Interlock, Rhysida, and DragonForce: OTX Pulse Analysis — Multi-Vector Infostealer & Ransomware Detection Pack

---
title: Potential Gremlin Stealer or Packed Payload Execution
id: 9a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects execution of processes with characteristics common to heavily packed malware or known stealers like Gremlin, based on process creation and metadata anomalies.
status: experimental
date: 2026/06/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/67565a8c4f5c969852b7e38e
tags:
    - attack.execution
    - attack.defense_evasion
    - attack.t1562.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\.exe'
        CommandLine|contains:
            - '-enc' # Common in obfuscated powershell often used by loaders
            - 'vbc.exe' # Often used for compiling code on the fly
            - 'regsvr32.exe' # Lolbin used by some loaders
    filter_legit:
        ParentImage|contains:
            - '\Program Files\'
            - '\Windows\System32\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: Suspicious Microsoft Teams Relay Network Traffic (DragonForce)
id: b1c2d3e4-f5a6-b7c8-d9e0-f1a2b3c4d5e6
description: Detects potential use of Microsoft Teams TURN servers by unauthorized processes, a technique used by DragonForce/Backdoor.Turn to mask C2 traffic.
status: experimental
date: 2026/06/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/67565a8c4f5c969852b7e38e
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - '.relay.skype.com'
            - '.teams.microsoft.com'
        Initiated: 'true'
    filter_legit_clients:
        Image|contains:
            - '\Microsoft\Teams\'
            - '\Microsoft\MsTeams\'
            - '\WindowsApps\MSTeams_'
    condition: selection and not filter_legit_clients
falsepositives:
    - Third-party applications legitimately integrating with Teams
level: critical
---
title: Cisco SD-WAN Vulnerability Exploitation Attempt
id: c3d4e5f6-a7b8-c9d0-e1f2-a3b4c5d6e7f8
description: Detects exploitation attempts against Cisco Catalyst SD-WAN vulnerabilities (CVE-2026-20128, CVE-2026-20133) often associated with webshell deployment.
status: experimental
date: 2026/06/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/67565a8c4f5c969852b7e38e
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
    product: apache
detection:
    selection_uri:
        cs-uri-query|contains:
            - 'vpncluster/api'
            - 'sdwan'
    selection_keywords:
        cs-uri-query|contains:
            - '%3Cscript%3E' # Script tag injection
            - 'union+select' # SQL Injection precursor often used in analysis
            - 'cmd.exe'
            - 'powershell.exe'
    condition: selection_uri and selection_keywords
falsepositives:
    - Potential, but low volume
level: high

// Hunt for processes associated with DragonForce C2 masquerading as Teams
// and generic suspicious process execution related to the described campaigns
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("relay.skype.com", "teams.microsoft.com")
| where InitiatingProcessFolderPath !has "Microsoft\\Teams" 
   and InitiatingProcessFolderPath !has "WindowsApps\\MSTeams"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemotePort

// Hunt for file hashes from the pulses
DeviceProcessEvents
| where Timestamp > ago(30d)
| where SHA256 in (
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c", // Interlock/Rhysida
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5", // Gremlin
    "8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531"  // DragonForce
    )
| project Timestamp, DeviceName, FileName, ProcessCommandLine, FolderPath, SHA256

// Hunt for Steam Wallpaper Engine suspicious activity (RAR execution from temp)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName has "rar.exe" or ProcessCommandLine has ".rar"
| where ProcessCommandLine has_any ("Steam", "Wallpaper Engine") or FolderPath contains "Steam"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath

<#
.SYNOPSIS
    IOC Hunt Script for OTX Pulse Data (Interlock, Gremlin, DragonForce, Steam)
.DESCRIPTION
    Checks for specific file hashes, suspicious process connections mimicking Teams, 
    and registry keys/persistence mechanisms associated with the campaigns.
#>

$IOC_Hashes = @(
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c", # Interlock/Rhysida
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5", # Gremlin
    "8a4033425d36cd99fe23e6faef9764fbf555f362ebdb5b72379342fbbe4c5531", # DragonForce
    "fc586cad94e5a10dd5be6a6ae6096bd02dfbfd094365bec87e788ed0798d6f67"  # Steam/Vidar
)

Write-Host "[*] Checking for malicious file hashes in C:\..."
$Drives = @("C:\", "D:\")
foreach ($Drive in $Drives) {
    if (Test-Path $Drive) {
        Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $_.Length -gt 0 } | 
        ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($IOC_Hashes -contains $hash) {
                Write-Host "[!] MATCH FOUND: $($_.FullName) - Hash: $hash" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[*] Checking for suspicious network connections (mimicking Teams)..."
$TeamsProcs = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.State -eq "Established" }
$Processes = Get-Process -IncludeUserName

foreach ($Conn in $TeamsProcs) {
    try {
        $Proc = $Processes | Where-Object { $_.Id -eq $Conn.OwningProcess }
        if ($Proc) {
            $RemoteAddr = [System.Net.Dns]::GetHostEntry($Conn.RemoteAddress).HostName
            if ($RemoteAddr -like "*relay.skype.com" -or $RemoteAddr -like "*teams.microsoft.com") {
                if ($Proc.Path -notlike "*Microsoft\Teams*" -and $Proc.Path -notlike "*WindowsApps\MSTeams*") {
                    Write-Host "[!] SUSPICIOUS: Process $($Proc.ProcessName) (PID: $($Proc.Id)) connecting to Teams Relay ($RemoteAddr). Path: $($Proc.Path)" -ForegroundColor Yellow
                }
            }
        }
    } catch { Continue }
}

Write-Host "[*] Hunt complete."