BraZetsu Access Broker Infrastructure Exposed: Hunting Nuitka-Compiled Python Malware and Persistent C2 Patterns

---
title: Nuitka Onefile Compiled Python Payload Execution
id: 3f8c2a71-9b4e-4d6a-a1c2-7e5f9d0b8a34
status: experimental
description: Detects execution from Nuitka onefile extraction directories, characteristic of Python malware frameworks (e.g., BraZetsu) compiled with Nuitka in onefile mode. Legitimate software rarely runs from onefile_ temp paths.
references:
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\onefile_'
      - '\Temp\onefile_'
  filter_signed:
    - Signer: null
  condition: selection_path and not filter_signed
falsepositives:
  - Rare legitimate tools distributed as Nuitka onefile bundles (internal Python tooling)
level: high
---
title: Unsigned Executable in User Directory Initiating Outbound Beaconing
id: 8b1d4e62-2c7a-4f91-b3d5-6a0e8c1f2b47
status: experimental
description: Detects unsigned executables running from user-writable paths making outbound HTTPS connections to non-browser processes, consistent with access broker beaconing behavior such as BraZetsu C2 callbacks.
references:
  - https://attack.mitre.org/techniques/T1071.001/
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1036
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 443
      - 8443
      - 4443
    Image|contains:
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
  filter_browsers:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\iexplore.exe'
  condition: selection and not filter_browsers
falsepositives:
  - Auto-updaters of legitimate user-installed software (Slack, Discord, Zoom updaters) — tune with a signer allowlist
level: medium
---
title: Reconnaissance Command Chain from Temp or Public Directory Parent
id: 5c9a3f18-7e2b-4d83-a6c1-9f0b2e4d7a56
status: experimental
description: Detects system reconnaissance commands (whoami, systeminfo, net, ipconfig) spawned by a parent process executing from temp or public directories, a common access broker host-profiling pattern before selling access.
references:
  - https://attack.mitre.org/techniques/T1033/
  - https://attack.mitre.org/techniques/T1082/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1082
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - 'onefile_'
  selection_child:
    Image|endswith:
      - '\whoami.exe'
      - '\systeminfo.exe'
      - '\ipconfig.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\quser.exe'
      - '\nltest.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Software installers performing environment checks (low frequency when correlated with unsigned parents)
level: high

// Hunt: Access broker beaconing pattern — unsigned processes in user paths with periodic outbound connections
// Tables: DeviceProcessEvents + DeviceNetworkEvents (Defender), works in Sentinel with MDE connector
let Lookback = 7d;
let SuspiciousPaths = @"(\\AppData\\Local\\Temp\\|\\AppData\\Roaming\\|\\Users\\Public\\|onefile_)";
let SuspectProcs =
    DeviceProcessEvents
    | where TimeGenerated >= ago(Lookback)
    | where FileName matches regex SuspiciousPaths or FolderPath matches regex SuspiciousPaths
    | project DeviceId, DeviceName, ProcessId, FileName, FolderPath, SHA256, ProcessTime=TimeGenerated;
DeviceNetworkEvents
| where TimeGenerated >= ago(Lookback)
| where RemotePort in (443, 8443, 4443)
| where ActionType == "ConnectionSuccess"
| join kind=inner SuspectProcs on DeviceId, ProcessId=ProcessId
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
            ConnectionCount=count(), DistinctRemotes=dcount(RemoteIP),
            RemoteIPs=make_set(RemoteIP, 20), RemoteURLs=make_set(RemoteUrl, 20)
    by DeviceName, FileName, FolderPath, SHA256
| where ConnectionCount >= 10  // sustained beaconing, not a one-off updater hit
| sort by ConnectionCount desc;

// Hunt: Nuitka onefile extraction artifacts via process telemetry (Sysmon/SecurityEvent 4688)
SecurityEvent
| where TimeGenerated >= ago(7d)
| where EventID == 4688
| where NewProcessName matches regex @"(?i)onefile_\d+_\d+"
   or CommandLine matches regex @"(?i)onefile_\d+_\d+"
| extend Parent = tostring(split(ParentProcessName, "\\")[-1]), Child = tostring(split(NewProcessName, "\\")[-1])
| summarize Executions=count(), DistinctUsers=dcount(Account), Commands=make_set(CommandLine, 10)
    by Computer, Parent, Child
| sort by Executions desc;

-- Artifact: SecurityArsenal.Hunt.NuitkaBroker
-- Sweeps for Nuitka onefile-compiled payload artifacts (BraZetsu-class access broker tooling)

-- Part 1: Live processes executing from onefile extraction directories
LET live_procs = SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)onefile_\\\\?[0-9]+_[0-9]+'
   OR CommandLine =~ '(?i)onefile_[0-9]+_[0-9]+'

-- Part 2: Residual onefile extraction directories under user temp paths
LET temp_artifacts = SELECT FullPath, Mtime, Size, IsDir
FROM glob(globs='C:/Users/*/AppData/Local/Temp/onefile_*')

-- Part 3: Unsigned executables in user-writable paths with active connections
LET suspicious_net = SELECT Pid, Name, Path, Status, Family, Type,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE RemotePort in (443, 8443, 4443)
  AND Path =~ '(?i)(AppData\\\\(Local\\\\Temp|Roaming)|Users\\\\Public)'

SELECT * FROM live_procs
UNION ALL
SELECT NULL AS Pid, FullPath AS Name, NULL AS Exe, NULL AS CommandLine,
       NULL AS Username, Mtime AS CreateTime FROM temp_artifacts

#requires -RunAsAdministrator
# Security Arsenal - BraZetsu / Nuitka-compiled broker hunting & audit hardening
$report = @()

# 1) Sweep for live onefile extraction processes
$onefileProcs = Get-CimInstance Win32_Process | Where-Object {
    $_.ExecutablePath -match 'onefile_\d+_\d+' -or $_.CommandLine -match 'onefile_\d+_\d+'
}
foreach ($p in $onefileProcs) {
    $report += [pscustomobject]@{ Finding='LIVE_ONEFILE_PROCESS'; Detail="$($p.ProcessId): $($p.ExecutablePath)"; Action='ISOLATE_HOST' }
}

# 2) Find unsigned executables in user-writable paths with ESTABLISHED 443 connections
$conns = Get-NetTCPConnection -State Established | Where-Object { $_.RemotePort -in 443,8443,4443 }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    if ($proc -and $proc.Path -match 'AppData\\(Local\\Temp|Roaming)|Users\\Public') {
        $sig = Get-AuthenticodeSignature -FilePath $proc.Path
        if ($sig.Status -ne 'Valid') {
            $report += [pscustomobject]@{ Finding='UNSIGNED_BEACON'; Detail="$($proc.Path) -> $($c.RemoteAddress):$($c.RemotePort)"; Action='CAPTURE_AND_TRIAGE' }
        }
    }
}

# 3) Ensure process creation auditing + command line capture is enabled (required for Sigma coverage)
$audit = (auditpol /get /subcategory:"Process Creation" 2>$null) -join ' '
if ($audit -notmatch 'Success') {
    auditpol /set /subcategory:"Process Creation" /success:enable | Out-Null
    $report += [pscustomobject]@{ Finding='AUDIT_FIX'; Detail='Enabled Process Creation auditing'; Action='DONE' }
}
$cmdline = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue
if (-not $cmdline -or $cmdline.ProcessCreationIncludeCmdLine_Enabled -ne 1) {
    Set-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -Value 1 -Type DWord
    $report += [pscustomobject]@{ Finding='AUDIT_FIX'; Detail='Enabled command-line inclusion in 4688 events'; Action='DONE' }
}

# 4) Ensure PowerShell Script Block Logging (catches Python->PS pivots common in broker hands-on activity)
$sbl = Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name EnableScriptBlockLogging -ErrorAction SilentlyContinue
if (-not $sbl -or $sbl.EnableScriptBlockLogging -ne 1) {
    New-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force | Out-Null
    Set-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name EnableScriptBlockLogging -Value 1 -Type DWord
    $report += [pscustomobject]@{ Finding='LOGGING_FIX'; Detail='Enabled PowerShell Script Block Logging'; Action='DONE' }
}

$report | Format-Table -AutoSize
if ($report | Where-Object { $_.Action -in 'ISOLATE_HOST','CAPTURE_AND_TRIAGE' }) {
    Write-Warning 'Active broker indicators found. Isolate affected hosts and begin IR scoping immediately.'
}