Astrill VPN Egress on Corporate Authentication

Rows are users (and, if the optional branch is kept, devices) with Astrill sign-ins or client executions; a sign-in match is a reason to look, never a finding alone.

// Hunt: Astrill VPN egress on corporate sign-ins (Microsoft Entra ID).
let AstrillIPs = dynamic(["104.206.40.138", "104.250.148.58", "174.128.251.99", "192.119.10.67", "192.119.11.250", "192.74.247.161", "198.135.49.154", "198.2.228.20", "199.115.99.34", "204.188.232.195", "38.140.49.92", "70.39.103.3", "74.222.20.18", "74.63.233.50"]);
// optional: the Spur list (https://storage.googleapis.com/spur-astrill-vpn/ips.txt) loaded into a Sentinel watchlist named AstrillVPN with the address as SearchKey; exits rotate, so refresh the watchlist
let SpurIPs = _GetWatchlist("AstrillVPN") | project IPAddress = tostring(SearchKey);
union
// optional: the Astrill client on an endpoint shows installation, not use against corporate resources
( DeviceProcessEvents
  | where Timestamp > ago(30d)
  | where FileName in~ ("astrill.exe", "Astrill") or FolderPath contains "\\astrill\\" or FolderPath contains "/Applications/Astrill.app/"
  | project Timestamp, Subject = DeviceName, Signal = "astrill-client", Address = "", Success = true, Evidence = FolderPath ),
( union SigninLogs, AADNonInteractiveUserSignInLogs
  | where TimeGenerated > ago(30d)
  | where IPAddress in (AstrillIPs)
      // optional: the Spur list watchlist
      or IPAddress in (SpurIPs)
  | project Timestamp = TimeGenerated, Subject = UserPrincipalName, Signal = "astrill-signin", Address = IPAddress, Success = ResultType == "0", Evidence = AppDisplayName )
| summarize Events = count(), Successes = countif(Success), Addresses = make_set(Address), Apps = make_set(Evidence, 10),
            FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Signals = make_set(Signal) by Subject
| sort by LastSeen desc

Corroborating rule for the optional endpoint match: the Astrill client alone is weak evidence and should not alert on its own.

# optional: this whole rule is the weak endpoint match; do not alert on it alone
title: Astrill VPN Client Executed on a Corporate Endpoint
id: 2d86b7a4-1c3f-4a59-8e1e-93a0c5d7f6b2
status: experimental
description: >
  Detects the Astrill VPN client running on a Windows or macOS endpoint. Astrill
  appears in nearly every substantial report on DPRK remote-worker fraud, but it
  is a commercial consumer VPN, so an installed client is weak evidence that
  corroborates an identity-side match on its exit addresses and proves nothing alone.
references:
  - https://spur.us/blog/astrill-vpn-and-dprk-remote-worker-fraud/
  - https://cloud.google.com/blog/topics/threat-intelligence/mitigating-dprk-it-worker-threat
logsource:
  category: process_creation
detection:
  selection_name:
    Image|endswith:
      - '\astrill.exe'
      - '/Astrill'
  selection_path:
    Image|contains:
      - '\astrill\'
      - '/Applications/Astrill.app/'
  condition: 1 of selection_*
falsepositives:
  - An employee running Astrill personally, notably where the internet is filtered
level: low

Sign-ins from the published exit addresses per user and address; the subsearch adds the Spur list from a lookup.

```Placeholder: index=identity holds Okta, Entra ID or ms:aad:signin events with src_ip, user and app extracted.```
index=identity (sourcetype=okta OR sourcetype=azuread OR sourcetype="ms:aad:signin")
    (src_ip IN ("104.206.40.138", "104.250.148.58", "174.128.251.99", "192.119.10.67", "192.119.11.250", "192.74.247.161", "198.135.49.154", "198.2.228.20", "199.115.99.34", "204.188.232.195", "38.140.49.92", "70.39.103.3", "74.222.20.18", "74.63.233.50")
     ```optional: the Spur list (https://storage.googleapis.com/spur-astrill-vpn/ips.txt) loaded as the lookup astrill_vpn_ips.csv with an ip column; exits rotate, so refresh the lookup```
     OR [| inputlookup astrill_vpn_ips.csv | rename ip AS src_ip | fields src_ip])
| stats count AS signins min(_time) AS first_seen max(_time) AS last_seen values(app) AS apps BY user, src_ip
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

Free-text match of the 14 addresses over ingested Entra ID or Okta events; user is extracted from userPrincipalName or alternateId when present.

// Hunt: Astrill VPN egress on corporate sign-ins. The address is matched as a whole token in the raw event, so no parser field name is assumed.
regex("(?:^|[^0-9.])(?<matchedIp>104[.]206[.]40[.]138|104[.]250[.]148[.]58|174[.]128[.]251[.]99|192[.]119[.]10[.]67|192[.]119[.]11[.]250|192[.]74[.]247[.]161|198[.]135[.]49[.]154|198[.]2[.]228[.]20|199[.]115[.]99[.]34|204[.]188[.]232[.]195|38[.]140[.]49[.]92|70[.]39[.]103[.]3|74[.]222[.]20[.]18|74[.]63[.]233[.]50)(?:[^0-9.]|$)")
| regex("(?:userPrincipalName|alternateId)[^a-zA-Z0-9_]+(?<user>[^\"]+)", strict=false)
| groupBy([matchedIp, user], function=[count(as=events), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])
| sort(lastSeen, order=desc)

Sign-ins from the published exit addresses per account and address over the Entra ID and Okta integrations; check which user field your integration version fills.

FROM logs-azure.signinlogs-*, logs-okta*
| WHERE @timestamp > NOW() - 30 days
| EVAL src = TO_STRING(source.ip)
| WHERE src IN ("104.206.40.138", "104.250.148.58", "174.128.251.99", "192.119.10.67", "192.119.11.250", "192.74.247.161", "198.135.49.154", "198.2.228.20", "199.115.99.34", "204.188.232.195", "38.140.49.92", "70.39.103.3", "74.222.20.18", "74.63.233.50")
| EVAL account = COALESCE(azure.signinlogs.properties.user_principal_name, user.name)
| EVAL succeeded = CASE(event.outcome == "success", 1, 0)
| STATS sign_ins = COUNT(*), successes = SUM(succeeded), first_seen = MIN(@timestamp), last_seen = MAX(@timestamp) BY account, src
| SORT last_seen DESC

Local check for the Astrill client running or installed, on Windows and macOS.

-- optional: this whole query is the weak endpoint match (the Astrill client on this Windows or macOS endpoint); do not alert on it alone
SELECT 'running' AS signal, name AS detail, path
FROM processes
WHERE lower(name) IN ('astrill', 'astrill.exe') OR path LIKE '%/Applications/Astrill.app/%' OR lower(path) LIKE '%\astrill\%'
UNION ALL
SELECT 'installed', filename, path
FROM file
WHERE path = '/Applications/Astrill.app'