-Host "=== Audit Policy Coverage ===" -ForegroundColor Cyan
auditpol /get /subcategory:"Process Creation","Logon","Sensitive Privilege Use","Credential Validation","Security Group Management","User Account Management"

# 2) Enable process command-line auditing if missing (critical for agent-tempo detection)
$cmdAudit = Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -ErrorAction SilentlyContinue
if ($null -eq $cmdAudit -or $cmdAudit.ProcessCreationIncludeCmdLine_Enabled -ne 1) {
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit" -Name "ProcessCreationIncludeCmdLine_Enabled" -Value 1
    Write-Host "[!] Enabled process command-line auditing (was disabled)" -ForegroundColor Yellow
}

# 3) Hunt for accounts with recent abnormal logon volume (compromised-account indicator)
Write-Host "=== Accounts with high logon volume in last 24h ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Properties[8].Value -in 3,10 } |
    Group-Object { $_.Properties[5].Value } |
    Where-Object { $_.Count -gt 200 } |
    Sort-Object Count -Descending |
    Select-Object Count, Name | Format-Table -AutoSize

# 4) Verify Credential Guard / LSASS protection (mitigates the credential-dumping stage)
$lsa = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -ErrorAction SilentlyContinue
if ($null -eq $lsa -or $lsa.RunAsPPL -ne 1) {
    Write-Host "[!] LSASS Protection (RunAsPPL) NOT enabled — set via GPO: 'Configure LSASS to run as a protected process'" -ForegroundColor Red
} else {
    Write-Host "[OK] LSASS Protection enabled" -ForegroundColor Green
}

# 5) Identify privileged accounts without MFA-equivalent enforcement risk:
# list admin accounts with passwords older than 90 days or never-expiring
Write-Host "=== Privileged account hygiene ===" -ForegroundColor Cyan
Get-ADGroupMember -Identity "Domain Admins" -Recursive -ErrorAction SilentlyContinue |
    Get-ADUser -Properties PasswordLastSet, PasswordNeverExpires, LastLogonDate |
    Where-Object { $_.PasswordNeverExpires -eq $true -or $_.PasswordLastSet -lt (Get-Date).AddDays(-90) } |
    Select-Object SamAccountName, PasswordLastSet, PasswordNeverExpires, LastLogonDate | Format-Table -AutoSize

# 6) Flag staged archives in suspicious paths (exfil tripwire check)
Write-Host "=== Staged archives in suspicious paths (last 7 days) ===" -ForegroundColor Cyan
$paths = @("C:\ProgramData","C:\Users\Public","C:\Perflogs")
foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include *.rar,*.7z,*.zip -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) -and $_.Length -gt 1MB } |
            Select-Object FullName, Length, LastWriteTime
    }
}