Scenario 06 · Nation-state · Sandworm Team
Sandworm is the GRU unit built to break things — the crew behind the only confirmed cyberattacks to black out a power grid, and behind NotPetya, the most expensive wiper in history. So we ran its tradecraft with the destruction removed: only the techniques that leave telemetry, no wipers. THRONE flagged every one — including two steps the first five scenarios never exercised.
Sandworm's calling card is destruction. But a wiped disk tells you nothing about detection once the data is gone — so we kept the tradecraft and dropped the payload.
Sandworm Team (ATT&CK G0034) is Russia's most destructive state actor — a unit of the GRU responsible for blacking out the Ukrainian power grid and for NotPetya. It is the one adversary whose signature is the irreversible endgame. That makes it the hardest group to study honestly, because the moment of interest destroys the evidence.
So this was a direct-execution run by hand on a single Windows victim, WIN-J50RP1JBGD4 (204.168.192.149 · internal 10.0.0.5): we issued Sandworm's non-destructive, observable techniques — new service creation, dumping sensitive registry hives, disabling the host firewall, and enumerating and mounting network shares — and left every wiper and destructive payload out. The goal was telemetry, not damage.
That scoping paid off. The run raised five alerts, one per technique, and THRONE caught all five. Two of them were signals none of the first five scenarios had triggered — host-firewall disabling and network-share enumeration — and ONYX, THRONE's AI SOC analyst, grouped the wave into a single investigable incident with its causality rebuilt from process lineage. No analyst touched any of it until there was something scored to look at.
Of every group in this campaign, Sandworm is the one defined by physical-world consequence. Knowing its real history is what makes the scoping decision — no wipers — the right one.
Sandworm Team is attributed to Unit 74455 of Russia's military-intelligence service, the GRU — specifically its Main Centre for Special Technologies (GTsST). Across vendors the same actor is tracked as Voodoo Bear, Telebots, IRIDIUM / Seashell Blizzard, and the BlackEnergy group. In October 2020 the U.S. Department of Justice indicted six named GRU officers of this unit for a string of the most damaging cyber operations on record. Unlike espionage crews that work to stay resident and quiet, Sandworm's operations are built to end in disruption — the intrusion is a means to a destructive, often strategically-timed, payload.
Its tradecraft reflects that endgame. Sandworm is known for purpose-built wipers and for targeting industrial control / operational-technology environments (power transmission in particular); for supply-chain compromise as an access vector; and, in the intrusion phase before the payload, for conventional living-off-the-land propagation — stolen credentials, SMB admin shares, service-based remote execution and WMI — the same primitives we exercise below.
| Year | Real-world operation | Effect |
|---|---|---|
| 2015 | BlackEnergy — Ukrainian power grid | First confirmed cyberattack to take down a power grid; roughly 230,000 customers lost power |
| 2016 | Industroyer / CrashOverride — Kyiv | Malware purpose-built to speak ICS protocols and trip substation breakers directly |
| 2017 | NotPetya | Wiper disguised as ransomware, seeded through a Ukrainian accounting-software update; estimated ~$10 billion in global damage |
| 2018 | Olympic Destroyer | Disrupted the PyeongChang Winter Olympics opening ceremony; notable for deliberate false-flag tradecraft |
| 2022 | Industroyer2 | Updated ICS malware aimed at a Ukrainian energy provider during the invasion |
NotPetya is the clearest lesson for a defender. It did not break in loudly — it moved laterally and quietly, using Mimikatz-harvested credentials, SMB admin shares and remote service execution to worm across flat networks, and only then destroyed. Everything detectable happened before the wipe. That is exactly the window this run lives in.
Sandworm's signature techniques are destructive: Data Destruction (T1485), Disk Wipe (T1561), Inhibit System Recovery (T1490) and System Shutdown/Reboot (T1529). None of these ran. A wiper proves nothing about detection, so we kept the tradecraft that precedes the payload and dropped the payload itself.
No C2, no automation, no theatre. We executed Sandworm's observable techniques directly on the target as a non-destructive command batch and watched what THRONE made of them. The honest framing matters: this is a controlled technique test, not a live operation.
Every technique ran on a single Windows victim, WIN-J50RP1JBGD4 (204.168.192.149 · internal 10.0.0.5), as a curated subset of the Sandworm kill chain — the recognisable moves, minus anything that would damage the box. The host streams Sysmon telemetry to the THRONE cloud tenant. Everything shown is the real lab: hostnames, IPs, alert IDs and ATT&CK mappings are reproduced as captured.
The autonomous, fact-chained emulations driven by a real command-and-control server are a separate report. Here the sequence was ours; the detections were THRONE's. The path from a command on the box to a scored, grouped incident is automatic, in seconds:
Behaviour on the box in, a triaged incident out. The same loop handled every other scenario; Sandworm needed no new plumbing — which is the point. Detection is a property of the pipeline, not of a per-adversary special case.
The subset we executed on WIN-J50RP1JBGD4, grouped by ATT&CK tactic. Each technique threw Windows telemetry that THRONE matched against its Sigma detections — and every one was caught. Two are marked NEW: the first time this signal has fired across the scenario series.
Read as a story, these five are the propagation spine of a Sandworm intrusion: get SYSTEM-level execution, steal credentials, lower the defenses, find the shares, mount them — the staging that would precede the wipe.
Issued with sc.exe create (equivalently New-Service). The command registers a service
under HKLM\SYSTEM\CurrentControlSet\Services and asks the Service Control Manager
(services.exe) to own it, which means whatever the service launches runs in SYSTEM context and
survives reboot. For Sandworm this is a landing primitive, not an afterthought: remote-execution tooling such as
PsExec works by installing and starting a service on the target, and a service is how an operator runs payloads with
the highest local privilege. We created a benign service — the telemetry, not a payload, was the objective.
Issued with reg save HKLM\SAM and reg save HKLM\SYSTEM (and typically
HKLM\SECURITY). Those hives hold the local account password hashes (SAM) and the boot key (SYSTEM)
needed to decrypt them; dumped to disk, they are cracked or passed offline. Sandworm pairs exactly this kind of
credential theft with SMB and service execution to move — it is the first half of the NotPetya propagation recipe,
where harvested secrets let the worm authenticate to the next host without ever touching an exploit.
Issued with netsh advfirewall set allprofiles state off. One command turns off Windows Defender
Firewall across the domain, private and public profiles, re-opening inbound SMB (445) and RPC (135) and the
administrative shares that worming depends on. Sandworm clears defensive obstacles before a lateral or destructive
phase; an open host firewall is what widens the blast radius so a single foothold becomes a network-wide event.
Issued with net view \\host, net share and net session. This lists the SMB
shares a host exposes and the sessions connected to it — cheap, native reconnaissance that maps where tools can be
staged and which machines are reachable. NotPetya enumerated network resources to choose where to spread next; the
same lookup here is the scout that precedes the mount.
Issued with net use \\host\ADMIN$ (or \C$). It authenticates to and mounts a remote
Windows administrative share over SMB. This is the classic worm primitive: copy a payload into ADMIN$
or C$, then execute it remotely via a service (back to T1543.003) or WMI.
Mounting an admin share and creating a service are two halves of one motion — which is why THRONE grouping them into
a single incident matters more than either alert alone.
Within seconds of each technique running, Sigma fired and ONYX — THRONE's AI SOC analyst — triaged the alerts. The full set of detections from this one run, all on WIN-J50RP1JBGD4, each tied to the ATT&CK technique that produced it:
| Alert | Detection | Sev | ATT&CK |
|---|---|---|---|
| ALR-175462 | Suspicious New Service Creation | HIGH | T1543.003 |
| ALR-175460 | Dumping of Sensitive Hives Via Reg.EXE | HIGH | T1003.002 |
| ALR-175459 | Firewall Disabled via Netsh.EXE | MED | T1562.004 |
| ALR-175464 | Share & Session Enumeration Using Net.EXE | LOW | T1135 |
| ALR-175463 | Windows Share Mount Via Net.EXE | LOW | T1021.002 |
Two HIGH-severity alerts anchor the wave — the new service and the SAM/SYSTEM hive dump — with a MEDIUM for the firewall tamper and two LOWs for the share enumeration and mount. The severities are not arbitrary; they track how close each step sits to an irreversible outcome.
ALR-175462 · Suspicious New Service Creation (T1543.003). The Sigma rule keys on service-installation telemetry — a new service registered with the Service Control Manager, with attention to the image path and the parent process that requested it. Benign software installs services too, so the signal is the combination: SYSTEM-context execution plus persistence plus a lineage that does not look like an MSI. ONYX scored it HIGH and placed it at the root of the incident, because a service is both how an operator keeps a foothold and how remote tooling lands.
ALR-175460 · Dumping of Sensitive Hives Via Reg.EXE
(T1003.002). The rule keys on reg.exe invoked with save or
export against HKLM\SAM, HKLM\SYSTEM or HKLM\SECURITY — the hive
path, not the user, because there is no routine administrative reason to serialise the SAM to disk. ONYX
escalated it as credential access: this is the step that turns one compromised host into the keys to the rest.
ALR-175459 · Firewall Disabled via Netsh.EXE (T1562.004) —
a new signal. The rule keys on netsh with the advfirewall … state off (or legacy
set opmode disable) command line. It is deliberately a low-noise detection: disabling the host firewall
from the command line is rare and almost always either an operator clearing the way or a careless admin — either
way worth a MEDIUM and an analyst's eyes.
ALR-175464 and ALR-175463 · share enumeration
(T1135) and admin-share mount (T1021.002) via
net.exe. Individually these are LOW — enumerating and mounting shares are everyday sysadmin actions. The
value is not either alert in isolation; it is that ONYX correlated them, the hive dump and the new service into one
incident, so the chain reads as the propagation precursor it is rather than four unrelated low-priority blips in a
queue.
Two of these had never fired in the first five scenarios: host-firewall disabling via
netsh (T1562.004) and network share & session enumeration
(T1135) — a defense-impairment step and a lateral-discovery step the earlier scenarios
never exercised. Both were caught the first time they appeared.
THRONE reconstructs each incident's causality from Sysmon's process GUIDs — parent to child, start to end — and renders it live on a 2D canvas in the Incidents tab. No log-grepping; the analyst sees the whole lineage, not a list of disconnected alerts.
For this run the reconstruction is what turns five separate detections into one readable story. Each
reg.exe, netsh.exe and net.exe invocation carries the GUID of the shell that
spawned it, and the new service carries the Service Control Manager as its parent — so THRONE stitches the run back
into the lineage the box actually reported:
Nothing above is inferred after the fact — each edge is a real parent/child relationship from a Sysmon process-creation event, keyed on the process GUID. The full interactive tree, with timestamps and command lines, lives on the incident in THRONE.
Sandworm is the adversary whose defining act erases its own evidence. You cannot do forensics on a wiped disk. The only place to win against this group is earlier — in the preparatory tradecraft.
That is the whole argument for this run. Every technique THRONE caught here — service creation, credential theft, firewall disabling, share discovery, admin-share mount — is staging. It is what Sandworm does in the hours or days before the payload, and it is the last point at which the outcome is still reversible. Detect the staging and you still have a host to save; detect the wipe and you have a disk to replace. The severities reflect this: the HIGHs sit on the steps that unlock the rest of the network, and the LOWs only stay low because ONYX folds them into the same chain rather than leaving them to rot in a queue.
What makes this adversary genuinely hard is that none of the staging is exotic. sc.exe,
reg.exe, netsh.exe and net.exe are signed, native Windows binaries that run
thousands of times a day in a legitimate estate. There is no malware signature to match, no C2 domain to block — the
signal is in intent and sequence, not in a file. A control that alerts on every net use drowns
its analysts; a control that ignores them misses the worm. The defensible middle is to score each step by how close
it sits to irreversibility and to reconstruct the chain so a human sees the shape, which is exactly what THRONE did
with no analyst in the loop until there was a scored incident waiting.
Four concrete controls that would have surfaced this chain in any production estate — none of them exotic, all of them cheap to run.
netsh advfirewall set allprofiles state off is rare, high-signal and a reliable pre-worm tell. Treat a
command-line firewall disable as a MEDIUM at least, and route it to a human — it is one of the cleanest early
warnings you can buy.
Key the rule on the hive path (HKLM\SAM, HKLM\SYSTEM,
HKLM\SECURITY), not on the user or parent. There is no benign operational reason to serialise the SAM at
scale; do not let an admin account launder it into noise.
Services launched from cmd, powershell or a temp/user-writable path — rather than a known
installer — are the PsExec and tool-staging signature. This one rule covers both persistence and the remote-execution
half of lateral movement.
On their own, net view and net use are everyday sysadmin actions and belong at LOW. Their
value is in sequence: enumeration followed by an ADMIN$/C$ mount, alongside a hive dump and
a new service, is the propagation precursor. Keep the causality reconstruction so an analyst sees one chain, not five
stray low alerts.