D2IP C2 Evasion + Rogue ScreenConnect Worm Activity + Teams Help Desk Social Engineering: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Direct-to-IP C2 Communication Without Prior DNS Query
id: 7d3f1a2e-9b4c-4e8a-a1f5-2c6d8e9f0a1b
status: experimental
description: Detects outbound network connections to external IPs by suspicious processes where no corresponding DNS resolution occurred, consistent with D2IP C2 behavior observed in Phorpiex, Mozi, Mirai, SectopRAT and Boatnet samples (45.32% of C2-active malware per OTX pulse).
author: Security Arsenal Threat Intelligence
date: 2026/09/03
references:
  - https://unit42.paloaltonetworks.com/malware-bypass-dns-direct-to-ip/
logsource:
  category: network_connection
  product: windows
detection:
  selection_initiated:
    Initiated: 'true'
  selection_external:
    DestinationIp|cidr:
      - '0.0.0.0/0'
  filter_private:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
      - '169.254.0.0/16'
  filter_known_good_ports:
    DestinationPort:
      - 123
  filter_browsers_updaters:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\svchost.exe'
  condition: selection_initiated and selection_external and not filter_private and not filter_known_good_ports and not filter_browsers_updaters
falsepositives:
  - Applications with hard-coded update servers
  - Internal monitoring agents using IP-based beacons
level: high
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1572
---
title: Rogue ScreenConnect Installation and VBScript Staging Chain
id: 8e4a2b3f-0c5d-5f9b-b2a6-3d7e9f0a1b2c
status: experimental
description: Detects execution of sequential numbered VBScript payloads (1.vbs-4.vbs) and unauthorized ScreenConnect client installation, matching the worm-like RMM abuse campaign deploying XMRig miners via social engineering.
author: Security Arsenal Threat Intelligence
date: 2026/09/03
references:
  - https://www.huntress.com/blog/rogue-screenconnect-installations
logsource:
  category: process_creation
  product: windows
detection:
  selection_vbs_staging:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains:
      - '1.vbs'
      - '2.vbs'
      - '3.vbs'
      - '4.vbs'
  selection_screenconnect_child:
    ParentImage|contains:
      - 'ScreenConnect.ClientService.exe'
      - 'ScreenConnect.WindowsClient.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\msiexec.exe'
  condition: 1 of selection_*
falsepositives:
  - Legitimate help desk scripted remediation via sanctioned RMM (verify authorized ScreenConnect instances first)
level: critical
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.execution
  - attack.t1059.005
  - attack.impact
  - attack.t1496
---
title: ScreenConnect Service Persistence with Suspicious Instance Name
id: 9f5b3c4a-1d6e-6a0c-c3b7-4e8f0a1b2c3d
status: experimental
description: Detects creation of ScreenConnect Windows services with non-standard or obfuscated instance names, a persistence mechanism used in rogue RMM worm campaigns alongside VBScript loaders.
author: Security Arsenal Threat Intelligence
date: 2026/09/03
logsource:
  product: windows
  service: system
  definition: Event ID 7045 - A service was installed in the system
detection:
  selection:
    EventID: 7045
    ServiceName|contains:
      - 'ScreenConnect'
  filter_authorized:
    ServiceName|contains:
      - 'ScreenConnect Client (YOUR-AUTHORIZED-INSTANCE-ID)'
  condition: selection and not filter_authorized
falsepositives:
  - Sanctioned IT/helpdesk ScreenConnect deployments (maintain authorized instance name in filter)
level: high
tags:
  - attack.persistence
  - attack.t1543.003
  - attack.command_and_control
  - attack.t1219

// Hunt: D2IP C2, rogue ScreenConnect activity, and Teams-campaign infrastructure
// Sentinel tables: DeviceNetworkEvents, DeviceProcessEvents, DeviceEvents
let CampaignIPs = dynamic(["45.13.237.190","5.181.3.106","178.130.47.46","80.66.72.215","185.155.99.161","45.8.157.185","2.56.172.214","185.234.67.53","136.0.20.6"]);
let D2IPWindow = 7d;
// Part 1: Direct hits on known campaign infrastructure
let KnownBadNet = DeviceNetworkEvents
    | where TimeGenerated > ago(D2IPWindow)
    | where RemoteIP in (CampaignIPs) or RemoteUrl contains "homehub.opik.net"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
    | extend HuntType = "Known IOC Network Hit";
// Part 2: Rogue ScreenConnect execution + VBScript staging chain
let ScreenConnectChain = DeviceProcessEvents
    | where TimeGenerated > ago(D2IPWindow)
    | where (ProcessCommandLine has_any ("1.vbs","2.vbs","3.vbs","4.vbs") and FileName in~ ("wscript.exe","cscript.exe"))
        or (InitiatingProcessFileName has "ScreenConnect" and FileName in~ ("cmd.exe","powershell.exe","wscript.exe","msiexec.exe"))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
    | extend HuntType = "Rogue RMM / VBS Staging";
// Part 3: D2IP behavior - outbound connections from processes with NO prior DNS query for that destination
let NoDnsProcesses = DeviceNetworkEvents
    | where TimeGenerated > ago(D2IPWindow)
    | where RemoteIPType == "Public" and ActionType == "ConnectionSuccess"
    | where isempty(RemoteUrl)
    | where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","svchost.exe","msmpeng.exe")
    | summarize Connections = count(), DistinctIPs = dcount(RemoteIP), IPs = make_set(RemoteIP, 10)
        by DeviceName, InitiatingProcessFileName, InitiatingProcessSHA256
    | extend HuntType = "D2IP Pattern (No DNS Resolution)";
KnownBadNet
| union ScreenConnectChain
| union (NoDnsProcesses | where DistinctIPs > 3)
| sort by TimeGenerated desc

# Security Arsenal - IOC & Artifact Hunt: D2IP / Rogue ScreenConnect / Teams Campaign
# Run elevated. Outputs CSV findings per host.
$ErrorActionPreference = 'SilentlyContinue'
$Findings = @()

# --- Known campaign IPs (ScreenConnect + Teams help desk campaigns) ---
$CampaignIPs = @("45.13.237.190","5.181.3.106","178.130.47.46","80.66.72.215",
                 "185.155.99.161","45.8.157.185","2.56.172.214","185.234.67.53","136.0.20.6")

# 1. Active & historical network connections to campaign IPs
Get-NetTCPConnection | Where-Object { $CampaignIPs -contains $_.RemoteAddress } | ForEach-Object {
    $Findings += [pscustomobject]@{ Type="ActiveConn-CampaignIP"; Detail="$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) (PID $($_.OwningProcess))"; Severity="CRITICAL" }
}
$dnsCache = Get-DnsClientCache | Where-Object { $_.Entry -like "*opik.net*" -or $_.Data -in $CampaignIPs }
foreach ($d in $dnsCache) { $Findings += [pscustomobject]@{ Type="DNSCache-IOC"; Detail="$($d.Entry) -> $($d.Data)"; Severity="HIGH" } }

# 2. Rogue ScreenConnect services (persistence) - flag ANY instance, verify against authorized list
$AuthorizedSC = "ScreenConnect Client (YOUR-AUTHORIZED-INSTANCE-ID)"
Get-CimInstance Win32_Service | Where-Object { $_.Name -like "ScreenConnect*" -and $_.Name -ne $AuthorizedSC } | ForEach-Object {
    $Findings += [pscustomobject]@{ Type="Rogue-ScreenConnect-Service"; Detail="$($_.Name) | $($_.PathName) | State=$($_.State)"; Severity="CRITICAL" }
}

# 3. VBScript staging artifacts in temp/user dirs (1.vbs-4.vbs chain)
$SearchPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:PUBLIC","C:\ProgramData")
foreach ($p in $SearchPaths) {
    Get-ChildItem -Path $p -Recurse -Include "1.vbs","2.vbs","3.vbs","4.vbs" -ErrorAction SilentlyContinue | ForEach-Object {
        $Findings += [pscustomobject]@{ Type="VBS-Staging-Artifact"; Detail="$($_.FullName) | Modified=$($_.LastWriteTime)"; Severity="HIGH" }
    }
}

# 4. XMRig artifacts - common miner process names, install paths, and Run-key persistence
$MinerNames = @("xmrig.exe","xmrig-notls.exe","miner.exe","system64.exe")
Get-Process | Where-Object { $MinerNames -contains $_.ProcessName + ".exe" -or $_.ProcessName -like "*xmrig*" } | ForEach-Object {
    $Findings += [pscustomobject]@{ Type="XMRig-Process"; Detail="$($_.ProcessName) | Path=$($_.Path) | PID=$($_.Id)"; Severity="CRITICAL" }
}
$RunKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($rk in $RunKeys) {
    (Get-ItemProperty $rk).PSObject.Properties | Where-Object { $_.Value -match "xmrig|miner|\.vbs|screenconnect" } | ForEach-Object {
        $Findings += [pscustomobject]@{ Type="Suspicious-RunKey"; Detail="$rk | $($_.Name) = $($_.Value)"; Severity="HIGH" }
    }
}

# 5. Scheduled tasks referencing VBS loaders or miner paths
Get-ScheduledTask | Where-Object { ($_.Actions.Execute + $_.Actions.Arguments) -match "\.vbs|xmrig|wscript.*temp|screenconnect" } | ForEach-Object {
    $Findings += [pscustomobject]@{ Type="Suspicious-ScheduledTask"; Detail="$($_.TaskName) | $($_.Actions.Execute) $($_.Actions.Arguments)"; Severity="HIGH" }
}

# 6. Sample hashes from D2IP pulse - scan common staging dirs
$BadHashes = @("9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4",
               "e3513922666c202c1ae5c06eea277ba10477868d6d89ce2819f4f8ff9070bc85",
               "01a96eeafb72042b3f69afd21b4c9155dbfe7f97ab3dca392972ad531a075ac2",
               "bf24277400cc453d530e4277d3bd24e96c5e409adef6970518bdc59205aa0241")
foreach ($p in $SearchPaths) {
    Get-ChildItem -Path $p -Recurse -File -Include *.exe,*.dll,*.vbs,*.ps1 -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($BadHashes -contains $h) { $Findings += [pscustomobject]@{ Type="Known-Malware-Hash"; Detail="$($_.FullName) | $h"; Severity="CRITICAL" } }
    }
}

# --- Output ---
$Findings | Sort-Object Severity | Format-Table -AutoSize
$Findings | Export-Csv -Path ".\OTX-Hunt-Findings-$(Get-Date -Format 'yyyyMMdd-HHmm').csv" -NoTypeInformation
if (-not $Findings) { Write-Host "[+] No indicators found on this host." -ForegroundColor Green }