OctLurk and SilkLurk: Defending Central Asian Government Networks from APT Espionage

---
title: Potential OctLurk Loader Process Injection
id: a1b2c3d4-5678-49ef-a1b2-c3d4e5f6a7b8
status: experimental
description: Detects suspicious process hollowing behavior often associated with the OctLurk loader, specifically targeting Windows system binaries.
references:
 - https://thehackernews.com/2026/08/suspected-chinese-speaking-hackers.html
author: Security Arsenal
date: 2026/08/15
tags:
 - attack.defense_evasion
 - attack.t1055.012
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith:
     - '\winword.exe'
     - '\excel.exe'
   Image|endswith:
     - '\svchost.exe'
     - '\dllhost.exe'
   CommandLine|contains:
     - '-inject'
     - '-load'
 condition: selection
falsepositives:
 - Legitimate administration tools
level: high
---
title: SilkLurk Persistence via WMI Event Consumer
id: b2c3d4e5-6789-49ef-a1b2-c3d4e5f6a7b9
status: experimental
description: Detects the creation of WMI event consumers used by SilkLurk for persistence, characterized by specific script patterns.
references:
 - https://thehackernews.com/2026/08/suspected-chinese-speaking-hackers.html
author: Security Arsenal
date: 2026/08/15
tags:
 - attack.persistence
 - attack.t1546.003
logsource:
 category: wmi_event
 product: windows
detection:
 selection:
   EventID: 10 # Event Filter created
   Operation: Created
   Query|contains:
     - 'ActiveScriptEventConsumer'
     - 'CommandLineEventConsumer'
   ScriptText|contains:
     - 'powershell -enc'
     - 'Invoke-Expression'
 condition: selection
falsepositives:
 - Legitimate software installation
level: medium

// Hunt for SilkLurk C2 Traffic and OctLurk Execution
let TimeFrame = 1d;
DeviceProcessEvents
| where Timestamp >= ago(TimeFrame)
// Look for common OctLurk loader decoy processes
| where ProcessCommandLine has "-enc" and ProcessCommandLine has "powershell"
| extend ProcessName = tostring(FolderPath), Account = tostring(AccountName)
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp >= ago(TimeFrame)
    // SilkLurk often uses high entropy User-Agent strings or specific intervals
    | where RemotePort == 443 
    | where InitiatingProcessFileName in ("powershell.exe", "cmd.exe", "wscript.exe")
    | summarize ConnectionCount = count(), MaxSentBytes = max(SentBytes) by DeviceId, InitiatingProcessAccountId, RemoteUrl
) on DeviceId, InitiatingProcessAccountId
| project Timestamp, DeviceName, Account, ProcessName, ProcessCommandLine, RemoteUrl, ConnectionCount, MaxSentBytes
| where ConnectionCount > 10 and MaxSentBytes < 5000 // Consistent small beacons

-- Hunt for OctLurk and SilkLurk Artifacts
SELECT 
  OSPath.Basename as FileName,
  OSPath.Path as FilePath,
  Size,
  Mtime as ModifiedTime,
  Atime as AccessedTime,
  Ctime as CreatedTime,
  Mode
FROM glob(globs="C:\Windows\Temp\**\*.tmp")
WHERE FileName =~ 'octlurk' 
   OR FileName =~ 'silk'
   OR FileName =~ 'loader'

UNION ALL

-- Hunt for Suspicious Registry Persistence
SELECT 
  key.path as KeyPath,
  key.value as ValueName,
  key.data as ValueData,
  key.mtime as ModifiedTime
FROM read_reg_key(globs="HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\*")
WHERE ValueData =~ 'powershell' 
   AND ValueData =~ '-enc'

# OctLurk and SilkLurk Identification Script
# Requires Administrator Privileges

Write-Host "[+] Scanning for OctLurk and SilkLurk indicators..." -ForegroundColor Cyan

# 1. Check for Suspicious Processes (OctLurk Loader Patterns)
$suspiciousProcesses = Get-Process | Where-Object { 
    $_.ProcessName -match "svchost" -or 
    $_.ProcessName -match "dllhost" 
} | Where-Object { 
    $_.MainWindowTitle -eq "" -and 
    $_.StartTime -lt (Get-Date).AddHours(-24) 
}

if ($suspiciousProcesses) {
    Write-Host "[!] Alert: Found potentially spoofed system processes:" -ForegroundColor Red
    $suspiciousProcesses | Select-Object ProcessName, Id, Path, StartTime | Format-Table
} else {
    Write-Host "[-] No suspicious loader processes detected." -ForegroundColor Green
}

# 2. Check Registry Run Keys for SilkLurk Persistence
$runKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)

Write-Host "[+] Scanning Registry Run Keys for encoded commands..." -ForegroundColor Cyan
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-Item $key | Select-Object -ExpandProperty Property | ForEach-Object {
            $propValue = (Get-ItemProperty -Path "$key" -Name $_).$_
            if ($propValue -match "powershell" -and $propValue -match "-enc|-e|-encodedcommand") {
                Write-Host "[!] Suspicious persistence found in $key" -ForegroundColor Red
                Write-Host "    Name: $_" -ForegroundColor Yellow
                Write-Host "    Value: $propValue" -ForegroundColor Yellow
            }
        }
    }
}

Write-Host "[+] Scan complete." -ForegroundColor Cyan