Interlock, DragonForce & UAT-8616: OTX Pulse Analysis — Ransomware & C2 Evasion Tactics

---
title: Potential Microsoft Teams C2 Activity (DragonForce Backdoor.Turn)
id: d9a8c1e2-b5f3-4a6b-9c8d-1e2f3a4b5c6d
description: Detects suspicious child processes spawned by Microsoft Teams, indicative of DLL side-loading or payload execution used by DragonForce actors.
author: Security Arsenal
date: 2026/06/17
references:
    - https://otx.alienvault.com/pulse/6623...
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Teams.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\regsvr32.exe'
    condition: selection
falsepositives:
    - Legitimate administrative use via Teams (rare)
level: high
---
title: Cisco SD-WAN Manager Exploitation Attempt (UAT-8616)
id: b7e6d5c4-a3b2-4f1e-8d7c-2a3b4c5d6e7f
description: Detects potential webshell access or exploitation attempts on Cisco Catalyst SD-WAN Manager based on URI patterns associated with XenShell/Godzilla.
author: Security Arsenal
date: 2026/06/17
references:
    - https://otx.alienvault.com/pulse/6624...
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
    product: apache
detection:
    selection_uri:
        cs-uri-query|contains:
            - 'jetty'
            - 'manager'
            - '.jsp'
    selection_keywords:
        cs-uri-query|contains:
            - 'exec'
            - 'cmd'
            - 'pwd'
    condition: all of selection*
falsepositives:
    - Administrative API usage
level: critical
---
title: Interlock / Rhysida Payload Execution - SystemBC and Sliver
id: a1b2c3d4-e5f6-4789-a012-34567890abcdef
description: Detects execution of SystemBC proxy or Sliver C2 beacons often associated with Hive0163 and Rhysida campaigns.
author: Security Arsenal
date: 2026/06/17
references:
    - https://otx.alienvault.com/pulse/6622...
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: process_creation
    product: windows
detection:
    selection_systembc:
        Image|endswith: '\systembc.exe'
    selection_sliver:
        Image|endswith: '\sliver.exe'
    selection_certutil:
        Image|endswith: '\certutil.exe'
        CommandLine|contains: 'decode'
    condition: 1 of selection*
falsepositives:
    - Rare SystemBC legitimate use
level: high


kql
// Hunt for DragonForce Team C2 indicators and network connections
// Look for Teams.exe making network connections outside typical Microsoft ranges or child processes
let MicrosoftIPs = pack_array("13.107.42.0/24", "13.107.64.0/18", "52.112.0.0/14");
DeviceNetworkEvents
| where InitiatingProcessFileName == "Teams.exe" 
| where not(ipv4_is_in_range(RemoteIP, "13.107.42.0/24")) 
| where not(ipv4_is_in_range(RemoteIP, "52.112.0.0/14"))
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| extend IOCScore = "High"
| union (
    DeviceProcessEvents
    | where FileName in~ ("systembc.exe", "sliver.exe", "node.exe", "go.exe") 
    | where ProcessCommandLine contains "-c" or ProcessCommandLine contains "-connect"
)
| union (
    DeviceFileEvents
    | where SHA256 in~ ("333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c", "8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531")
)


powershell
# IOC Hunt Script for Interlock/Rhysida and UAT-8616 Webshells
# Requires Administrative Privileges

Write-Host "[+] Starting Hunt for Interlock, Rhysida, and SD-WAN Indicators..." -ForegroundColor Cyan

# Check for specific Malware Processes
$MalwareProcs = @("systembc", "sliver", "godzilla", "xenshell", "xmrig", "interlock")
Write-Host "[*] Checking for running malicious processes..." -ForegroundColor Yellow
Get-Process | Where-Object { $MalwareProcs -contains $_.ProcessName.ToLower() } | ForEach-Object {
    Write-Host "[!] Suspicious Process Found: $($_.ProcessName) (PID: $($_.Id))" -ForegroundColor Red
    Write-Host "    Path: $($_.Path)"
}

# Check for Suspicious Scheduled Tasks (Common Persistence for SystemBC/Rhysida)
Write-Host "[*] Checking Scheduled Tasks for suspicious actions..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { $_.State -eq 'Ready' } | ForEach-Object {
    $TaskInfo = Export-ScheduledTask $_.TaskName
    if ($TaskInfo.Actions.Execute -match "powershell|cmd|wscript" -and $TaskInfo.Actions.Arguments -match "-enc|-e|download") {
        Write-Host "[!] Suspicious Scheduled Task: $($_.TaskName)" -ForegroundColor Red
    }
}

# Check Network Connections to Known C2 IP from Pulse (185.196.9.234)
Write-Host "[*] Checking for connections to known C2 infrastructure..." -ForegroundColor Yellow
$C2IP = "185.196.9.234"
Get-NetTCPConnection -RemoteAddress $C2IP -ErrorAction SilentlyContinue | ForEach-Object {
    $Proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    Write-Host "[!] Connection to C2 ($C2IP) found via PID: $($_.OwningProcess) ($($Proc.ProcessName))" -ForegroundColor Red
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green