Gamaredon GammaWorm, SideCopy XenoRAT, and BTMOB MaaS Campaigns: OTX Pulse Analysis & Enterprise Detection Pack

---
title: Potential Gamaredon HTML Smuggling and RAR Exploitation
id: 9a3c4d1e-5f6b-4a7c-8e9d-1f2a3b4c5d6e
description: Detects suspicious execution patterns associated with Gamaredon campaigns, specifically RAR extraction leading to HTA execution and use of WinRAR exploits.
status: experimental
date: 2026/06/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66555a4e1c2e3e4b5c6d7e8f
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\winrar.exe'
        Image|endswith: '\cmd.exe'
        CommandLine|contains: 'script.hta' # Generic heuristic for HTA execution from archive
    condition: selection
falsepositives:
    - Legitimate administrators extracting and running scripts
level: high
tags:
    - attack.initial_access
    - attack.execution
    - gamaredon
    - cve-2025-8088
---
title: SideCopy XenoRAT LNK Execution via mshta.exe
id: b4c5d6e7-6g7h-5i8j-9f0a-2b3c4d5e6f7g
description: Detects the execution of mshta.exe initiated by a .lnk file, a common TTP for SideCopy campaigns delivering XenoRAT.
status: experimental
date: 2026/06/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66555a4e1c2e3e4b5c6d7e90
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\mshta.exe'
        ParentImage|endswith: '\explorer.exe'
        CommandLine|contains: '.hta'
    filter_legit:
        CommandLine|contains: 'C:\Windows\System32'
    condition: selection and not filter_legit
falsepositives:
    - Administrative troubleshooting
level: high
tags:
    - attack.initial_access
    - attack.execution
    - apt36
    - sidecopy
    - xenorat
---
title: Cloudflare Tunnel C2 Activity (Gamaredon)
id: c5d6e7f8-7h8i-6j9k-0a1b-3c4d5e6f7g8h
description: Detects processes establishing connections to suspicious Cloudflare tunnel domains often used by Gamaredon for C2.
status: experimental
date: 2026/06/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66555a4e1c2e3e4b5c6d7e8f
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains: '.trycloudflare.com'
        Initiated: 'true'
    condition: selection
falsepositives:
    - Legitimate developer use of Cloudflare tunnels
level: medium
tags:
    - attack.command_and_control
    - gamaredon
    - defense_evasion

// Hunt for SideCopy and Gamaredon Network IOCs
let IOCs = dynamic([
    "104.194.140.6", "103.132.98.224", "191.96.225.241", "191.96.79.41", 
    "200.9.155.153", "195.160.221.203", "iiwdsxwamylbwwsoyrmj.supabase.co", 
    "quitethepastry.ru", "abimj.edu.af", "trycloudflare.com"
]);
DeviceNetworkEvents
| where RemoteIP in (IOCs) or RemoteUrl has_any (IOCs)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| summarize count() by DeviceName, RemoteUrl
| order by count_ desc


kql
// Hunt for HTA persistence in Startup folders (Gamaredon)
DeviceFileEvents
| whereFolderPath contains "Start Menu\\Programs\\Startup"
| where FileName endswith ".hta"
| project Timestamp, DeviceName, FileName,FolderPath, SHA256, InitiatingProcessAccountName
| order by Timestamp desc

# Security Arsenal Threat Hunt: Gamaredon & SideCopy Persistence Check
# Checks for HTA files in Startup and Suspicious Scheduled Tasks

Write-Host "[+] Checking for suspicious HTA files in Startup directories..." -ForegroundColor Cyan

$StartUpPaths = @(
    "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
    "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
)

foreach ($Path in $StartUpPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Filter "*.hta" -ErrorAction SilentlyContinue | ForEach-Object {
            Write-Host "[!] Suspicious HTA found: $($_.FullName)" -ForegroundColor Red
            $Hash = Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue
            Write-Host "    MD5: $($Hash.Hash)"
        }
    }
}

Write-Host "[+] Checking for recent modifications to Run registry keys..." -ForegroundColor Cyan

$RunKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-Item -Path $Key | ForEach-Object {
            $_.GetValueNames() | ForEach-Object {
                $Value = $_.GetValue($_)
                if ($Value -match "mshta" -or $Value -match ".hta" -or $Value -match "trycloudflare") {
                    Write-Host "[!] Suspicious persistence in $Key" -ForegroundColor Yellow
                    Write-Host "    Name: $_ | Value: $Value"
                }
            }
        }
    }
}

Write-Host "[+] Hunt complete." -ForegroundColor Green