Cyber Av3ngers IOCONTROL + MALPDB Campaign: Nation-State PLC Exploitation Against U.S. Water & Energy Infrastructure — OTX Detection Pack

---
title: Outbound Connection to IOCONTROL C2 Domains
id: 8f1c2a44-9b3e-4c7a-b5d1-1a2b3c4d5e6f
status: experimental
description: Detects DNS resolution or outbound connections to known IOCONTROL/Cyber Av3ngers C2 infrastructure observed in PLC exploitation campaigns against U.S. critical infrastructure.
author: Security Arsenal Threat Intelligence
logsource:
    category: dns
    product: zeek
    service: dns
detection:
    selection:
        query|contains:
            - 'ocferda.com'
            - 'tylarion867mino.com'
    condition: selection
falsepositives:
    - Unlikely — these domains have no legitimate business use
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
date: 2026/08/23
---
title: Non-Engineering Host Initiating PLC Protocol Communication
id: 4d5e6f70-1a2b-4c3d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects Modbus, S7comm, or Unitronics PCOM protocol connections originating from hosts outside the approved engineering workstation segment — consistent with Cyber Av3ngers PLC access methodology.
author: Security Arsenal Threat Intelligence
logsource:
    category: network_connection
detection:
    selection_ports:
        DestinationPort:
            - 502
            - 102
            - 20256
    filter_engineering_subnet:
        SourceIp|cidr:
            - '10.50.0.0/24'
    condition: selection_ports and not filter_engineering_subnet
falsepositives:
    - Vendor remote support sessions — validate against change tickets and maintenance windows
level: high
tags:
    - attack.initial_access
    - attack.t1190
    - attack.t0813
date: 2026/08/23
---
title: Suspicious Persistence via Cron or Systemd on OT-Adjacent Linux Hosts
id: 7a8b9c0d-2e3f-4a5b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation or modification of cron jobs, systemd units, or rc.local on Linux hosts — a persistence mechanism used by the IOCONTROL backdoor deployed in OT environments.
author: Security Arsenal Threat Intelligence
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename|contains:
            - '/etc/cron.d/'
            - '/var/spool/cron/'
            - '/etc/systemd/system/'
            - '/etc/rc.local'
    condition: selection
falsepositives:
    - Legitimate package installation and configuration management — correlate with approved deployments
level: high
tags:
    - attack.persistence
    - attack.t1053.003
    - attack.t1543.002
date: 2026/08/23

// Hunt: IOCONTROL C2 communication + anomalous connections to OT/PLC ports
let suspiciousDomains = dynamic(["ocferda.com", "tylarion867mino.com"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (suspiciousDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemotePort in (502, 102, 20256)
    | where InitiatingProcessFileName !in~ ("VisiLogic.exe", "Unitronics.RemoteOperator.exe", "TIA.exe")
    | summarize ConnectionCount = count(), DistinctTargets = dcount(RemoteIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort
    | order by FirstSeen asc),
    (DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where SHA1 in ("95bd07b4400095acdafce05888da27228d7d07ca", "366e435a1ea0f597deb6ebe7c0c5acdb6e8b33eb")
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA1, InitiatingProcessFileName)

# Security Arsenal — Cyber Av3ngers / IOCONTROL / MALPDB Host & Network Hunt
# Run elevated on OT-adjacent Windows engineering workstations and jump hosts
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

Write-Host "[1/5] Checking for known malicious file hashes..." -ForegroundColor Cyan
$badHashes = @('95bd07b4400095acdafce05888da27228d7d07ca','366e435a1ea0f597deb6ebe7c0c5acdb6e8b33eb')
Get-ChildItem -Path 'C:\Program Files','C:\Program Files (x86)','C:\ProgramData','C:\Users' -Recurse -File -ErrorAction SilentlyContinue |
  Where-Object { $badHashes -contains (Get-FileHash $_.FullName -Algorithm SHA1 -ErrorAction SilentlyContinue).Hash } |
  ForEach-Object { $report += [PSCustomObject]@{Check='MaliciousHash'; Detail=$_.FullName} }

Write-Host "[2/5] Checking DNS cache and recent connections to C2 domains..." -ForegroundColor Cyan
$c2 = @('ocferda.com','tylarion867mino.com')
Get-DnsClientCache | Where-Object { $e = $_; $c2 | Where-Object { $e.Entry -like "*$_*" } } |
  ForEach-Object { $report += [PSCustomObject]@{Check='DNSCache-C2'; Detail="$($_.Entry) -> $($_.Data)"} }
Get-NetTCPConnection -State Established | Where-Object {
  ($_.RemotePort -in 502,102,20256) -or
  ($_.OwningProcess -and ($c2 | Where-Object { (Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost -like "*$_*" }))
} | ForEach-Object { $report += [PSCustomObject]@{Check='SuspiciousNetConn'; Detail="PID $($_.OwningProcess) -> $($_.RemoteAddress):$($_.RemotePort)"} }

Write-Host "[3/5] Auditing scheduled tasks for MALPDB-style persistence..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'temp|appdata|programdata' -and $_.State -ne 'Disabled' } |
  ForEach-Object { $report += [PSCustomObject]@{Check='SuspiciousTask'; Detail="$($_.TaskName) :: $($_.Actions.Execute)"} }

Write-Host "[4/5] Auditing Run keys and services..." -ForegroundColor Cyan
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' | ForEach-Object {
  Get-ItemProperty $_ | ForEach-Object { $_.PSObject.Properties } | Where-Object { $_.Value -match 'temp|appdata' } |
    ForEach-Object { $report += [PSCustomObject]@{Check='RunKey'; Detail="$($_.Name) = $($_.Value)"} }
}

Write-Host "[5/5] Flagging logons from unexpected sources (valid-credential abuse)..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; LogonType=10} -MaxEvents 500 |
  Where-Object { $_.Message -notmatch '10\.50\.0\.' } |
  ForEach-Object { $report += [PSCustomObject]@{Check='AnomalousRDP'; Detail=$_.TimeCreated} }

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\CyberAv3ngers_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "Hunt complete. $($report.Count) findings." -ForegroundColor Yellow