H2 2025 IAB Trends: Detecting High-Value Broker Access in Government and Retail

---
title: Potential IAB Post-Access Reconnaissance Activity
id: 8a2c4f10-7b1e-4f3d-9e0a-1a2b3c4d5e6f
status: experimental
description: Detects sequential execution of system discovery commands (whoami, net user) often used by IAB buyers to verify access validity immediately after login.
references:
  - https://www.rapid7.com/blog/post/tr-initial-access-broker-shift-high-value-targets-premium-pricing
author: Security Arsenal
date: 2025/11/12
tags:
  - attack.discovery
  - attack.t1033
  - attack.t1087
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'whoami'
      - 'net user'
      - 'net group'
  timeframe: 1m
  condition: selection | count() > 2
falsepositives:
  - Legitimate administrative troubleshooting
level: high
---
title: Suspicious Remote Service Creation via SC.EXE
id: 9b3d5e21-8c2f-5g4e-0f1b-2b3c4d5e6f7g
status: experimental
description: Detects the creation of a new service using sc.exe, a common persistence mechanism used after initial access is established to maintain a foothold.
references:
  - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2025/11/12
tags:
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\sc.exe'
    CommandLine|contains: 'create'
  filter:
    User|contains:
      - 'SYSTEM'
      - 'ADMINISTRATOR'
  condition: selection and not filter
falsepositives:
  - Software installation by IT staff
level: medium

SigninLogs
| where ResultType == 0
| extend LocationDetails = tostring(LocationDetails)
| project Timestamp, UserPrincipalName, AppDisplayName, ClientAppUsed, IPAddress, LocationDetails, RiskDetail
| evaluate geoip(IPAddress)
| where Country in ("Russia", "China", "North Korea", "Iran", "Nigeria") // Adjust based on your org's threat model
| join kind=inner (
    SigninLogs
    | summarize LastKnownLocation = arg_max(Timestamp, tostring(LocationDetails)) by UserPrincipalName
) on UserPrincipalName
| where Timestamp > ago(1h)
| extend Distance = geo_distance_if(tofloat(Coordinates), tofloat(LastKnownLocation)) // Conceptual distance check
| project Timestamp, UserPrincipalName, IPAddress, Country, AppDisplayName, RiskDetail

-- Hunt for suspicious network connections indicative of C2 or RMM tools
SELECT Fd.pid, Fd.family, Fd.type, Fd.remote_address, P.Name, P.Username, P.CommandLine
FROM glob(globs="/*", root="/proc/")
WHERE Name =~ "fd"
  AND IsDir
GROUP BY Pid
-- Velociraptor handles the /proc parsing internally for Linux, for Windows use netstat() below
-- Windows version for established connections on high ports (likely reverse shells/C2)
SELECT RemoteAddress, RemotePort, State, Pid, Name, CommandLine
FROM listen()
WHERE State =~ 'ESTABLISHED'
  AND RemotePort > 1024
  AND Name NOT IN ("chrome.exe", "firefox.exe", "msedge.exe", "svchost.exe", "teams.exe")

# Audit and Isolate: Check for non-standard active RDP sessions and Local Admins

Write-Host "[+] Checking for active RDP sessions on non-standard interfaces..."
$query = "SELECT * FROM Win32_LogonSession WHERE LogonType = 10"
$ sessions = Get-WmiObject -Query $query

# Get current user list in local administrators group
Write-Host "[+] Auditing Local Administrators Group..."
$adminGroup = Get-LocalGroupMember -Name "Administrators" -ErrorAction SilentlyContinue

if ($adminGroup) {
    Write-Host "Current Local Administrators:"
    $adminGroup | Select-Object Name, PrincipalSource, SID | Format-Table -AutoSize
    
    # Check for accounts ending in $ (hidden) or unknown sources
    $suspiciousMembers = $adminGroup | Where-Object { $_.Name -match '\$$' -or $_.PrincipalSource -eq 'Unknown' }
    if ($suspiciousMembers) {
        Write-Host "[ALERT] Suspicious admin accounts found:" -ForegroundColor Red
        $suspiciousMembers
    }
}

# Review recent Security Event ID 4624 (Logon Type 10/Remote) for anomalies
Write-Host "[+] Checking recent Remote Interactive Logons (Event ID 4624, Type 10)..."
$events = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4624)]] and *[EventData[Data[@Name='LogonType']='10']]" -MaxEvents 20 -ErrorAction SilentlyContinue
if ($events) {
    $events | Select-Object TimeCreated, @{n='User';e={$_.Properties[5].Value}}, @{n='IP';e={$_.Properties[19].Value}} | Format-Table -AutoSize
} else {
    Write-Host "No recent remote logons found."
}