---
title: BOOBA PROJECT - Suspicious RDP Logon Followed by Lateral Movement
id: 8a3f2b1c-4e5d-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects successful RDP logons from external IPs followed within 30 minutes by SMB admin share access or remote service creation — consistent with BOOBA PROJECT initial access to lateral movement pivot.
author: Security Arsenal Threat Intelligence
date: 2026/11/14
references:
  - https://securityarsenal.com/darkside
logsource:
  product: windows
  service: security
detection:
  selection_rdp:
    EventID: 4624
    LogonType: 10
    IpAddress|cidr:
      - '0.0.0.0/0'
    IpAddress|cidr|exclude:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  selection_lateral:
    EventID:
      - 5140
      - 5145
    ShareName|contains:
      - 'ADMIN$'
      - 'C$'
      - 'IPC$'
  condition: selection_rdp | selection_lateral
timeframe: 30m
falsepositives:
  - Legitimate administrative RDP access from VPN concentrator IPs
  - Automated management tools
level: high
tags:
  - attack.initial_access
  - attack.lateral_movement
  - attack.t1078
  - attack.t1021.001
  - attack.t1021.002
---
title: BOOBA PROJECT - Office Macro Spawning Suspicious Child Process
id: 9b4c3d2e-5f6e-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects Microsoft Office applications spawning cmd, powershell, wscript, cscript, mshta, or rundll32 — consistent with BOOBA PROJECT phishing macro execution leading to Cobalt Strike or loader deployment.
author: Security Arsenal Threat Intelligence
date: 2026/11/14
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\msaccess.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Office add-in behavior
  - Document management integrations
level: critical
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204.002
  - attack.t1566.001
---
title: BOOBA PROJECT - Pre-Encryption Data Staging and Shadow Copy Deletion
id: 0c5d4e3f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects vssadmin or wmic shadow copy deletion combined with mass file compression or archive creation — strong pre-encryption indicator in BOOBA PROJECT operations.
author: Security Arsenal Threat Intelligence
date: 2026/11/14
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_shadow:
    - CommandLine|contains:
        - 'vssadmin delete shadows'
        - 'vssadmin Delete Shadows'
        - 'wmic shadowcopy delete'
        - 'bcdedit'
        - 'wbadmin delete catalog'
  selection_staging:
    - CommandLine|contains:
        - '7z.exe a '
        - 'rar.exe a '
        - 'winrar a '
        - 'Compress-Archive'
  condition: 1 of selection_shadow or 1 of selection_staging
falsepositives:
  - IT administrators managing backup configurations
  - Legitimate archival processes
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.t1486

// BOOBA PROJECT Pre-Ransomware Staging Hunt — Microsoft Sentinel
// Hunts for lateral movement + data staging indicators within a 7-day window
// Focus: suspicious service creation, admin share access, and mass file read activity

let Lookback = 7d;
let SuspiciousServices = dynamic(["PSEXESVC", "paexec", "remcom", "csexec"]);

// Step 1: Identify remote service installations (lateral movement)
let LateralServices =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 7045
    | where ServiceName has_any (SuspiciousServices)
        or (ServiceFileName has_any ("ADMIN$", "C$", "\\temp\\", "\\users\\public\\"))
    | project
        ServiceInstallTime = TimeGenerated,
        Computer,
        ServiceName,
        ServiceFileName,
        ServiceAccount = Account;

// Step 2: Correlate with mass file read activity on the same hosts
let MassFileReads =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4663
    | where ObjectType == "File"
    | summarize
        FileReadCount = count(),
        UniqueExtensions = dcount(split(ObjectName, ".")[-1]),
        FirstRead = min(TimeGenerated),
        LastRead = max(TimeGenerated)
        by Computer, Account = SubjectAccount, bin(TimeGenerated, 1h)
    | where FileReadCount > 500 and UniqueExtensions > 10;

// Step 3: Join lateral movement with staging behavior
LateralServices
| join kind=inner (
    MassFileReads
) on Computer
| project
    Computer,
    ServiceInstallTime,
    ServiceName,
    ServiceFileName,
    ServiceAccount,
    FileReadCount,
    UniqueExtensions,
    FirstRead,
    LastRead
| extend HoursBetween = datetime_diff('hour', FirstRead, ServiceInstallTime)
| sort by Computer, ServiceInstallTime;

// Bonus: Check for shadow copy deletion events
union
(
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where Process has_any ("vssadmin", "wmic", "bcdedit", "wbadmin")
    | where CommandLine has_any ("delete shadows", "shadowcopy delete", "delete catalog", "recoveryenabled no")
    | project
        ShadowDeleteTime = TimeGenerated,
        Computer,
        Process,
        CommandLine,
        Account
)

# BOOBA PROJECT Rapid Response Script — Pre-Encryption Indicator Sweep
# Run on critical servers. Checks for signs of pre-ransomware staging activity.
# Requires: Run as Administrator. Test in lab before production deployment.

Write-Host "=== BOOBA PROJECT Rapid Response Indicator Sweep ===" -ForegroundColor Cyan
Write-Host "Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan
Write-Host "Hostname: $env:COMPUTERNAME`n" -ForegroundColor Cyan

# 1. Check for exposed RDP (listening on 3389 with external access)
Write-Host "[1] Checking RDP Exposure..." -ForegroundColor Yellow
$rdp = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($rdp) {
    Write-Host "  [!] RDP is LISTENING on port 3389" -ForegroundColor Red
    $rdp | Format-Table LocalAddress, LocalPort, State, OwningProcess -AutoSize
    $rdpEnabled = (Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server").fDenyTSConnections
    if ($rdpEnabled -eq 0) { Write-Host "  [!] RDP connections are ENABLED" -ForegroundColor Red }
} else {
    Write-Host "  [+] RDP not detected on port 3389" -ForegroundColor Green
}

# 2. Check for recently created scheduled tasks (last 7 days) — persistence mechanism
Write-Host "`n[2] Checking for Recently Created Scheduled Tasks (7 days)..." -ForegroundColor Yellow
$recentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -and ((New-TimeSpan -Start $_.Date -End (Get-Date)).Days -le 7)
} | Sort-Object Date -Descending
if ($recentTasks) {
    Write-Host "  [!] Found $($recentTasks.Count) recently created tasks:" -ForegroundColor Red
    $recentTasks | ForEach-Object {
        $info = $_ | Get-ScheduledTaskInfo
        Write-Host "    - $($_.TaskName) | Path: $($_.TaskPath) | Created: $($_.Date)" -ForegroundColor Red
    }
} else {
    Write-Host "  [+] No suspicious recent scheduled tasks found" -ForegroundColor Green
}

# 3. Check Volume Shadow Copies status — ransomware deletes these
Write-Host "`n[3] Checking Volume Shadow Copies..." -ForegroundColor Yellow
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if ($shadows) {
    Write-Host "  [+] $($shadows.Count) shadow copies exist" -ForegroundColor Green
    $shadows | ForEach-Object {
        Write-Host "    - ID: $($_.ID) | Created: $($_.InstallDate) | Volume: $($_.VolumeName)"
    }
} else {
    Write-Host "  [!] NO shadow copies found — may indicate deletion or disabled VSS" -ForegroundColor Red
}

# Check VSS service status
$vss = Get-Service VSS -ErrorAction SilentlyContinue
Write-Host "  VSS Service Status: $($vss.Status) | StartType: $($vss.StartType)" -ForegroundColor $(if ($vss.Status -eq 'Running') {'Green'} else {'Yellow'})

# 4. Check for suspicious processes commonly used in staging
Write-Host "`n[4] Checking for Suspicious Staging Processes..." -ForegroundColor Yellow
$suspiciousProcs = @("7z", "rar", "winrar", "psexec", "paexec", "remcom", "ncat", "nc.exe", "rclone", "megasync")
$foundProcs = Get-Process | Where-Object { $proc = $_.ProcessName.ToLower(); $suspiciousProcs | Where-Object { $proc -like "*$_*" } }
if ($foundProcs) {
    Write-Host "  [!] Suspicious processes detected:" -ForegroundColor Red
    $foundProcs | Format-Table ProcessName, Id, Path, StartTime -AutoSize
} else {
    Write-Host "  [+] No known staging/exfil processes detected" -ForegroundColor Green
}

# 5. Check for recent Event Log clearing (anti-forensics)
Write-Host "`n[5] Checking for Event Log Clearing (last 7 days)..." -ForegroundColor Yellow
$logClear = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
$syslogClear = Get-WinEvent -FilterHashtable @{LogName='System'; Id=104; StartTime=(Get-Date).AddDays(-7)} -ErrorAction SilentlyContinue
if ($logClear -or $syslogClear) {
    Write-Host "  [!] Event log clearing detected:" -ForegroundColor Red
    if ($logClear) { $logClear | ForEach-Object { Write-Host "    - Security log cleared at $($_.TimeCreated)" -ForegroundColor Red } }
    if ($syslogClear) { $syslogClear | ForEach-Object { Write-Host "    - System log cleared at $($_.TimeCreated)" -ForegroundColor Red } }
} else {
    Write-Host "  [+] No event log clearing detected in last 7 days" -ForegroundColor Green
}

# 6. Check for new local admin accounts (privilege escalation persistence)
Write-Host "`n[6] Checking Local Administrators Group..." -ForegroundColor Yellow
$admins = Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue
Write-Host "  Current local administrators:"
$admins | ForEach-Object {
    Write-Host "    - $($_.Name) ($($_.ObjectClass))" -ForegroundColor $(if ($_.Name -notmatch 'Administrator|Domain Admins|Enterprise Admins') {'Yellow'} else {'White'})
}

Write-Host "`n=== Sweep Complete ===" -ForegroundColor Cyan
Write-Host "Review all [!] findings immediately. Correlate with SIEM alerts and EDR telemetry." -ForegroundColor Cyan