NEW LAB: Abu Jibal (APT34 / OilRig) – Iranian Cyber Threat Analysis

By /

Listen to this Post

Featured Image
APT34 (OilRig), an Iranian state-sponsored threat group, continues to target the oil and gas sector across the Middle East. This lab focuses on advanced attack techniques used by the group, including:

  • Password Filter DLL Attacks
  • RunPE In-Memory Execution
  • Windows Kernel Elevation
  • Malicious JavaScript Payloads
  • Custom Keyloggers

Access the lab here: XINTRA Lab

You Should Know: APT34 (OilRig) Attack Techniques & Defense

1. Password Filter DLL Attacks

APT34 uses Password Filter DLLs to intercept and exfiltrate credentials.

Detection & Mitigation:

 Check registered password filters in registry 
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "Notification Packages"

Monitor for suspicious DLLs in: 
C:\Windows\System32

Mitigation:

  • Restrict DLL loading via SRP (Software Restriction Policies)
  • Use LSA Protection (Enable `RunAsPPL` in registry)

2. RunPE In-Memory Execution (Process Hollowing)

APT34 injects malicious payloads into legitimate processes.

Detection:

 Check for abnormal child processes (Linux) 
ps aux | grep -E '(explorer.exe|svchost.exe)' --color=auto

Windows (PowerShell) 
Get-WmiObject Win32_Process | Select-Object Name, ProcessId, ParentProcessId | Format-Table

Mitigation:

  • Enable AMSI (Antimalware Scan Interface)
  • Deploy Sysmon with process creation logging: 
    <Sysmon> 
<EventFiltering> 
<RuleGroup name="Process Creation" groupRelation="or"> 
<ProcessCreate onmatch="include"> 
<ParentImage name="Suspicious Parent" condition="contains">powershell.exe</ParentImage> 
</ProcessCreate> 
</RuleGroup> 
</EventFiltering> 
</Sysmon>

3. Windows Kernel Elevation (CVE-2024-XXXX Exploits)

APT34 exploits kernel drivers for privilege escalation.

Detection:

 List loaded kernel drivers 
driverquery /v

Check for unsigned drivers 
Get-WmiObject Win32_PnPSignedDriver | Where-Object {$_.IsSigned -eq $false}

Mitigation:

  • Enable HVCI (Hypervisor-Protected Code Integrity)
  • Block vulnerable drivers via Windows Defender Application Control (WDAC)

4. Malicious JavaScript Payloads (Living-off-the-Land)

APT34 delivers malware via obfuscated JS scripts.

Detection:

 Monitor for suspicious JS execution (Linux) 
sudo grep -r "eval(" /var/www/

Windows (PowerShell) 
Get-ChildItem -Path C:\ -Include .js -Recurse -ErrorAction SilentlyContinue | Select-String "WScript.Shell"

Mitigation:

  • Disable WScript & CScript via GPO: 
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings" -Name "Enabled" -Value 0

5. Custom Keyloggers (Hooking API Calls)

APT34 deploys keyloggers via SetWindowsHookEx.

Detection:

 Check for active hooks (Windows) 
Get-Process | Where-Object { $_.Modules.ModuleName -like "winhook" }

Monitor keyboard events (Linux) 
sudo apt install auditd 
sudo auditctl -a exit,always -F arch=b64 -S keyboard

Mitigation:

  • Use Endpoint Detection & Response (EDR) tools
  • Block unusual DLL injections via AppLocker

What Undercode Say

APT34 remains a high-risk threat due to its advanced evasion techniques. Key takeaways:
– Monitor LSA & registry for Password Filter DLLs
– Restrict in-memory execution via AMSI & Sysmon
– Block unsigned drivers with WDAC
– Disable WScript to prevent JS-based attacks
– Audit keyboard hooks to detect keyloggers

Expected Output:

 Sample command to detect APT34 TTPs 
sudo grep -i "apt34" /var/log/syslog

Prediction:

APT34 will likely enhance fileless attacks using PowerShell & .NET reflection in 2024.

Lab URL: XINTRA APT34 Lab

References:

Reported By: Lina L – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram

Related Posts: