Clop Extortion Gang Claims Breaches at GE and Philips: Detection, Threat Hunting, and Response Playbook

---
title: Mass Archive Creation by Compression Tools - Potential Data Staging
id: 3f8a2c41-7b6e-4d19-a2c5-9e1f4b8d6a02
status: experimental
description: Detects execution of archive utilities with password protection or multi-file compression consistent with ransomware/extortion data staging behavior observed in Clop-style exfiltration campaigns.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.bleepingcomputer.com/news/security/philips-and-ge-investigating-clop-ransomware-data-theft-claims/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\7zr.exe'
      - '\winzip64.exe'
  selection_switches:
    CommandLine|contains:
      - ' a '
      - ' -p'
      - ' -hp'
      - ' -m5'
      - ' -v'
  condition: selection_binary and selection_switches
falsepositives:
  - Legitimate backup operations by IT administrators
  - Software packaging workflows
level: high
---
title: Webshell or Script Dropped in Web Server Directory
id: 8c1d5e72-4a3b-4f68-b7d1-2e9a6c3f5b18
status: experimental
description: Detects creation of script files (ASPX, JSP, PHP) in web server or file-transfer application directories by non-standard processes, consistent with webshell deployment after exploitation of public-facing applications such as managed file transfer platforms.
references:
  - https://attack.mitre.org/techniques/T1505/003/
  - https://www.bleepingcomputer.com/news/security/philips-and-ge-investigating-clop-ransomware-data-theft-claims/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1190
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\webapps\'
      - '\wwwroot\'
      - '\htdocs\'
  selection_extensions:
    TargetFilename|endswith:
      - '.aspx'
      - '.ashx'
      - '.jsp'
      - '.jspx'
      - '.php'
      - '.war'
  filter_legit:
    Image|endswith:
      - '\iisexpress.exe'
      - '\devenv.exe'
      - '\msdeploy.exe'
      - '\w3wp.exe'
  condition: selection_paths and selection_extensions and not filter_legit
falsepositives:
  - Legitimate application deployments (filter by deployment tooling as needed)
level: high
---
title: Web Server Process Spawning Command Shell
id: 5b7e9a14-2d6c-4f81-a3b9-7c4e1d8f2a63
status: experimental
description: Detects web server or application server worker processes spawning command interpreters, a hallmark of webshell execution following exploitation of internet-facing applications including MFT platforms targeted by Clop.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/02/09
tags:
  - attack.execution
  - attack.t1059
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\tomcat9.exe'
      - '\java.exe'
      - '\javaw.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some legacy applications invoke shells from web workers - investigate all hits
level: critical

// Hunt: Anomalous high-volume outbound data transfers from servers (potential exfiltration)
// Baseline deviation approach - flags hosts sending significantly more data than their 14-day norm
let lookback = 14d;
let window = 1d;
let baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(lookback) .. ago(window))
| where InitiatingProcessFolderPath !has_any ("windows\\system32", "program files\\windows defender")
| summarize BaselineBytes = avg(tolong(SentBytes)) by DeviceName, RemoteIP
| where BaselineBytes > 0;
DeviceNetworkEvents
| where TimeGenerated > ago(window)
| where RemoteIPType == "Public"
| summarize RecentBytes = sum(tolong(SentBytes)), DistinctDestinations = dcount(RemoteIP), 
            Processes = make_set(InitiatingProcessFileName, 10) by DeviceName, RemoteIP
| join kind=inner baseline on DeviceName, RemoteIP
| where RecentBytes > (BaselineBytes * 10) and RecentBytes > 500000000  // >10x baseline AND >500MB
| project DeviceName, RemoteIP, RecentBytes, BaselineBytes, DistinctDestinations, Processes
| order by RecentBytes desc;

// Hunt: Compression utility execution followed by network activity (staging then exfil)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("rar.exe", "7z.exe", "7za.exe", "winzip64.exe")
| where ProcessCommandLine has_any (" -p", " -hp", " a ")
| summarize ArchiveOps = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            Commands = make_set(ProcessCommandLine, 5) by DeviceName, AccountName
| where ArchiveOps >= 3
| order by ArchiveOps desc;

-- Hunt for data staging and webshell execution indicators on servers
-- Part 1: Suspicious child processes of web server processes
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       get_process(pid=Ppid).Name AS ParentName,
       get_process(pid=Ppid).Exe AS ParentExe
FROM pslist()
WHERE ParentExe =~ '(w3wp|httpd|nginx|tomcat|java)'
  AND Name =~ '(cmd|powershell|pwsh|certutil|bitsadmin|curl|rar|7z)'

-- Part 2: Recently created archives in staging-friendly directories
SELECT FullPath, Size, Mtime, Atime
FROM glob(globs=['C:/ProgramData/**/*.rar', 'C:/ProgramData/**/*.7z',
                 'C:/ProgramData/**/*.zip', 'C:/Windows/Temp/**/*.rar',
                 'C:/Windows/Temp/**/*.7z', 'C:/Users/Public/**/*.rar',
                 'C:/Users/Public/**/*.zip'])
WHERE Mtime > now() - 604800
  AND Size > 10000000
ORDER BY Size DESC

# Clop-Style Intrusion Exposure Audit - Run elevated on file transfer / web servers
# Author: Security Arsenal IR Team

$ReportPath = "C:\Temp\ExfilAudit_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
New-Item -Path C:\Temp -ItemType Directory -Force | Out-Null

# 1. Audit for suspicious archives staged in common locations in last 14 days
"=== [1] Recent large archives (potential staging) ===" | Out-File $ReportPath
$stagingPaths = @('C:\ProgramData','C:\Windows\Temp','C:\Users\Public','C:\Perflogs')
foreach ($p in $stagingPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include *.rar,*.7z,*.zip -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and $_.Length -gt 10MB } |
            Select-Object FullName, Length, LastWriteTime | Format-Table -AutoSize | Out-File $ReportPath -Append
    }
}

# 2. Check web root for recently modified script files (webshell indicator)
"=== [2] Recently modified web scripts (last 30 days) ===" | Out-File $ReportPath -Append
$webRoots = @('C:\inetpub\wwwroot','C:\xampp\htdocs')
foreach ($w in $webRoots) {
    if (Test-Path $w) {
        Get-ChildItem -Path $w -Recurse -Include *.aspx,*.ashx,*.jsp,*.php -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
            Select-Object FullName, LastWriteTime | Format-Table -AutoSize | Out-File $ReportPath -Append
    }
}

# 3. Identify compression tool executions from process auditing / recent prefetch
"=== [3] Compression utility prefetch artifacts ===" | Out-File $ReportPath -Append
Get-ChildItem C:\Windows\Prefetch -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'RAR|7Z|WINZIP' } |
    Select-Object Name, LastWriteTime | Format-Table -AutoSize | Out-File $ReportPath -Append

# 4. List top outbound data talkers (last 24h, requires firewall/netflow - uses TCP session counts as proxy)
"=== [4] Active external connections from server processes ===" | Out-File $ReportPath -Append
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.|::1|fe80)' } |
    Group-Object OwningProcess | Sort-Object Count -Descending | Select-Object -First 15 |
    ForEach-Object { $proc = Get-Process -Id $_.Name -ErrorAction SilentlyContinue
        "{0} ({1}) - {2} connections" -f $proc.ProcessName, $_.Name, $_.Count } | Out-File $ReportPath -Append

# 5. Verify audit policies needed to catch this activity are enabled
"=== [5] Audit policy verification ===" | Out-File $ReportPath -Append
auditpol /get /subcategory:"Process Creation","File System" | Out-File $ReportPath -Append
if (-not ((auditpol /get /subcategory:"Process Creation") -match 'Success')) {
    "WARNING: Process Creation auditing not enabled - enable and add command-line logging (Event 4688)" | Out-File $ReportPath -Append
}

Write-Host "Audit complete: $ReportPath" -ForegroundColor Green