Critical Alert: Defending Against North Korean Cloud Exploitation, Supply Chain Attacks, and Data Breaches

---
title: Potential North Korean Cloud Credential Harvesting
id: 8d7e5b12-f3a4-4c8d-9e1a-2b3c4d5e6f7g
status: experimental
description: Detects suspicious AWS API activities consistent with North Korean threat actor patterns including unusual IAM operations and S3 access attempts
references:
  - https://attack.mitre.org/groups/G0032/
  - https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls.html
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.credential_access
  - attack.t1110.003
  - attack.initial_access
  - attack.t1190
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName|contains:
      - 'CreateAccessKey'
      - 'DeleteAccessKey'
      - 'UpdateAccessKey'
      - 'GetCallerIdentity'
    userIdentity.type: 'IAMUser'
  filter_legitimate:
    userIdentity.arn|contains:
      - 'arn:aws:iam::[0-9]+:user/Administrator'
      - 'arn:aws:iam::[0-9]+:user/DevOps'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate IAM administrative activities
level: high
---
title: Suspicious Adobe Process Execution Pattern
id: 9f8e6d23-4b5c-5d9e-0f1b-3c4d5e6f7g8h
status: experimental
description: Detects suspicious execution patterns associated with Adobe product exploitation attempts including abnormal child process execution
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    Image|contains:
      - '\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe'
      - '\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter_legitimate:
    CommandLine|contains:
      - 'Adobe Update'
  condition: selection_parent and selection_child and not filter_legitimate
falsepositives:
  - Legitimate document-related script execution
level: medium
---
title: Supply Chain Data Exfiltration Indicators
id: 0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential data exfiltration patterns associated with supply chain compromises like the OnTrac breach
references:
  - https://attack.mitre.org/techniques/T1041/
  - https://attack.mitre.org/techniques/T1567/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1567.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_large_upload:
    Initiated: 'true'
    DestinationPort:
      - 443
      - 80
  filter_legitimate:
    DestinationHostname|contains:
      - '.office.com'
      - '.microsoft.com'
      - '.amazonaws.com'
      - '.adobe.com'
  condition: selection_large_upload and not filter_legitimate
falsepositives:
  - Legitimate large data transfers to cloud services
level: medium

// Hunt for suspicious AWS API calls consistent with North Korean TTPs
AWSCloudTrail
| where EventName in ('CreateAccessKey', 'DeleteAccessKey', 'UpdateAccessKey', 'AttachUserPolicy', 'PutUserPolicy')
| where UserIdentityType == 'IAMUser'
| where SourceIpAddress !in (AuthorizedIPs)
| project TimeGenerated, EventName, UserIdentityArn, SourceIpAddress, UserAgent
| order by TimeGenerated desc

// Check for unauthorized Adobe vulnerability exploitation attempts
DeviceProcessEvents
| where InitiatingProcessFileName in ('Acrobat.exe', 'AcroRd32.exe', 'Photoshop.exe', 'Illustrator.exe')
| where FileName in ('powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe')
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine
| order by Timestamp desc

// Detect potential data exfiltration from supply chain compromise
DeviceNetworkEvents
| where InitiatingProcessFileVersion contains 'OnTrac' 
   or RemoteUrl contains 'ontrac'
| where RemotePort in (80, 443, 21, 22)
| where SentBytes > 1000000
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, SentBytes
| summarize TotalBytesSent=sum(SentBytes) by DeviceName, RemoteUrl
| order by TotalBytesSent desc

-- Hunt for potential compromise indicators in cloud-related tools
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ 'aws'
   OR Name =~ 'az'
   OR Name =~ 'gcloud'
   OR Exe =~ '\\Program Files\\AWS'
   OR Exe =~ '\\AppData\\Local\\AWS'

-- Check for unauthorized Adobe software or suspicious installation paths
SELECT FullPath, Size, ModTime, Mode
FROM glob(globs='\Program Files\Adobe\**\*.exe')
WHERE ModTime < now() - 90*24*60*60
   OR NOT FullPath =~ '\\Acrobat DC\\Acrobat\\Acrobat.exe'
   AND NOT FullPath =~ '\\Acrobat Reader DC\\Reader\\AcroRd32.exe'

-- Identify unusual network connections to cloud providers
SELECT RemoteAddress, RemotePort, Pid, Family, State, Type
FROM netstat()
WHERE RemotePort IN (443, 80, 22)
   AND State =~ 'ESTABLISHED'
   AND NOT RemoteAddress IN ('127.0.0.1', '::1')

# Adobe Patch Verification Script
# Checks for critical Adobe security updates and identifies vulnerable installations

function Check-AdobeSecurityUpdates {
    Write-Host "Checking Adobe security patches..." -ForegroundColor Cyan
    
    # Check Acrobat Reader
    $acrobatPaths = @(
        "${env:ProgramFiles}\Adobe\Acrobat DC\Acrobat\Acrobat.exe",
        "${env:ProgramFiles(x86)}\Adobe\Acrobat DC\Acrobat\Acrobat.exe",
        "${env:ProgramFiles}\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe",
        "${env:ProgramFiles(x86)}\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
    )
    
    $minVersion = "23.008.20470"  # Current secure baseline
    $vulnerableFound = $false
    
    foreach ($path in $acrobatPaths) {
        if (Test-Path $path) {
            $versionInfo = (Get-Item $path).VersionInfo.FileVersion
            $version = [version]$versionInfo
            $minVer = [version]$minVersion
            
            if ($version -lt $minVer) {
                Write-Host "VULNERABLE: $path (Version: $versionInfo)" -ForegroundColor Red
                $vulnerableFound = $true
            } else {
                Write-Host "SECURE: $path (Version: $versionInfo)" -ForegroundColor Green
            }
        }
    }
    
    # Check for recent Adobe update installations
    $recentUpdates = Get-WinEvent -FilterHashtable @{
        LogName='Application'; ProviderName='MsiInstaller';
        StartTime=(Get-Date).AddDays(-30)
    } -ErrorAction SilentlyContinue | Where-Object {
        $_.Message -like '*Adobe*' -and $_.Message -like '*update*'
    } | Sort-Object TimeCreated -Descending
    
    if ($recentUpdates) {
        Write-Host "Recent Adobe updates found:" -ForegroundColor Cyan
        $recentUpdates | Select-Object TimeCreated, Message | Format-List
    }
    
    if ($vulnerableFound) {
        Write-Host "ACTION REQUIRED: Update Adobe products immediately" -ForegroundColor Yellow
    } else {
        Write-Host "All Adobe products appear secure" -ForegroundColor Green
    }
}

# Check for AWS credential exposure
function Test-AWSCredentialExposure {
    Write-Host "Checking for exposed AWS credentials..." -ForegroundColor Cyan
    
    $commonPaths = @(
        "$env:USERPROFILE\.aws",
        "$env:USERPROFILE\Documents\aws",
        "$env:APPDATA\aws",
        "$env:LOCALAPPDATA\aws"
    )
    
    $credentialsFound = $false
    
    foreach ($path in $commonPaths) {
        if (Test-Path $path) {
            $credentialsFiles = Get-ChildItem -Path $path -Include "credentials", "config" -Recurse -ErrorAction SilentlyContinue
            
            foreach ($file in $credentialsFiles) {
                $content = Get-Content $file -Raw -ErrorAction SilentlyContinue
                if ($content -match "aws_access_key_id" -and $content -match "aws_secret_access_key") {
                    Write-Host "POTENTIAL EXPOSURE: AWS credentials found in $($file.FullName)" -ForegroundColor Red
                    $credentialsFound = $true
                }
            }
        }
    }
    
    if (-not $credentialsFound) {
        Write-Host "No exposed AWS credentials detected in common locations" -ForegroundColor Green
    }
}

# Execute checks
Check-AdobeSecurityUpdates
Test-AWSCredentialExposure