INC Ransomware Double-Extortion Campaign + DPRK Hangro VPN Infrastructure: OTX Pulse Detection Pack — IAB Handoffs, BYOVD & SoftEther C2

---
title: INC Ransomware - Randomized Scheduled Task Creation for Persistence
id: 9f2a1c7e-3b41-4e5d-8a6f-inc000000001
status: experimental
description: Detects creation of scheduled tasks with randomized/high-entropy names via schtasks or svchost task scheduler RPC, consistent with INC ransomware IAB persistence observed in OTX pulse.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
      - '/create'
      - '/tn'
  selection_suspicious_context:
    ParentImage|endswith:
      - '\wmiprvse.exe'
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wmic.exe'
  filter_common_admins:
    User|contains: 'SYSTEM'
    CommandLine|contains: '\Microsoft\Windows\'
  condition: selection_schtasks and selection_suspicious_context and not filter_common_admins
falsepositives:
  - Enterprise software deployment tooling
level: high
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.execution
---
title: INC Ransomware - BYOVD Vulnerable Driver Load from User-Writable Path
id: 9f2a1c7e-3b41-4e5d-8a6f-inc000000002
status: experimental
description: Detects kernel driver loads from user-writable directories, a hallmark of INC ransomware BYOVD attacks used to terminate EDR processes before encryption.
author: Security Arsenal Threat Intel
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    ImageLoaded|contains:
      - '\Users\'
      - '\ProgramData\'
      - '\Windows\Temp\'
      - '\AppData\'
      - '\Public\'
    ImageLoaded|endswith: '.sys'
  filter_known:
    ImageLoaded|contains: '\Windows\System32\drivers\'
  condition: selection and not filter_known
falsepositives:
  - Rare legitimate user-mode driver frameworks (e.g., some anti-cheat installers) - verify signer
level: critical
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - attack.t1068
---
title: Impacket Remote Execution - Service Creation and Admin Share Command Line
id: 9f2a1c7e-3b41-4e5d-8a6f-inc000000003
status: experimental
description: Detects command-line patterns characteristic of Impacket wmiexec/psexec/smbexec used by INC affiliates for lateral movement across endpoints.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmdline:
    CommandLine|contains:
      - 'cmd.exe /Q /c'
      - '\\127.0.0.1\\ADMIN$'
      - '\\127.0.0.1\\C$'
      - ' 2>&1'
  selection_parent:
    ParentImage|endswith:
      - '\services.exe'
      - '\wmiprvse.exe'
  filter_noise:
    CommandLine|contains: 'WindowsUpdate'
  condition: selection_cmdline and selection_parent and not filter_noise
falsepositives:
  - Legitimate remote administration tools - baseline admin hostnames
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002

// Hunt: INC ransomware behaviors + DPRK Hangro infrastructure contact
// Covers: AnyDesk/RDP lateral movement, Impacket-style execution, IOC network hits
let inc_iocs = dynamic(["throughoutes.net", "213.111.185.108"]);
let hangro_iocs = dynamic(["mail.silibank.net.kp", "smtp.star-co.net.kp", "mail.silibank.com",
    "175.45.176.21", "175.45.176.22", "175.45.177.33", "175.45.178.56", "175.45.178.57"]);
let networkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(45d)
    | where RemoteUrl in~ (inc_iocs) or RemoteIP in (inc_iocs)
       or RemoteUrl in~ (hangro_iocs) or RemoteIP in (hangro_iocs)
    | summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count()
        by DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName
    | extend HitType = "IOC Network Match";
let anydeskRdp =
    DeviceProcessEvents
    | where TimeGenerated > ago(45d)
    | where FileName =~ "AnyDesk.exe" and ProcessCommandLine has_any ("--silent", "--install")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName
    | extend HitType = "AnyDesk Silent Install";
let impacketPattern =
    DeviceProcessEvents
    | where TimeGenerated > ago(45d)
    | where InitiatingProcessFileName in~ ("wmiprvse.exe", "services.exe")
    | where FileName =~ "cmd.exe" and ProcessCommandLine has_all ("/Q", "/c")
        and ProcessCommandLine has_any ("ADMIN$", "C$", "2>&1")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName
    | extend HitType = "Impacket-Style Remote Exec";
let randTasks =
    DeviceProcessEvents
    | where TimeGenerated > ago(45d)
    | where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
    | extend TaskName = extract(@"/tn\s+\"?([A-Za-z0-9]{8,16})\"?", 1, ProcessCommandLine)
    | where isnotempty(TaskName) and TaskName matches regex "^[A-Za-z0-9]{8,16}$"
    | project TimeGenerated, DeviceName, TaskName, ProcessCommandLine, AccountName
    | extend HitType = "Randomized Scheduled Task";
union networkHits, anydeskRdp, impacketPattern, randTasks
| sort by TimeGenerated desc

# Security Arsenal - INC Ransomware & Hangro IOC Hunt Script
# Run elevated on suspect endpoints or via your RMM/EDR remote shell
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

Write-Host "[*] Checking for randomized scheduled tasks (INC IAB persistence)..." -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object {
    $_.TaskName -match '^[A-Za-z0-9]{8,16}$' -and
    $_.TaskPath -notlike '\Microsoft\*'
}
foreach ($t in $tasks) {
    $report += [PSCustomObject]@{Finding='Suspicious Scheduled Task'; Detail="$($t.TaskName) | Path: $($t.TaskPath) | Author: $($t.Author)"; Severity='HIGH'}
}

Write-Host "[*] Checking for drivers loaded from user-writable paths (BYOVD)..." -ForegroundColor Cyan
$writablePaths = @('C:\Users','C:\ProgramData','C:\Windows\Temp','C:\Public')
foreach ($p in $writablePaths) {
    Get-ChildItem -Path $p -Recurse -Filter *.sys -ErrorAction SilentlyContinue | ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        $report += [PSCustomObject]@{Finding='Driver in Writable Path'; Detail="$($_.FullName) | SigStatus: $($sig.Status) | Signer: $($sig.SignerCertificate.Subject)"; Severity='CRITICAL'}
    }
}

Write-Host "[*] Checking for AnyDesk artifacts..." -ForegroundColor Cyan
$anydeskPaths = @("$env:ProgramFiles\AnyDesk", "$env:ProgramFiles(x86)\AnyDesk", "$env:AppData\AnyDesk")
foreach ($p in $anydeskPaths) {
    if (Test-Path $p) {
        $report += [PSCustomObject]@{Finding='AnyDesk Artifact'; Detail=$p; Severity='MEDIUM'}
    }
}
$anydeskSvc = Get-Service -Name 'AnyDesk' -ErrorAction SilentlyContinue
if ($anydeskSvc) { $report += [PSCustomObject]@{Finding='AnyDesk Service'; Detail="Status: $($anydeskSvc.Status) | StartType: $($anydeskSvc.StartType)"; Severity='MEDIUM'} }

Write-Host "[*] Checking active/recent network connections to INC & Hangro IOCs..." -ForegroundColor Cyan
$badIPs = @('213.111.185.108','175.45.176.21','175.45.176.22','175.45.177.33','175.45.178.56','175.45.178.57')
$conns = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -in $badIPs }
foreach ($c in $conns) {
    $proc = (Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $report += [PSCustomObject]@{Finding='IOC Network Connection'; Detail="$($c.RemoteAddress):$($c.RemotePort) | State: $($c.State) | Process: $proc"; Severity='CRITICAL'}
}

Write-Host "[*] Resolving IOC domains from DNS cache..." -ForegroundColor Cyan
$badDomains = @('throughoutes.net','mail.silibank.net.kp','smtp.star-co.net.kp','mail.silibank.com')
$dnsCache = Get-DnsClientCache | Where-Object { $d = $_.Entry; $badDomains | Where-Object { $d -like "*$_*" } }
foreach ($d in $dnsCache) {
    $report += [PSCustomObject]@{Finding='IOC DNS Cache Hit'; Detail="$($d.Entry) -> $($d.Data)"; Severity='HIGH'}
}

Write-Host "[*] Checking recent RDP logons (lateral movement review)..." -ForegroundColor Cyan
$rdpEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=(Get-Date).AddDays(-45)} -MaxEvents 5000 |
    Where-Object { $_.Message -match 'Logon Type:\s+10' }
$report += [PSCustomObject]@{Finding='RDP Logon Count (45d)'; Detail="$($rdpEvents.Count) type-10 logons - review for anomalous source accounts"; Severity='INFO'}

Write-Host "`n===== HUNT RESULTS =====" -ForegroundColor Yellow
if ($report.Count -eq 0) { Write-Host "No findings. Endpoint appears clean for checked artifacts." -ForegroundColor Green }
else { $report | Sort-Object Severity | Format-Table -AutoSize | Out-String -Width 250 | Write-Host }
$report | Export-Csv -Path ".\INC_Hangro_Hunt_$(hostname)_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation