Global Crypto Fraud Takedown: Detecting 'Pig Butchering' and Remote Access Abuse

---
title: Suspicious Remote Access Tool Execution from User Directory
id: 8a4b1c92-3d5e-4f6a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects execution of common remote access tools from user-writable directories (AppData/Temp), often used in fraud and scam operations to bypass installation requirements or evade detection.
references:
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
    Image|endswith:
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\rustdesk.exe'
      - '\supremo.exe'
      - '\screenconnect.exe'
      - '\aeradmin.exe'
  selection_path:
    CommandLine|contains:
      - '\AppData\Local\Temp'
      - '\AppData\Roaming'
  condition: all of selection_*
falsepositives:
  - Legitimate portable use of IT support tools (rare in managed environments)
level: high
---
title: Potential Crypto Wallet or Miner Execution
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects execution of known crypto wallet or mining binaries on corporate endpoints, which may indicate "pig butchering" fraud activity or unauthorized resource usage.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.resource_hijacking
  - attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains:
      - '\AppData\Roaming\'
    Image|endswith:
      - '\exodus.exe'
      - '\atomic.exe'
      - '\bitcoin-qt.exe'
      - '\ethereumwallet.exe'
      - '\nicehash.exe'
      - '\xmrig.exe'
  filter:
    Image|contains: '\Program Files\'
  condition: selection and not filter
falsepositives:
  - Authorized usage by finance/development teams
level: medium

// Hunt for Remote Access Tools running from non-standard paths
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("anydesk.exe", "teamviewer.exe", "rustdesk.exe", "supremo.exe", "aeradmin.exe")
| where FolderPath !contains @"Program Files" and FolderPath !contains @"Program Files (x86)"
| extend DeviceName, AccountName, InitiatingProcessAccountName
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName
| order by Timestamp desc

-- Hunt for Remote Access Tools running from suspicious user directories
SELECT Pid, Name, Exe, Username, CommandLine, Ctime
FROM pslist()
WHERE Name IN ('AnyDesk.exe', 'TeamViewer.exe', 'RustDesk.exe', 'SupRemo.exe')
  AND (Exe =~ 'AppData\\Local\\Temp' OR Exe =~ 'AppData\\Roaming')

-- Hunt for common crypto-related binaries in user profiles
SELECT FullPath, Size, Mtime
FROM glob(globs='/*/Users/*/*/AppData/Roaming/*/{exodus.exe,atomic.exe,bitcoin-qt.exe,ethereumwallet.exe}')

<#
.SYNOPSIS
    Detects and kills unauthorized Remote Access Tools (RATs) running from user directories.
    Used for remediation of "Pig Butchering" scam tools.
#>

$SuspiciousProcesses = @(
    "AnyDesk", "TeamViewer", "RustDesk", "SupRemo", "AERAdmin"
)

Write-Host "[+] Scanning for unauthorized remote access tools..." -ForegroundColor Cyan

foreach ($ProcName in $SuspiciousProcesses) {
    $Processes = Get-Process -Name $ProcName -ErrorAction SilentlyContinue
    
    foreach ($Proc in $Processes) {
        $Path = $Proc.Path
        # Check if running from Program Files (legitimate install) or User Directory (suspicious portable)
        if ($Path -match "C:\\Users\\") {
            Write-Host "[!] ALERT: Suspicious process found: $($ProcName) (PID: $($Proc.Id))" -ForegroundColor Red
            Write-Host "    Path: $Path"
            
            # Stop Process
            Stop-Process -Id $Proc.Id -Force
            Write-Host "    Action: Process terminated." -ForegroundColor Yellow
        }
    }
}

Write-Host "[+] Scan complete." -ForegroundColor Green