Google Infrastructure Trust-Proxy Phishing Campaign + ScreenConnect Delivery: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Suspicious Redirect Chain via Google Infrastructure to Untrusted Domain
id: 7c3a1f2e-9b41-4d8a-a2c6-1e5f8a0b3d21
status: experimental
description: Detects web proxy sessions where a Google-owned property (Search, DoubleClick, Tag Manager, Analytics, Custom Search, Meet) is the referrer immediately before navigation to a known-bad or untrusted external domain. Characteristic of the trust-proxy phishing campaign abusing Google open redirects.
author: Security Arsenal Threat Intelligence
date: 2026/10/11
references:
    - https://blog.knowbe4.com/bypassing-the-gatekeepers-how-a-global-phishing-campaign-turns-googles-infrastructure-into-a-trust-proxy
logsource:
    category: proxy
product: webserver
detection:
    selection_referrer:
        c-referrer|contains:
            - 'google.com/url'
            - 'doubleclick.net'
            - 'googletagmanager.com'
            - 'google-analytics.com'
            - 'cse.google.com'
            - 'meet.google.com'
    selection_dest:
        c-uri|contains:
            - 'furqanmustafa.com'
            - 'pittni.com'
            - 'vazquezfleytas.com'
            - 'edificiocristal.pt'
            - 'velvorra.com'
            - 'reliabilityinoperations.de'
            - 'rydezyhrsysteminc.vu'
            - 'spectrhwqumbrands.vu'
    condition: selection_referrer and selection_dest
falsepositives:
    - Legitimate Google ad click-throughs to advertiser domains (tune with domain age/reputation filtering)
level: high
tags:
    - attack.initial_access
    - attack.t1566.002
---
title: ScreenConnect Remote Access Client Installation or Execution
id: 2d8b4c1a-6e57-4f92-b3d9-8a1c7e0f5b42
status: experimental
description: Detects installation service creation or execution of the ScreenConnect (ConnectWise Control) client, a legitimate RMM tool abused by phishing operators for persistent remote access following credential harvesting.
author: Security Arsenal Threat Intelligence
date: 2026/10/11
references:
    - https://blog.knowbe4.com/bypassing-the-gatekeepers-how-a-global-phishing-campaign-turns-googles-infrastructure-into-a-trust-proxy
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\ScreenConnect.ClientService.exe'
            - '\ScreenConnect.WindowsClient.exe'
            - '\ScreenConnect.Client.exe'
    selection_service:
        CommandLine|contains:
            - 'ScreenConnect Client'
            - 'screenconnect'
    filter_approved_rmm:
        Image|startswith:
            - 'C:\Program Files\ScreenConnect'
        # Add your approved RMM deployment paths here if ScreenConnect is sanctioned
    condition: (selection_img or selection_service) and not filter_approved_rmm
falsepositives:
    - Environments where ScreenConnect is the sanctioned RMM platform (suppress via approved path/publisher)
level: high
tags:
    - attack.command_and_control
    - attack.t1219
    - attack.persistence
    - attack.t1543.003
---
title: Phishing URL with Encoded Victim Email in Fragment or Query String
id: 9f1e6d3b-4c28-4a75-9e14-3b7d2f8c6a90
status: experimental
description: Detects inbound email URLs or web requests containing an email address encoded in the URL fragment or query string - a fingerprinting technique used by the credential-harvesting kit to pre-fill victim identity on phishing pages.
author: Security Arsenal Threat Intelligence
date: 2026/10/11
references:
    - https://blog.knowbe4.com/bypassing-the-gatekeepers-how-a-global-phishing-campaign-turns-googles-infrastructure-into-a-trust-proxy
logsource:
    category: proxy
product: webserver
detection:
    selection_email_param:
        c-uri|re: '(?i)(#|\?|&)(email|e|user|u|login|id)=([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}|[A-Za-z0-9+/=]{16,})'
    selection_external:
        c-uri|contains:
            - '.vu/'
            - '.de/'
            - '.com/'
            - '.pt/'
    filter_google:
        c-uri|contains:
            - 'google.com'
            - 'googleapis.com'
    condition: selection_email_param and selection_external and not filter_google
falsepositives:
    - Marketing platforms using email tokens in tracking links (tune by sender reputation)
level: medium
tags:
    - attack.initial_access
    - attack.t1566
    - attack.collection

// Hunt: Google trust-proxy phishing chain + ScreenConnect C2 (Microsoft Sentinel)
// Lookback: 30 days - adjust to your retention and first-seen IOC dates
let Lookback = 30d;
let PhishIOCs = dynamic([
    "furqanmustafa.com","pittni.com","vazquezfleytas.com","edificiocristal.pt",
    "velvorra.com","reliabilityinoperations.de","rydezyhrsysteminc.vu","spectrhwqumbrands.vu"
]);
// 1) Egress to known phishing landing / C2 domains
let LandingHits = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl has_any (PhishIOCs) or RemoteUrl endswith ".vu"
| project LandingHitTime=TimeGenerated, DeviceName, InitiatingProcessFileName,
          InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
// 2) ScreenConnect client execution or installation on any endpoint
let ScreenConnectActivity = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName has_any ("ScreenConnect.ClientService.exe","ScreenConnect.WindowsClient.exe","ScreenConnect.Client.exe")
   or ProcessCommandLine has "screenconnect"
| project SCEngTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;
// 3) Correlate: endpoints that hit landing infrastructure AND ran ScreenConnect (probable full compromise)
LandingHits
| join kind=inner ScreenConnectActivity on DeviceName
| extend TimeDelta = abs(datetime_diff('minute', SCEngTime, LandingHitTime))
| project DeviceName, LandingHitTime, RemoteUrl, RemoteIP, InitiatingProcessFileName,
          SCEngTime, FileName, ProcessCommandLine, TimeDelta, SHA256
| order by DeviceName asc, LandingHitTime asc;
// Secondary hunt: URL fragments/query strings carrying corporate email addresses in mail flow
// EmailUrlInfo (if MDE for Office licensed)
EmailUrlInfo
| where TimeGenerated > ago(Lookback)
| where Url matches regex @"(?i)(#|\?|&)(email|e|user|u|login)=([a-zA-Z0-9._%+-]+@|[A-Za-z0-9+/=]{16,})"
| project TimeGenerated, Url, UrlDomain, NetworkMessageId
| order by TimeGenerated desc;

# ============================================================
# IOC Hunt: Google Trust-Proxy Phishing Campaign + ScreenConnect
# Security Arsenal - Threat Intelligence | 2026-10-11
# Run elevated on suspected endpoints or via your EDR live-response
# ============================================================

$PhishDomains = @(
    "furqanmustafa.com","pittni.com","vazquezfleytas.com",
    "edificiocristal.pt","velvorra.com",
    "reliabilityinoperations.de","rydezyhrsysteminc.vu","spectrhwqumbrands.vu"
)

Write-Host "`n[1] ScreenConnect service / persistence artifacts" -ForegroundColor Cyan
Get-Service | Where-Object { $_.Name -like "*ScreenConnect*" -or $_.DisplayName -like "*ScreenConnect*" } |
    Select-Object Name, DisplayName, Status, StartType | Format-Table -AutoSize

Write-Host "`n[2] ScreenConnect registry persistence keys" -ForegroundColor Cyan
$RegPaths = @(
    "HKLM:\SYSTEM\CurrentControlSet\Services",
    "HKLM:\SOFTWARE",
    "HKCU:\SOFTWARE"
)
foreach ($base in $RegPaths) {
    Get-ChildItem $base -ErrorAction SilentlyContinue |
        Where-Object { $_.PSChildName -like "*ScreenConnect*" } |
        ForEach-Object { Write-Host "  HIT: $($_.PSPath)" -ForegroundColor Red }
}

Write-Host "`n[3] ScreenConnect binaries on disk (outside sanctioned paths)" -ForegroundColor Cyan
$scFiles = @(
    "$env:ProgramFiles","${env:ProgramFiles(x86)}","$env:ProgramData","$env:TEMP","$env:LOCALAPPDATA"
) | ForEach-Object {
    Get-ChildItem $_ -Recurse -Filter "ScreenConnect*.exe" -ErrorAction SilentlyContinue
}
$scFiles | Select-Object FullName, CreationTime, Length | Format-Table -AutoSize

Write-Host "`n[4] Active connections to ScreenConnect ports (8040/8041) or phishing C2" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 8040,8041 } |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess,
        @{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
    Format-Table -AutoSize

Write-Host "`n[5] DNS cache check for phishing landing domains" -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $PhishDomains) {
    $hits = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hits) {
        $hits | ForEach-Object { Write-Host "  HIT: $($_.Entry) -> $($_.Data)" -ForegroundColor Red }
    }
}

Write-Host "`n[6] Recent browser history artifacts (Chrome/Edge) for landing domains" -ForegroundColor Cyan
$historyPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History"
)
foreach ($hp in $historyPaths) {
    if (Test-Path $hp) {
        $tmp = Join-Path $env:TEMP ("hist_" + [guid]::NewGuid().ToString("N") + ".db")
        Copy-Item $hp $tmp -Force -ErrorAction SilentlyContinue
        # Requires sqlite3.exe in PATH; otherwise export $tmp for offline analysis
        foreach ($d in $PhishDomains) {
            $r = & sqlite3 $tmp "SELECT url, datetime(last_visit_time/1000000-11644473600,'unixepoch') FROM urls WHERE url LIKE '%$d%';" 2>$null
            if ($r) { $r | ForEach-Object { Write-Host "  HIT [$hp]: $_" -ForegroundColor Red } }
        }
        Remove-Item $tmp -Force -ErrorAction SilentlyContinue
    }
}

Write-Host "`n[*] Hunt complete. Any HIT = escalate to IR; treat host + associated identity as compromised.`n" -ForegroundColor Green