GoGRPC Backdoor + Teams Vishing IAB Campaign and Sliver Intrusions on Philippine Nuclear/Defense Targets: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Quick Assist Execution Following Teams Interaction - Vishing IAB TTP
id: 7f2a1c9e-3b4d-4e5a-9c6f-2d8b1a4e5f01
status: experimental
description: Detects Quick Assist (quickassist.exe) spawning PowerShell or script interpreters, consistent with Teams vishing helpdesk-impersonation intrusions deploying GoGRPC/BlindDoor. Quick Assist spawning child processes is highly anomalous.
author: Security Arsenal Threat Intelligence
references:
  - https://www.zscaler.com/blogs/security-research/helpdesk-hijackers-teams-vishing-quick-assist-and-gogrpc-backdoor
date: 2026/08/26
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith: '\quickassist.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate helpdesk troubleshooting scripts (rare; validate against IT ticket records)
level: high
tags:
  - attack.initial_access
  - attack.t1656
  - attack.t1059
---
title: GoGRPC / RSOX C2 Communication to Known IAB Infrastructure
id: 8e3b2d0f-4c5e-5f6b-0d7a-3e9c2b5f6a02
status: experimental
description: Detects network connections to known GoGRPC/RSOX C2 and staging infrastructure from the Helpdesk Hijackers campaign and Sliver operator infrastructure from the Philippine intrusions.
author: Security Arsenal Threat Intelligence
references:
  - https://www.zscaler.com/blogs/security-research/helpdesk-hijackers-teams-vishing-quick-assist-and-gogrpc-backdoor
  - https://hunt.io/blog/chinese-speaking-operator-philippine-nuclear-naval-contractor
date: 2026/08/26
logsource:
  category: network_connection
  product: windows
  service: sysmon
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'scansec-upd.com'
      - 'fine-work-team.com'
      - 'timelevel12.com'
      - 'zooparkko.com'
  selection_ip:
    DestinationIp: '31.58.209.241'
  condition: 1 of selection_*
falsepositives:
  - None expected; these are dedicated attacker-controlled hosts
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1572
---
title: Suspicious gRPC or Reverse SOCKS Tunneling Behavior
id: 9f4c3e1a-5d6f-6a7c-1e8b-4f0d3c6a7b03
status: experimental
description: Detects non-browser, non-standard processes making outbound TLS connections with characteristics of gRPC C2 or reverse SOCKS proxy tunneling (RSOX/RevSocket), including Go-compiled binaries executing from user-writable paths.
author: Security Arsenal Threat Intelligence
date: 2026/08/26
logsource:
  category: network_connection
  product: windows
  service: sysmon
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
  selection_port:
    DestinationPort:
      - 443
      - 8443
      - 50051
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\teams.exe'
      - '\onedrive.exe'
  condition: selection_path and selection_port and not filter_browsers
falsepositives:
  - Legitimate user-installed applications in AppData (Slack, Discord) - tune per environment
level: medium
tags:
  - attack.command_and_control
  - attack.t1572
  - attack.t1090

// Helpdesk Hijackers + Sliver operator hunt — Microsoft Sentinel / Defender
// 1) Quick Assist abuse: quickassist.exe spawning script interpreters
let QAHunt = DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where InitiatingProcessFileName =~ "quickassist.exe"
| where FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe")
| project QA_Time=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, ReportId;
// 2) Network connections to known C2 / staging infrastructure
let C2Hunt = DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteUrl has_any ("scansec-upd.com","fine-work-team.com","timelevel12.com","zooparkko.com")
   or RemoteIP == "31.58.209.241"
| project C2_Time=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
// 3) PowerShell download cradles referencing campaign domains
let PSHunt = DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine has_any ("scansec-upd","timelevel12","fine-work-team","DownloadString","IEX","Invoke-WebRequest")
| project PS_Time=TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
// Union all three views for triage
union QAHunt, C2Hunt, PSHunt
| sort by DeviceName

# Security Arsenal - Helpdesk Hijackers / GoGRPC + Sliver IOC Hunt
# Run elevated on suspected endpoints. Checks persistence, artifacts, and live connections.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

Write-Host "[*] Checking persistence mechanisms..." -ForegroundColor Cyan

# Registry Run keys
$runKeys = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($key in $runKeys) {
  Get-ItemProperty -Path $key | ForEach-Object {
    $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|Temp|ProgramData|powershell' } |
      ForEach-Object { $report += [pscustomobject]@{Type='RunKey'; Detail="$key :: $($_.Name) = $($_.Value)"} }
  }
}

# Scheduled tasks invoking scripts or user-writable paths
Get-ScheduledTask | ForEach-Object {
  $actions = ($_.Actions | Out-String)
  if ($actions -match 'powershell|AppData|Temp|ProgramData|rundll32') {
    $report += [pscustomobject]@{Type='ScheduledTask'; Detail="$($_.TaskName) :: $actions"}
  }
}

Write-Host "[*] Checking for Quick Assist execution artifacts..." -ForegroundColor Cyan
$qaPaths = @("$env:LOCALAPPDATA\Packages\MicrosoftCorporationII.QuickAssist*")
if (Test-Path "$env:USERPROFILE\AppData\Local\Packages") {
  Get-ChildItem "$env:USERPROFILE\AppData\Local\Packages" -Directory |
    Where-Object Name -match 'QuickAssist' |
    ForEach-Object { $report += [pscustomobject]@{Type='QuickAssistArtifact'; Detail=$_.FullName} }
}
# Quick Assist logs (session evidence)
$qaLogs = "$env:WINDIR\Logs\QuickAssist"
if (Test-Path $qaLogs) {
  Get-ChildItem $qaLogs -Recurse | ForEach-Object {
    $report += [pscustomobject]@{Type='QuickAssistLog'; Detail=$_.FullName}
  }
}

Write-Host "[*] Checking network connections to known C2..." -ForegroundColor Cyan
$badDomains = @('scansec-upd.com','fine-work-team.com','timelevel12.com','zooparkko.com')
$badIP = '31.58.209.241'
Get-NetTCPConnection -State Established | ForEach-Object {
  $proc = Get-Process -Id $_.OwningProcess
  if ($_.RemoteAddress -eq $badIP) {
    $report += [pscustomobject]@{Type='C2Connection-IP'; Detail="$($proc.ProcessName) (PID $($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort)"}
  }
  $resolved = (Resolve-DnsName -Name $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost
  foreach ($d in $badDomains) {
    if ($resolved -match $d) {
      $report += [pscustomobject]@{Type='C2Connection-DNS'; Detail="$($proc.ProcessName) -> $resolved ($($_.RemoteAddress))"}
    }
  }
}

Write-Host "[*] Hash-hunting staged payloads in user-writable paths..." -ForegroundColor Cyan
$badMD5 = @('3d1819de80c5a6633bc546f7b07086a4','7a818efa2a3af3130a3c4b69260a08aa',
            '925dc63fc70de650127f41e00e9ffbf3','b42366dcf2612adb43ed0c617bfa98d4',
            'b6a74fcadf1efca4e9f01658529556bc')
$badSHA256 = @('10df3451915ea35bcb17efe121415f24182680e2d07fc09df07ee695072104c1')
$scanPaths = @("$env:LOCALAPPDATA\Temp","$env:APPDATA","$env:PUBLIC","C:\ProgramData")
foreach ($p in $scanPaths) {
  Get-ChildItem $p -Recurse -File -Include *.exe,*.dll,*.ps1 -ErrorAction SilentlyContinue | ForEach-Object {
    $h = Get-FileHash $_.FullName -Algorithm MD5
    if ($badMD5 -contains $h.Hash.ToLower()) {
      $report += [pscustomobject]@{Type='HashMatch-MD5'; Detail=$_.FullName}
    }
  }
}

Write-Host "[*] Checking DNS cache for C2 lookups..." -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $d = $_.Entry; $badDomains | Where-Object { $d -match $_ } } |
  ForEach-Object { $report += [pscustomobject]@{Type='DNSCache'; Detail="$($_.Entry) -> $($_.Data)"} }

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($report.Count -eq 0) { Write-Host "No indicators found on this host." -ForegroundColor Green }
else { $report | Format-Table -AutoSize | Out-String -Width 300 | Write-Host }
$report | Export-Csv -Path ".\iab_sliver_hunt_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation