CHAOS Ransomware Gang: 3 Victims Posted in 48 Hours — US/GB/AU Targeting, KEV-Linked Access Paths & Detection Rules

---
title: CHAOS - Suspect External RDP Logon After Failure Burst
id: 7f1a2b3c-4d5e-6f70-8a9b-0c1d2e3f4a01
status: experimental
description: Detects interactive remote RDP logons from non-allowlisted external sources after repeated account failures, a common Chaos/RaaS affiliate entry pattern when RDP is exposed or brokered.
author: Security Arsenal Threat Intelligence
date: 2026/08/31
modified: 2026/08/31
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: windows
  service: security
detection:
  selection_success:
    EventID: 4624
    LogonType: 10
  selection_fail:
    EventID: 4625
    LogonType: 10
  filter_allow:
    IpAddress|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_success and not filter_allow
falsepositives:
  - Managed service provider RDP jumps
  - VPN concentrator NAT addresses
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1078
  - chaos-ransomware
---
title: CHAOS - RMM PsExec WMI or Service Install Lateral Movement
id: 7f1a2b3c-4d5e-6f70-8a9b-0c1d2e3f4a02
status: experimental
description: Detects remote execution and service creation consistent with PsExec, WMI, ScreenConnect/RMM abuse and admin share movement seen before ransomware staging.
author: Security Arsenal Threat Intelligence
date: 2026/08/31
modified: 2026/08/31
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: windows
detection:
  selection_proc:
    EventID: 4688
    CommandLine|contains:
      - 'psexec'
      - '\\admin$'
      - 'wmic process call create'
      - 'screenconnect'
      - 'rundll32' 
  selection_service:
    EventID: 7045
    ServiceFileName|contains:
      - 'psexec'
      - 'screenconnect'
      - 'rclone'
      - '7z'
      - 'rar'
  selection_wmi:
    EventID: 4688
    ParentImage|endswith: '\WmiPrvSE.exe'
  condition: selection_proc or selection_service or selection_wmi
falsepositives:
  - Legitimate RMM during approved maintenance windows
  - SCCM or Intune remote actions
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
  - attack.t1072
  - chaos-ransomware
---
title: CHAOS - Pre-Encryption Staging Shadow Delete Archive or Exfil Tool
id: 7f1a2b3c-4d5e-6f70-8a9b-0c1d2e3f4a03
status: experimental
description: Detects backup inhibition, archive creation and exfiltration tooling that often fires shortly before Chaos-family encryption and leak-site pressure.
author: Security Arsenal Threat Intelligence
date: 2026/08/31
modified: 2026/08/31
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: windows
detection:
  selection_shadow:
    EventID: 4688
    CommandLine|contains:
      - 'delete shadows'
      - 'vssadmin delete'
      - 'wbadmin delete catalog'
      - 'bcdedit'
      - 'recoveryenabled no'
  selection_archive:
    EventID: 4688
    CommandLine|contains:
      - '7z a'
      - 'rar a'
      - '-p'
      - '.7z'
      - '.rar'
  selection_exfil:
    EventID: 4688
    CommandLine|contains:
      - 'rclone'
      - 'megacmd'
      - 'azcopy'
      - 'curl.exe'
      - 'ftp'
  condition: selection_shadow or selection_archive or selection_exfil
falsepositives:
  - Backup administrators running maintenance
  - Developers packaging release artifacts
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.t1560.001
  - attack.t1567
  - chaos-ransomware

let lookback = 14d;
let exfilProc = dynamic(['rclone','megacmd','azcopy','curl','ftp','7z','rar']);
let lateralProc = dynamic(['psexec','wmic','screenconnect','winrm','ssh','mstsc']);
let stagingProc = dynamic(['vssadmin','wbadmin','bcdedit','nltest','net','net1','arp','ipconfig']);
union isfuzzy=true
(
  DeviceProcessEvents
  | where TimeGenerated > ago(lookback)
  | extend Proc = tolower(FileName), CL = tolower(ProcessCommandLine)
  | where Proc in~ (exfilProc) or Proc in~ (lateralProc) or Proc in~ (stagingProc)
     or CL has_any ('delete shadows','recoveryenabled no','process call create','\\admin$','psexec','rclone copy','rar a','7z a','screenconnect')
  | project TimeGenerated, DeviceName, AccountName, Proc, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName, ReportId
),
(
  DeviceNetworkEvents
  | where TimeGenerated > ago(lookback)
  | where RemotePort in (445,3389,5985,5986,22,21,443)
  | where InitiatingProcessFileName in~ (exfilProc) or InitiatingProcessFileName in~ (lateralProc)
     or RemoteUrl has_any ('mega','transfer.sh','file.io','anonfiles','gofile','pixeldrain')
  | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, ActionType, ReportId
),
(
  DeviceEvents
  | where TimeGenerated > ago(lookback)
  | where ActionType has_any ('ScheduledTaskCreated','ServiceInstalled','UserAccountAddedToLocalGroup','RegistryValueSet')
  | project TimeGenerated, DeviceName, ActionType, InitiatingProcessAccountName, InitiatingProcessFileName, AdditionalFields, ReportId
)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Signals=count(), DistinctDevices=dcount(DeviceName), Actions=make_set(ActionType,20) by DeviceName, InitiatingProcessAccountName
| order by LastSeen desc

# Rapid pre-ransomware triage for likely CHAOS/RaaS staging. Run elevated on suspect servers and DC-adjacent systems.
$Days = 7; $Cut = (Get-Date).AddDays(-$Days)
Write-Host '[1] Scheduled tasks created or changed in window'
Get-ScheduledTask | ForEach-Object {
  $i = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
  if ($i -and $i.LastRunTime -gt $Cut) { [pscustomobject]@{Task=$_.TaskName; Path=$_.TaskPath; State=$_.State; LastRun=$i.LastRunTime; Author=$_.Author} }
} | Sort-Object LastRun -Descending | Format-Table -Auto
Write-Host '[2] Services installed recently or matching staging tool names'
Get-CimInstance Win32_Service | Where-Object { $_.Name -match 'psexec|screen|connect|rclone|7z|rar|update|svc' -or $_.PathName -match 'psexec|screenconnect|rclone|7z|rar|appdata|programdata' } |
  Select-Object Name, State, StartMode, PathName, StartName | Format-List
Write-Host '[3] RDP exposure and NLA state'
$rdp = Get-ItemProperty 'HKLM:
SYSTEM
CurrentControlSet
Control
Terminal Server' -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:
SYSTEM
CurrentControlSet
Control
Terminal Server
WinStations
RDP-Tcp' -ErrorAction SilentlyContinue
[pscustomobject]@{RdpEnabled = ($rdp.fDenyTSConnections -eq 0); NlaRequired = ($nla.UserAuthentication -eq 1); Port = $nla.PortNumber}
Write-Host '[4] Recent local admin membership changes candidates'
Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object Name, ObjectClass, PrincipalSource | Format-Table -Auto
Write-Host '[5] Shadow copies present and recent deletion events'
Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue | Select-Object ID, InstallDate, VolumeName, DeviceObject | Format-Table -Auto
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$Cut} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'vssadmin|delete shadows|wbadmin|bcdedit|psexec|screenconnect|rclone|7z|rar|wmic' } |
  Select-Object TimeCreated, Id, Message | Format-List