Defending Against CL-STA-1062 TinyRCT Backdoor: Detection & Mitigation

---
title: Potential TinyRCT Backdoor - Suspicious Service Installation
id: 8a4b1c92-0f3e-4a5d-9b2c-3d4e5f6a7b8c
status: experimental
description: Detects the installation of services with suspicious characteristics commonly used by custom backdoors like TinyRCT, such as binary paths in user directories or unusual command lines.
references:
  - https://attack.mitre.org/techniques/T1543/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'create'
      - 'config'
    CommandLine|contains:
      - 'sc.exe'
      - 'powershell.exe -command New-Service'
    CommandLine|contains:
      - 'binPath='
  filter_legit:
    CommandLine|contains:
      - 'C:\\Windows\\System32\\'
      - 'C:\\Program Files\\'
      - 'C:\\Program Files (x86)\\'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate software installation by administrators
level: high
---
title: Suspicious Network Connection from System Process
id: 9b5c2d03-1g4f-5b6e-0c3d-4e5f6g7h8i9j
status: experimental
description: Detects system processes (like svchost or generic runtime hosts) initiating outbound connections to non-standard ports or external IPs, characteristic of injected backdoor code.
references:
  - https://attack.mitre.org/techniques/T1055/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.defense_evasion
  - attack.t1055.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|endswith:
      - '\\svchost.exe'
      - '\\rundll32.exe'
      - '\\regsvr32.exe'
    DestinationPort|not:
      - 80
      - 443
      - 8080
  condition: selection
falsepositives:
  - Windows Update traffic
  - Legitimate system management tools
level: medium
---
title: TinyRCT Indicators - Unsigned Process in System Path
id: 0c6d3e14-2h5g-6c7f-1d4e-5f6g7h8i9j0k
status: experimental
description: Detects execution of unsigned binaries from system directories, a common technique for custom backdoors attempting to appear system-native.
references:
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.defense_evasion
  - attack.t1036.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - 'C:\\Windows\\System32\\'
      - 'C:\\Windows\\SysWOW64\\'
    Signed: 'false'
  condition: selection
falsepositives:
  - Rare instances of legitimate unsigned internal tools
level: high

let HighRiskPorts = dynamic([4444, 5555, 6666, 8080, 8888, 9000, 9999]);
DeviceNetworkEvents
| where InitiatingProcessFolderPath !contains "Program Files" 
and InitiatingProcessFolderPath !contains "Windows"
| where RemotePort in (HighRiskPorts) or RemotePort > 1024
| where ActionType == "ConnectionSuccess"
| summarize ConnectionCount=count(), DistinctIPs=dcount(RemoteIP) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP
| where ConnectionCount > 5
| project DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, ConnectionCount

-- Hunt for active connections from suspicious directories
SELECT 
  Pid, 
  Name, 
  Exe, 
  Cmdline, 
  Username
FROM pslist()
WHERE Exe =~ 'C:\\Users\\.*\\AppData\\' 
   OR Exe =~ 'C:\\ProgramData\\'
   OR Exe =~ 'C:\\Windows\\Temp\\'
JOIN ON Pid
SELECT 
  Pid,
  RemoteAddress,
  RemotePort,
  State
FROM netstat()
WHERE State = 'ESTABLISHED'

# Audit for potentially malicious services used for persistence (TinyRCT)
Write-Host "[+] Auditing services for suspicious binary paths..."

$suspiciousPaths = @(
    "$env:USERPROFILE",
    "$env:PUBLIC",
    "$env:TEMP",
    "C:\PerfLogs",
    "C:\Windows\Tasks"
)

Get-WmiObject Win32_Service | Where-Object { 
    $_.State -eq 'Running' -and 
    $_.PathName -ne $null -and
    ($suspiciousPaths | Where-Object { $_.PathName -like "*$_*" })
} | ForEach-Object {
    Write-Host "[!] Suspicious Service Found:" -ForegroundColor Red
    Write-Host "    Name: $($_.Name)"
    Write-Host "    PathName: $($_.PathName)"
    Write-Host "    StartMode: $($_.StartMode)"
    Write-Host "    ProcessId: $($_.ProcessId)"
}

Write-Host "[+] Audit complete."