SHADOW-EARTH-053: China-Linked Espionage Campaign — Detection & Defense Guide

---
title: Suspicious Parent-Child Process Pair (Word/Excel spawning PowerShell)
id: 3d1f1f8e-5e6b-4b8a-9e1c-1a2b3c4d5e6f
status: experimental
description: Detects suspicious process execution where an Office application spawns a PowerShell instance, a common technique used in spear-phishing documents associated with SHADOW-EARTH-053.
references:
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\POWERPNT.EXE'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
  filter:
    CommandLine|contains: 'C:\Program Files\'
falsepositives:
  - Legitimate macro usage for business automation (rare)
level: high
---
title: Potential Web Shell Activity via IIS Worker Process
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious command execution spawned by the IIS worker process (w3wp.exe), indicative of web shell exploitation often used by SHADOW-EARTH-053.
references:
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\w3wp.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\whoami.exe'
      - '\net.exe'
falsepositives:
  - Legitimate server management scripts
level: critical
---
title: Suspicious Certutil Download Usage
id: 9e0f1a2b-3c4d-5e6f-7a8b-9c0d1e2f3a4b
status: experimental
description: Detects the use of certutil to download files from the internet, a common LOLBin used for staging payloads.
references:
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\certutil.exe'
    CommandLine|contains: 'urlcache'
    CommandLine|contains: 'fetch'
falsepositives:
  - Administrative troubleshooting (rare)
level: medium

// Hunt for SHADOW-EARTH-053 TTPs: Suspicious PowerShell and Child Processes
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ('winword.exe', 'excel.exe', 'w3wp.exe')
| where FileName in~ ('powershell.exe', 'cmd.exe', 'certutil.exe', 'powershell_ise.exe')
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessAccountName, FolderPath
| order by Timestamp desc

-- Hunt for processes spawned by IIS w3wp.exe or Office apps that execute shell commands
SELECT Pid, Name, CommandLine, Exe, Parent.Pid AS ParentPid, Parent.Name AS ParentName, Username, CreateTime
FROM pslist()
WHERE Parent.Name =~ "w3wp.exe" OR Parent.Name =~ "WINWORD.EXE" OR Parent.Name =~ "EXCEL.EXE"
  AND (Name =~ "cmd.exe" OR Name =~ "powershell.exe")

<#
.SYNOPSIS
    Audit for Suspicious Scheduled Tasks and Services.
.DESCRIPTION
    Checks for scheduled tasks or services running with suspicious binaries or in unusual paths,
    common indicators of persistence from actors like SHADOW-EARTH-053.
#>

Write-Host "[+] Initiating Persistence Audit..." -ForegroundColor Cyan

# Check for Scheduled Tasks running PowerShell with encoded commands
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Actions.Execute -like '*powershell*' -and $_.Actions.Arguments -like '*-e*' -or $_.Actions.Arguments -like '*-enc*' }

if ($suspiciousTasks) {
    Write-Host "[!] WARNING: Found Scheduled Tasks with encoded PowerShell commands:" -ForegroundColor Red
    $suspiciousTasks | ForEach-Object { Write-Host "Task: $($_.TaskName) - Command: $($_.Actions.Execute) $($_.Actions.Arguments)" }
} else {
    Write-Host "[+] No suspicious Scheduled Tasks detected." -ForegroundColor Green
}

# Check for Services with unsigned or suspicious binaries in user directories
Write-Host "[+] Checking Service Path Integrity..."
$suspiciousServices = Get-WmiObject Win32_Service | Where-Object { 
    $_.PathName -match 'C:\Users\' -or $_.PathName -match 'C:\Temp\' -or $_.PathName -match '\\recycle\' 
}

if ($suspiciousServices) {
    Write-Host "[!] WARNING: Found Services running from user/temp directories:" -ForegroundColor Red
    $suspiciousServices | ForEach-Object { Write-Host "Service: $($_.DisplayName) - Path: $($_.PathName)" }
} else {
    Write-Host "[+] No suspicious Service paths detected." -ForegroundColor Green
}