Dutch Takedown of 17M-Device Botnet: C2 Infrastructure Analysis and Detection

---
title: Potential Botnet C2 Traffic to Dutch Infrastructure
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects outbound connections to IP ranges associated with the recent Dutch botnet takedown. Note: Update the `ip_range` list with specific IOCs from the NCSC advisory.
references:
  - https://www.ncsc.nl/
  - https://www.politie.nl/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIp|cidr:
      - '0.0.0.0/0' # REPLACE WITH NCSC PUBLISHED IOC CIDR BLOCKS
    DestinationPort:
      - 80
      - 443
      - 8080
  filter:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter
falsepositives:
  - Legitimate traffic to Dutch entities
level: high
---
title: Suspicious Linux/Botnet Process Execution
id: 9c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects common execution patterns used by IoT/Linux botnets, often involving removal of running processes and downloading binaries from remote servers.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/12
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'wget http'
      - 'curl http'
      - 'tftp'
      - '/tmp/'
      - '/dev/shm/'
    CommandLine|contains:
      - 'rm -rf'
      - 'killall'
  condition: selection
falsepositives:
  - Legitimate administrative scripts
level: medium

let NL_ASNs = dynamic(["AS16245", "AS20562", "AS1136"]); // Add specific ASN IDs from NCSC report
let TimeFrame = 1h;
DeviceNetworkEvents
| where Timestamp > ago(TimeFrame)
| where RemotePort in (80, 443, 8080, 5555) // Common botnet ports
| where ActionType == "ConnectionSuccess"
// Filter for traffic to Netherlands or specific suspicious IOCs
| where RemoteCountry == "NL" or RemoteIP has_any (array_of_suspicious_ips) // Update array_of_suspicious_ips
| summarize Count = count(), DistinctIPs = dcount(RemoteIP), TimeSeen = max(Timestamp) by DeviceName, InitiatingProcessFileName, RemoteIP
| where Count > 10 // Threshold for beaconing activity
| project DeviceName, InitiatingProcessFileName, RemoteIP, Count, TimeSeen
| order by Count desc

-- Hunt for suspicious processes listening on non-standard ports or common botnet paths
SELECT Pid, Name, Exe, Cmdline, Username, Cwd
FROM pslist()
WHERE Exe =~ '/tmp/' OR Exe =~ '/dev/shm/' OR Exe =~ '/var/tmp/'
   OR Name IN ('wget', 'curl', 'tftp', 'busybox')
   AND Cmdline =~ 'http'

-- Hunt for established network connections to non-local IPs
SELECT Fd, Family, RemoteAddr, State, Pid
FROM netstat()
WHERE State = 'ESTABLISHED'
   AND NOT RemoteAddr =~ '127.0.0.1'
   AND NOT RemoteAddr =~ '::1'
   AND NOT RemoteAddr =~ '192.168.'
   AND NOT RemoteAddr =~ '10.'

# Check for suspicious processes connecting to non-standard ports
$SuspiciousPorts = @(8080, 6667, 4444, 5555)
$Processes = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
              Where-Object { $SuspiciousPorts -contains $_.RemotePort } |
              Select-Object OwningProcess, RemoteAddress, RemotePort

if ($Processes) {
    Write-Warning "Found processes with established connections on suspicious ports."
    $Processes | ForEach-Object {
        $Proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "PID: $($_.OwningProcess) Path: $($Proc.Path) Remote: $($_.RemoteAddress):$($_.RemotePort)"
    }
} else {
    Write-Host "No suspicious connections detected on monitored ports."
}

# Audit Windows Firewall for block-all status (recommended for IoT segments)
$FirewallProfile = Get-NetFirewallProfile | Select-Object Name, Enabled
Write-Host "Current Firewall Profiles:"
$FirewallProfile | Format-Table Name, Enabled -AutoSize