BengalSEO MayaBot SEO Poisoning Operation: OTX Pulse Analysis — Enterprise Detection Pack for Search Engine Poisoning & Tech Support Scam Infrastructure

---
title: BengalSEO MayaBot Trojanized Installer Execution via SEO-Poisoned Download
id: 9f1c2a44-7b3e-4d21-9a5c-bengalseo00001
status: experimental
description: Detects execution of installer binaries masquerading as printer drivers, iTunes, or streaming software downloaded from browser processes — consistent with BengalSEO MayaBot delivery via SEO poisoning.
author: Security Arsenal Threat Intelligence
references:
    - https://thedfirreport.com/2026/08/24/bengalseo-part-1-anatomy-of-the-operation/
date: 2026/09/07
tags:
    - attack.initial_access
    - attack.t1189
    - attack.t1204
logsource:
    category: process_creation
    product: windows
    definition: sysmon
detection:
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
    selection_name:
        Image|endswith:
            - '\Downloads\'
        CommandLine|contains:
            - 'driver'
            - 'setup'
            - 'install'
    selection_lure:
        CommandLine|contains:
            - 'printer'
            - 'itunes'
            - 'mytv'
            - 'streaming'
            - 'techsupport'
            - 'support_tool'
    condition: selection_parent and (selection_name or selection_lure)
falsepositives:
    - Legitimate driver and software installations by end users
level: high
---
title: BengalSEO Persistence via Run Key or Scheduled Task Masquerading as Software Update Service
id: 9f1c2a44-7b3e-4d21-9a5c-bengalseo00002
status: experimental
description: Detects registry Run key persistence or scheduled task creation using names mimicking printer/software update services, as observed with MayaBot post-install persistence.
author: Security Arsenal Threat Intelligence
references:
    - https://thedfirreport.com/2026/08/24/bengalseo-part-1-anatomy-of-the-operation/
date: 2026/09/07
tags:
    - attack.persistence
    - attack.t1060
    - attack.t1547.001
    - attack.t1053.005
logsource:
    category: registry_set
    product: windows
    definition: sysmon
detection:
    selection_key:
        TargetObject|contains:
            - '\CurrentVersion\Run'
            - '\CurrentVersion\RunOnce'
    selection_value:
        Details|contains:
            - 'driver'
            - 'update'
            - 'support'
            - 'printer'
    filter_signed_path:
        Details|startswith:
            - 'C:\Program Files\Microsoft Office'
            - 'C:\Windows\System32'
    condition: selection_key and selection_value and not filter_signed_path
falsepositives:
    - Legitimate OEM printer updater utilities — baseline per-host and alert on first-seen values
level: high
---
title: Outbound Beaconing to Self-Hosted Matomo Analytics or TDS Endpoint from Non-Browser Process
id: 9f1c2a44-7b3e-4d21-9a5c-bengalseo00003
status: experimental
description: Detects HTTP requests to Matomo/Piwik-style analytics endpoints (matomo.php, piwik.php) initiated by non-browser processes, consistent with MayaBot C2 tasking riding analytics-style request patterns through the BengalSEO TDS layer.
author: Security Arsenal Threat Intelligence
references:
    - https://thedfirreport.com/2026/08/24/bengalseo-part-1-anatomy-of-the-operation/
date: 2026/09/07
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102
logsource:
    category: network_connection
    product: windows
    definition: sysmon
detection:
    selection_uri:
        Image|endswith:
            - '.exe'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\iexplore.exe'
            - '\brave.exe'
            - '\opera.exe'
    selection_path:
        Initiated: 'true'
    condition: selection_uri and selection_path and not filter_browsers
fields:
    - Image
    - DestinationHostname
    - DestinationIp
falsepositives:
    - Applications with embedded analytics SDKs — correlate DestinationHostname against OTX BengalSEO pulse indicators before escalation
level: medium

// BengalSEO / MayaBot Hunt — Microsoft Sentinel
// Hunts network connections and process launches tied to BengalSEO lure domains,
// trojanized installer execution, and suspicious RMM installs (scam-arm artifact).
let BengalSeoDomains = dynamic([
    "brotherprinter-drivers.com","freetechsupport.org","iconnectpc.com",
    "itunes-download.com","amazoncom-mytv.com","digitallinkup.com",
    "anjaymedical.com","msnbclivestreaming.com"
]);
let LookalikePattern = @"(driver|download|mytv|techsupport|livestreaming|freesupport)";
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has_any (BengalSeoDomains)
       or RemoteUrl matches regex LookalikePattern
    | project TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let ProcessHits = DeviceProcessEvents
    | where TimeGenerated > ago(90d)
    | where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe")
    | where FileName has_any ("setup","install","driver")
       or ProcessCommandLine has_any ("printer","itunes","mytv","streaming","support")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
              FolderPath, SHA256, InitiatingProcessFileName;
let RmmHits = DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where FileName in~ ("AnyDesk.exe","TeamViewer.exe","ScreenConnect.exe","AteraAgent.exe","SplashtopSOS.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName;
union NetworkHits, ProcessHits, RmmHits
| sort by TimeGenerated desc

# BengalSEO / MayaBot IOC Hunt Script — run elevated on suspect endpoints or via your RMM/EDR shell
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

$badDomains = @(
    'brotherprinter-drivers.com','freetechsupport.org','iconnectpc.com',
    'itunes-download.com','amazoncom-mytv.com','digitallinkup.com',
    'anjaymedical.com','msnbclivestreaming.com'
)

# 1. DNS cache check for BengalSEO lure domains
Write-Host '[*] Checking DNS cache for BengalSEO IOC domains...'
$dns = Get-DnsClientCache | Where-Object { $n = $_.Name; $badDomains | Where-Object { $n -like "*$_*" } }
if ($dns) { $report += '[HIT] DNS cache matches:'; $report += ($dns | Out-String) }

# 2. Active network connections to known infrastructure
Write-Host '[*] Checking active connections...'
Get-NetTCPConnection -State Established | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $report += "[INFO] $($proc.ProcessName) -> $($_.RemoteAddress):$($_.RemotePort)"
}

# 3. Persistence: Run keys with lure-style value names
Write-Host '[*] Checking Run keys for masqueraded persistence...'
$runPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($p in $runPaths) {
    $props = Get-ItemProperty -Path $p
    foreach ($name in ($props.PSObject.Properties.Name | Where-Object { $_ -notmatch '^PS' })) {
        if ($name -match '(?i)(driver|update|support|printer|itunes)') {
            $report += "[HIT] RunKey $p :: $name = $($props.$name)"
        }
    }
}

# 4. Suspicious scheduled tasks mimicking software updaters
Write-Host '[*] Checking scheduled tasks...'
Get-ScheduledTask | Where-Object {
    $_.TaskName -match '(?i)(driver|update|support|printer)' -and
    $_.TaskPath -notlike '\Microsoft*'
} | ForEach-Object { $report += "[HIT] Task: $($_.TaskPath)$($_.TaskName) — Action: $($_.Actions.Execute) $($_.Actions.Arguments)" }

# 5. Trojanized installer artifacts in user Downloads
Write-Host '[*] Checking Downloads folders for lure-named executables...'
Get-ChildItem 'C:\Users\*\Downloads' -Include '*.exe','*.msi','*.zip' -Recurse |
    Where-Object { $_.Name -match '(?i)(driver|itunes|mytv|streaming|techsupport)' } |
    ForEach-Object { $report += "[HIT] File: $($_.FullName) — $($_.CreationTime)" }

# 6. Scam-arm artifact: consumer RMM tools installed on corporate endpoint
Write-Host '[*] Checking for unauthorized RMM tooling (tech support scam indicator)...'
$rmm = @('AnyDesk','TeamViewer','ScreenConnect','Atera','Splashtop','GoToAssist','LogMeIn')
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
                'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' |
    Where-Object { $d = $_.DisplayName; $rmm | Where-Object { $d -like "*$_*" } } |
    ForEach-Object { $report += "[HIT] RMM installed: $($_.DisplayName) — $($_.InstallDate)" }

$report | Out-File "$env:TEMP\bengalseo_hunt_$(Get-Date -Format yyyyMMdd_HHmmss).txt"
$report | ForEach-Object { Write-Host $_ }
Write-Host "[*] Hunt complete. Results written to $env:TEMP"