DragonForce Ransomware Cartel, Noodle RAT Espionage Cluster + ScreenConnect Invitation Lures: OTX Pulse Analysis — Enterprise Detection Pack

---
title: DragonForce Pre-Ransomware Staging - SystemBC and Shadow Copy Deletion
id: 9c2f1a7e-4b5d-4e6a-8f1c-df20261017a1
status: experimental
description: Detects DragonForce ransomware pre-encryption staging behaviors including SystemBC proxy execution, vssadmin shadow deletion, and suspicious Cobalt Strike-style process chains observed in DragonForce affiliate intrusions.
author: Security Arsenal Threat Intelligence
references:
  - https://www.bitsight.com/blog/threat-actor-profile-dragonforce-ransomware-group
date: 2026/10/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\diskshadow.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'delete shadows /all'
  selection_systembc:
    CommandLine|contains:
      - 'socks5'
      - '-relay'
      - 'tor.exe'
    Image|endswith:
      - '\sys.exe'
      - '\syswow64.exe'
      - '\systembc.exe'
  condition: selection_vss or selection_systembc
falsepositives:
  - Legitimate backup administration
  - IT disk management scripts
level: high
tags:
  - attack.impact
  - attack.t1490
  - attack.command_and_control
  - attack.t1090
---
title: Noodle RAT Loader Execution - MULTIDROP MICROLOAD Process Anomalies
id: 7e3b8d2f-1c4a-4f9b-9d2e-nr20261017b2
status: experimental
description: Detects Noodle RAT (ANGRYREBEL) loader-stage execution patterns including unsigned binaries launched from temp/public directories spawning unexpected child processes and outbound network-capable shells, consistent with MULTIDROP and MICROLOAD delivery chains used by Iron Tiger and Calypso APT clusters.
author: Security Arsenal Threat Intelligence
references:
  - https://cyberint.com/blog/dark-web/noodle-rat-a-recipe-for-cross-platform-espionage
date: 2026/10/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
  selection_child:
    CommandLine|contains:
      - 'powershell'
      - 'cmd /c'
      - 'rundll32'
      - 'regsvr32'
      - 'schtasks /create'
      - 'net user'
  filter_signed:
    Signed: 'true'
  condition: selection_path and selection_child and not filter_signed
falsepositives:
  - Software installers running from temp directories
  - Enterprise software deployment tools
level: medium
tags:
  - attack.execution
  - attack.t1059
  - attack.persistence
  - attack.t1053
---
title: ScreenConnect Installation Following Phishing Lure Execution
id: 2f8a4c6d-9e1b-4a3c-b7d5-sc20261017c3
status: experimental
description: Detects installation or execution of ConnectWise ScreenConnect remote access software launched from browser or mail client process trees, consistent with the fake event invitation phishing campaign delivering ScreenConnect as a RAT via CAPTCHA-gated lure pages.
author: Security Arsenal Threat Intelligence
references:
  - https://cofense.com/blog/rsvp-to-disaster-how-one-click-installs-a-rat
date: 2026/10/17
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\outlook.exe'
      - '\explorer.exe'
  selection_screenconnect:
    Image|contains:
      - 'ScreenConnect'
      - 'ConnectWise'
    OriginalFileName|contains:
      - 'ScreenConnect'
  condition: selection_parent and selection_screenconnect
falsepositives:
  - Legitimate IT-initiated remote support sessions (whitelist approved deployment paths)
  - MSP-managed ScreenConnect rollouts
level: high
tags:
  - attack.command_and_control
  - attack.t1219
  - attack.initial_access
  - attack.t1566

// Multi-pulse hunt: DragonForce C2 infrastructure, Noodle RAT C2 domain,
// ScreenConnect lure domain, and suspicious ScreenConnect process trees
let BadIPs = dynamic(["94.232.46.202", "185.73.125.8"]);
let BadDomains = dynamic(["shdufysuf.com", "theinvitationestateco.vu"]);
let NetHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteIP in (BadIPs) or RemoteUrl has_any (BadDomains)
    | project NetHitTime=TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort,
              InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType;
let ProcHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where (FileName has_any ("ScreenConnect", "ConnectWise")
        and InitiatingProcessFileName has_any ("chrome.exe", "msedge.exe", "firefox.exe", "outlook.exe"))
       or ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no")
       or SHA256 in (
           "9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507",
           "f3aab811ae8163e09db40db201facc7e189d1a1b161be265202ca54b39b5e6cc",
           "33641bfbbdd5a9cd2320c61f65fe446a2226d8a48e3bd3c29e8f916f0592575f",
           "51aed28d3468de5e75addc467ba14389356afe896098e4e478efcd7bf79a65b9",
           "7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3",
           "7aa50ba59b38494cc524dbd31519bd3a218133aed64d9037eef02d697b8e99d0",
           "df603ed55cbf6f9d74068b956ab966a7b785eb102e1045f343d96255eb2cdc24")
    | project ProcHitTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine,
              InitiatingProcessFileName, SHA256, FolderPath;
NetHits
| join kind=fullouter ProcHits on DeviceName
| order by DeviceName asc

# Security Arsenal - Multi-Pulse IOC Hunt
# Hunts DragonForce staging artifacts, Noodle RAT persistence, and ScreenConnect installs
# Run elevated on Windows endpoints or deploy via your RMM/EDR scripting engine

$report = @()

# --- 1. Network: DragonForce C2 / Noodle RAT infrastructure ---
$badIPs = @('94.232.46.202', '185.73.125.8')
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue |
    Where-Object { $badIPs -contains $_.RemoteAddress -and $_.State -ne 'TimeWait' }
foreach ($c in $conns) {
    $report += [PSCustomObject]@{
        Check   = 'DragonForce C2 Connection'
        Finding = "Active/historical connection to $($c.RemoteAddress):$($c.RemotePort) (PID $($c.OwningProcess))"
        Severity = 'CRITICAL'
    }
}

# --- 2. DNS cache: lure + C2 domain resolution ---
$badDomains = @('shdufysuf.com', 'theinvitationestateco.vu')
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue |
    Where-Object { $d = $_.Entry; $badDomains | Where-Object { $d -like "*$_*" } }
foreach ($d in $dns) {
    $report += [PSCustomObject]@{
        Check   = 'Malicious Domain Resolution'
        Finding = "DNS cache hit: $($d.Entry) -> $($d.Data)"
        Severity = 'HIGH'
    }
}

# --- 3. ScreenConnect unauthorized installation artifacts ---
$scPaths = @(
    "$env:ProgramFiles\ScreenConnect*",
    "${env:ProgramFiles(x86)}\ScreenConnect*",
    "$env:TEMP\ScreenConnect*",
    "$env:USERPROFILE\Downloads\*ScreenConnect*"
)
foreach ($p in $scPaths) {
    if (Test-Path $p) {
        $report += [PSCustomObject]@{
            Check   = 'ScreenConnect Artifact'
            Finding = "Path present: $p"
            Severity = 'HIGH'
        }
    }
}
$scServices = Get-Service -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -like '*ScreenConnect*' -or $_.DisplayName -like '*ScreenConnect*' }
foreach ($s in $scServices) {
    $report += [PSCustomObject]@{
        Check   = 'ScreenConnect Service (Persistence)'
        Finding = "Service: $($s.Name) [$($s.Status)] - verify against approved RMM inventory"
        Severity = 'HIGH'
    }
}

# --- 4. Ransomware staging: shadow copy state + suspicious scheduled tasks ---
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    $report += [PSCustomObject]@{
        Check   = 'Shadow Copies Deleted'
        Finding = 'No VSS shadow copies present - consistent with pre-encryption staging'
        Severity = 'CRITICAL'
    }
}
$susTasks = Get-ScheduledTask -ErrorAction SilentlyContinue |
    Where-Object { $_.Actions.Execute -match 'Temp|AppData|ProgramData' -and $_.TaskPath -notlike '\Microsoft*' }
foreach ($t in $susTasks) {
    $report += [PSCustomObject]@{
        Check   = 'Suspicious Scheduled Task'
        Finding = "$($t.TaskName): $($t.Actions.Execute) $($t.Actions.Arguments)"
        Severity = 'MEDIUM'
    }
}

# --- 5. Noodle RAT-style autostart persistence from user-writable paths ---
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
    $vals = Get-ItemProperty $rk -ErrorAction SilentlyContinue
    if ($vals) {
        $vals.PSObject.Properties | Where-Object {
            $_.Value -match 'Temp|AppData|ProgramData' -and $_.Name -notmatch '^PS'
        } | ForEach-Object {
            $report += [PSCustomObject]@{
                Check   = 'Autostart from User-Writable Path'
                Finding = "$rk -> $($_.Name) = $($_.Value)"
                Severity = 'HIGH'
            }
        }
    }
}

if ($report.Count -eq 0) {
    Write-Output "[CLEAN] No pulse IOC artifacts detected on $env:COMPUTERNAME"
} else {
    $report | Sort-Object Severity | Format-Table -AutoSize
    $report | Export-Csv "$env:TEMP\ioc_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
}