LEVERAGING YARA AND SIGMA RULES TO DETECT CHINESE STATE-SPONSORED HACKING GROUPS OF THE "TYPHOON" TYPE

This study addresses the escalating cyber threat posed by Chinese state-sponsored hacking groups, particularly the "Typhoon" class (Salt Typhoon and Volt Typhoon) which target critical infrastructure through stealthy and persistent techniques. The research aims to enhance detection capabilities against these advanced persistent threats by analysing their tactics, techniques, and procedures and by developing YARA and Sigma rules. The methodology involves mapping observed TTPs to MITRE ATT&CK and designing detection rules that identify key indicators of compromise in both system files and event logs. The main contribution of the study is the implementation of rule-based detection mechanisms that proactively uncover malicious activities often missed by traditional signature-based tools.