---
title: Potential MeshCentral C2 Activity
id: 89a3c4d2-5b6e-4a7f-9c1d-2e3f5a6b7c8d
description: Detects processes associated with MeshCentral agent making network connections, often used by UNC6240.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith:
            - '\node.exe'
            - '\meshcentral.exe'
        DestinationPort:
            - 443
    condition: selection
falsepositives:
    - Legitimate MeshCentral administration usage
level: high
---
title: Suspicious Webshell Process Spawn (Cisco SD-WAN / Godzilla)
id: 72b1c5d9-8e4f-3b6a-0d2e-1f4e6a7b8c9d
description: Detects web server processes spawning shells or suspicious utilities, indicative of webshell activity like Godzilla/Behinder on infrastructure devices.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1505.003
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith:
            - '/java'
            - '/vshelld'
            - '/nginx'
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/perl'
            - '/python'
    condition: selection
falsepositives:
    - Legitimate administrative scripting via web interface
level: critical
---
title: Interlock/Rhysida SystemBC Proxy Execution
id: 10e9f8a7-6d5c-4b3e-2a1f-3c4d5e6f7g8h
description: Detects execution patterns associated with SystemBC proxy tooling often used by Hive0163 and Rhysida actors.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://www.ibm.com/think/x-force/interlock-and-rhysida-within-the-ransonware-ecosystem
tags:
    - attack.command_and_control
    - attack.t1090.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
    selection_cli:
        CommandLine|contains:
            - 'SystemBC'
            - '-socks'
            - '127.0.0.1:'
    condition: all of selection*
falsepositives:
    - Rare; legitimate software does not typically use these flags
level: high


kql
// Hunt for specific network IOCs from OTX Pulses
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("leadslaw.com", "azurenetfiles.net") 
       or RemoteIP in ("185.196.9.234", "176.120.22.24")
| extend ThreatContext = case(
    RemoteUrl has "leadslaw.com", "Interlock/Rhysida C2",
    RemoteUrl has "azurenetfiles.net", "UNC6240 MeshCentral C2",
    "Known Malicious IP")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, ThreatContext

// Hunt for File Hashes (MeshCentral, Webshells, RATs)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c", // InterlockRAT
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa", // Webshell/XenShell
    "c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f"  // MeshCentral Agent
)
| project Timestamp, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessAccountName


powershell
# IOC Hunt Script - Interlock, Rhysida, and ShinyHunters Indicators
# Requires Administrative Privileges

$MaliciousHashes = @(
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c",
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f",
    "2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35"
)

$Domains = @("leadslaw.com", "azurenetfiles.net")

Write-Host "[+] Checking for MeshCentral Persistence..."
$MeshPath = "C:\Program Files\MeshCentral"
if (Test-Path $MeshPath) {
    Write-Host "[!] WARNING: MeshCentral installation found at $MeshPath" -ForegroundColor Red
}

Write-Host "[+] Checking Hosts File for Malicious Domains..."
$HostsPath = "$env:windir\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $Content = Get-Content $HostsPath
    foreach ($Domain in $Domains) {
        if ($Content -match $Domain) {
            Write-Host "[!] WARNING: $Domain found in hosts file." -ForegroundColor Red
        }
    }
}

Write-Host "[+] Scanning for specific file hashes in common download directories..."
$Paths = @("$env:USERPROFILE\Downloads", "$env:TEMP", "$env:APPDATA")
foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
            if ($Hash.Hash -in $MaliciousHashes) {
                Write-Host "[!] CRITICAL: Malicious file found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking for SystemBC related Registry Run Keys..."
$RunKeys = @("HKLM:\Software\Microsoft\Windows\CurrentVersion\Run", "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-ItemProperty $Key -ErrorAction SilentlyContinue | ForEach-Object {
            if ($_.PSObject.Properties.Value -match "SystemBC" -or $_.PSObject.Properties.Value -match "node.exe") {
                Write-Host "[!] Suspicious persistence found in $Key" -ForegroundColor Yellow
            }
        }
    }
}


# Response Priorities