BengalSEO Bing Poisoning Campaign Delivers MayaBot and Tech Support Scams — Detection and Defense Guide

---
title: Browser-Spawned Installer or Script Execution - SEO Poisoning Delivery
id: 3f8a1b72-5c6d-4e9a-b1f2-8d4c6a7e9f01
status: experimental
description: Detects web browsers spawning installers, script interpreters, or command shells, consistent with SEO poisoning / malvertising drive-by downloads such as the BengalSEO campaign delivering MayaBot via trojanized installers.
references:
  - https://thehackernews.com/2026/09/bengalseo-poisons-bing-search-results.html
  - https://attack.mitre.org/techniques/T1189/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/09/24
tags:
  - attack.initial_access
  - attack.t1189
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_child:
    Image|endswith:
      - '\msiexec.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Browser-integrated installers for legitimate software (rare in hardened environments)
  - Enterprise software distribution via browser portals
level: high
---
title: Executable Launched From User Downloads Directory
id: 9c2e4d81-7a3b-4f5c-8e6d-1b9a3c5e7f02
status: experimental
description: Detects execution of binaries directly from user Downloads folders, a common final step in SEO poisoning delivery chains where victims are lured into running trojanized installers impersonating legitimate software.
references:
  - https://thehackernews.com/2026/09/bengalseo-poisons-bing-search-results.html
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/09/24
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\Downloads\'
  filter_known_updaters:
    Image|endswith:
      - '\MicrosoftEdgeUpdate.exe'
      - '\OneDriveSetup.exe'
  condition: selection and not filter_known_updaters
falsepositives:
  - Users manually installing legitimate downloaded software - tune with allowlists for approved installers by hash or signer
level: medium
---
title: Persistence via Run Key From User Profile Path
id: 5b7f3a19-2d8e-4c6a-9f1b-4e8d2a6c3b04
status: experimental
description: Detects registry Run key persistence entries pointing to executables in user-writable profile paths (Downloads, AppData, Temp), consistent with MayaBot-style botnet persistence following SEO poisoning delivery.
references:
  - https://thehackernews.com/2026/09/bengalseo-poisons-bing-search-results.html
  - https://attack.mitre.org/techniques/T1060/
author: Security Arsenal
date: 2026/09/24
tags:
  - attack.persistence
  - attack.t1060
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
  selection_path:
    Details|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - 'C:\Users\Public\'
  condition: selection_key and selection_path
falsepositives:
  - Legitimate per-user applications persisting from AppData (e.g., Teams, Slack, OneDrive) - filter by signer and known paths
level: high

// Stage 1: Browser-spawned installers and script interpreters (SEO poisoning delivery)
let browsers = dynamic(["msedge.exe", "chrome.exe", "firefox.exe", "brave.exe"]);
let children = dynamic(["msiexec.exe", "powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (browsers)
| where FileName in~ (children)
| project TimeGenerated, DeviceName, AccountName,
    ParentProcess = InitiatingProcessFileName,
    ChildProcess = FileName, ProcessCommandLine,
    InitiatingProcessCommandLine, SHA256, ReportId
| sort by TimeGenerated desc;

// Stage 2: Network connections from recently executed binaries in Downloads folders
// (candidate first-beacon / C2 behavior for payloads like MayaBot)
let recent_download_execs =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FolderPath has @"\Downloads\"
    | summarize FirstExec = min(TimeGenerated) by DeviceName, FileName, FolderPath, SHA256;
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl !has_any ("microsoft.com", "bing.com", "windows.com")
    or RemoteIPType == "PublicIP"
| join kind=inner recent_download_execs on DeviceName, FileName
| project FirstExec, TimeGenerated, DeviceName, FileName, FolderPath, SHA256,
    RemoteIP, RemoteUrl, RemotePort
| sort by FirstExec desc

// Unauthorized RMM tool installation - common endgame of tech support scam calls
let rmm_tools = dynamic(["anydesk.exe", "teamviewer.exe", "teamviewer_service.exe",
    "screenconnect.clientservice.exe", "rustdesk.exe", "ultraviewer.exe",
    "ammyy.exe", "supremo.exe", "splashtop.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ (rmm_tools)
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    dcount(DeviceName) by FileName, SHA256
| where FirstSeen > ago(14d)  // newly appeared in environment
| sort by FirstSeen desc

-- BengalSEO / SEO-poisoning endpoint sweep:
-- Find MOTW-tagged executables in Downloads plus Run-key persistence in user-writable paths

-- Part 1: Executables in Downloads with Mark-of-the-Web (Zone.Identifier ADS)
SELECT FullPath, Size, Mtime,
       parse_string_with_regex(string=read_file(path=FullPath + ':Zone.Identifier'),
                               regex='ZoneId=(\\d)').g1 AS ZoneId
FROM glob(globs='C:/Users/*/Downloads/**/*.exe')
WHERE ZoneId = '3'

-- Part 2: Run-key persistence entries pointing to user-writable locations
SELECT Name, Key.FullPath AS KeyPath,
       Data.value AS CommandLine,
       Key.Mtime AS ModifiedTime
FROM read_reg_key(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*')
WHERE CommandLine =~ 'Downloads|AppData\\\\Local\\\\Temp|Users\\\\Public'

-- Live triage: processes running from user-writable paths with active connections
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(Downloads|AppData\\\\Local\\\\Temp|Users\\\\Public)'

SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status = 'ESTABLISHED' AND RemoteAddr !~ '^(10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.)'

# BengalSEO / SEO-poisoning audit and hardening script
# Run as SYSTEM or local admin. Outputs JSON findings for SIEM ingestion.

$findings = @()

# --- 1. Audit Downloads folders for internet-sourced executables (MOTW ZoneId=3) ---
Get-ChildItem 'C:\Users\*\Downloads' -Include *.exe,*.msi,*.bat,*.ps1,*.js,*.vbs,*.scr -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $zone = Get-Content -Path $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue
    if ($zone -match 'ZoneId=3') {
        $findings += [pscustomobject]@{
            Type = 'MOTW_Executable_In_Downloads'
            Path = $_.FullName
            LastWrite = $_.LastWriteTime
            SHA256 = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        }
    }
}

# --- 2. Audit Run keys for persistence in user-writable paths ---
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match 'Downloads|AppData\\Local\\Temp|Users\\Public'
        } | ForEach-Object {
            $findings += [pscustomobject]@{
                Type = 'Suspicious_RunKey_Persistence'
                Path = "$key\$($_.Name)"
                Command = $_.Value
            }
        }
    }
}

# --- 3. Verify SmartScreen enforcement (Defender + Edge) ---
$smartscreen = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name EnableSmartScreen -ErrorAction SilentlyContinue
if (-not $smartscreen -or $smartscreen.EnableSmartScreen -ne 1) {
    New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Force | Out-Null
    Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name EnableSmartScreen -Value 1
    Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name ShellSmartScreenLevel -Value 'Block'
    $findings += [pscustomobject]@{ Type = 'Remediation'; Path = 'SmartScreen'; Command = 'Enforced Block mode' }
}
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Force -ErrorAction SilentlyContinue | Out-Null
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Name SmartScreenEnabled -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Edge' -Name PreventSmartScreenPromptOverride -Value 1

# --- 4. Detect unsanctioned RMM tools (tech support scam indicator) ---
$rmm = @('AnyDesk','TeamViewer','ScreenConnect','RustDesk','UltraViewer','Ammyy','Supremo')
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall',
              'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' -ErrorAction SilentlyContinue |
    Get-ItemProperty | Where-Object { $n = $_.DisplayName; $rmm | Where-Object { $n -match $_ } } |
    ForEach-Object {
        $findings += [pscustomobject]@{ Type = 'Unsanctioned_RMM_Installed'; Path = 'InstalledSoftware'; Command = $_.DisplayName }
    }

$findings | ConvertTo-Json -Depth 3 | Out-File "$env:ProgramData\seo_poisoning_audit_$(Get-Date -Format yyyyMMdd).json"
$findings | Format-Table -AutoSize