Google Trust-Proxy Phishing Chain + ScreenConnect Follow-On: OTX Detection Pack for Credential Harvesting

---
title: OTX Google Trust-Proxy Phishing Redirect Chain
id: 9f0b9d2a-5d6f-4f93-a1dd-0txg00gle001
status: experimental
description: Detects web traffic where trusted Google properties are chained with pulse-listed phishing domains or disposable hostnames used for credential harvesting.
author: Security Arsenal
logsource:
  category: proxy
detection:
  selection_google_chain:
    url|contains:
      - 'google.com/search'
      - 'meet.google.com'
      - 'doubleclick.net'
      - 'googletagmanager.com'
      - 'google-analytics.com'
      - 'cse.google.com'
  selection_iocs:
    url|contains:
      - 'furqanmustafa.com'
      - 'pittni.com'
      - 'vazquezfleytas.com'
      - 'edificiocristal.pt'
      - 'velvorra.com'
      - 'odahlzr5lm.reliabilityinoperations.de'
      - 'cloudbemismanufacturingcompanygroup.rydezyhrsysteminc.vu'
      - 'servicetriumphgroupsimplyappraisals.spectrhwqumbrands.vu'
  condition: selection_google_chain and selection_iocs
falsepositives:
  - Legitimate Google marketing redirects and accessibility tools; validate destination domain reputation and click context.
level: high
tags:
  - attack.t1183
  - attack.t1566
  - attack.t1071.001
---
title: Suspicious ScreenConnect Client Execution From Browser or Office Context
id: 7b7f6d2c-4f95-4f1c-9e2b-scrconn002
status: experimental
description: Detects ScreenConnect/ConnectWise client processes launched by browsers, email clients, PowerShell or installer contexts after possible phishing or credential compromise.
author: Security Arsenal
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    Image|contains:
      - 'ScreenConnect'
      - 'ConnectWise'
  selection_parent:
    ParentImage|contains:
      - 'chrome'
      - 'msedge'
      - 'OUTLOOK'
      - 'Teams'
      - 'powershell'
      - 'msiexec'
      - 'rundll32'
  selection_unexpected_path:
    Image|contains:
      - 'AppData'
      - 'ProgramData'
      - 'Temp'
      - 'Downloads'
  condition: selection_img and selection_parent and selection_unexpected_path
falsepositives:
  - Approved IT remote support installs; verify ticket, admin account, source URL and signing metadata.
level: critical
tags:
  - attack.t1102
  - attack.t1219
  - attack.t1059
---
title: ScreenConnect Persistence Through Windows Service or Run Key
id: 1ddaf772-5f70-4cb2-bb7f-scrconn003
status: experimental
description: Detects registry persistence events that reference ScreenConnect, ConnectWise or remote access client service artifacts outside approved deployment locations.
author: Security Arsenal
logsource:
  product: windows
  category: registry_set
detection:
  selection_value:
    TargetObject|contains:
      - 'ScreenConnect'
      - 'ConnectWise'
      - 'CurrentVersion\Run'
      - 'Services'
  selection_detail:
    Details|contains:
      - 'ScreenConnect'
      - 'ConnectWise'
      - 'AppData'
      - 'ProgramData'
      - 'Temp'
  condition: selection_value and selection_detail
falsepositives:
  - Managed RMM rollout by IT; compare against software inventory and maintenance windows.
level: high
tags:
  - attack.t1543.003
  - attack.t1547.001
  - attack.t1219

let bad_iocs = dynamic(["furqanmustafa.com","pittni.com","vazquezfleytas.com","edificiocristal.pt","velvorra.com","odahlzr5lm.reliabilityinoperations.de","cloudbemismanufacturingcompanygroup.rydezyhrsysteminc.vu","servicetriumphgroupsimplyappraisals.spectrhwqumbrands.vu"]);
let google_props = dynamic(["google.com/search","meet.google.com","doubleclick.net","googletagmanager.com","google-analytics.com","cse.google.com"]);
union isfuzzy=true
(
  DeviceNetworkEvents
  | where Timestamp > ago(14d)
  | where RemoteUrl has_any (bad_iocs)
     or (RemoteUrl has_any (google_props) and InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","OUTLOOK.EXE","Teams.exe"))
  | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
),
(
  DeviceProcessEvents
  | where Timestamp > ago(14d)
  | where FileName has_any ("ScreenConnect","ConnectWise") or ProcessCommandLine has_any ("ScreenConnect","ConnectWise")
  | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
)
| order by Timestamp desc

$ErrorActionPreference = 'SilentlyContinue'
$iocs = @('furqanmustafa.com','pittni.com','vazquezfleytas.com','edificiocristal.pt','velvorra.com','odahlzr5lm.reliabilityinoperations.de','cloudbemismanufacturingcompanygroup.rydezyhrsysteminc.vu','servicetriumphgroupsimplyappraisals.spectrhwqumbrands.vu')
Write-Host '[+] Services and installed RMM artifacts'
Get-CimInstance Win32_Service | Where-Object { $_.Name -match 'screenconnect|connectwise|remote' -or $_.PathName -match 'screenconnect|connectwise' } | Select-Object Name, DisplayName, State, StartMode, PathName
Write-Host '[+] Run-key persistence'
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($k in $runKeys) { Get-ItemProperty $k | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match 'screenconnect|connectwise|appdata|programdata|temp' } | Select-Object Name, Value } }
Write-Host '[+] Scheduled tasks referencing remote access tooling'
Get-ScheduledTask | Where-Object { ($_.TaskName -match 'screenconnect|connectwise') -or ($_.Actions.Execute -match 'screenconnect|connectwise') -or ($_.Actions.Arguments -match 'screenconnect|connectwise') } | Select-Object TaskName, TaskPath, State
Write-Host '[+] DNS cache hits for pulse IOCs'
Get-DnsClientCache | Where-Object { $name = $_.Name; $iocs | ForEach-Object { $name -like ('*' + $_ + '*') } } | Select-Object Name, Type, TimeToLive, Data
Write-Host '[+] Active and recent TCP endpoints resolving toward suspicious RMM or IOC infrastructure'
Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' } | ForEach-Object { $r = $_; try { $dns = Resolve-DnsName $r.RemoteAddress -ErrorAction Stop | Select-Object -First 1 -ExpandProperty Name } catch { $dns = $null }; if ($dns -and (($iocs | ForEach-Object { $dns -like ('*' + $_ + '*') }) -or $dns -match 'screenconnect|connectwise')) { [pscustomobject]@{ LocalAddress=$r.LocalAddress; LocalPort=$r.LocalPort; RemoteAddress=$r.RemoteAddress; RemotePort=$r.RemotePort; RemoteName=$dns; OwningProcess=$r.OwningProcess; Process=(Get-Process -Id $r.OwningProcess).ProcessName } } }
Write-Host '[+] Common writable paths for unexpected ScreenConnect artifacts'
$paths = @($env:ProgramData, $env:LOCALAPPDATA, $env:APPDATA, $env:TEMP, "$env:USERPROFILE\Downloads")
foreach ($p in $paths) { Get-ChildItem $p -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'screenconnect|connectwise' -or $_.FullName -match 'screenconnect|connectwise' } | Select-Object FullName, Length, CreationTime, LastWriteTime }