Interlock/Rhysida Ransomware Ecosystem & Global Procurement AiTM Phishing: OTX Pulse Analysis

title: Suspicious Installer Executing Proxy/Shell - Interlock RAT Pattern
id: 4a2b8c9d-1e3f-4a5b-8c6d-7e8f9a0b1c2d
description: Detects execution of suspicious processes initiated by signed installers, a common method for distributing InterlockRAT and SystemBC.
status: experimental
date: 2026/08/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6183a5b0c2d4e5f6a7b8c9d0
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\setup.exe'
            - '\install.exe'
            - '\update.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
    filter_legitimate:
        Signed: 'true'
        Signature: 'Microsoft Windows'
    condition: selection and not filter_legitimate
falsepositives:
    - Legitimate software updates using system utilities
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - cve.2023.36036
---
title: SystemBC Proxy C2 Traffic Pattern
id: b3c9d0e1-2f4a-5b6c-9d7e-0f1a2b3c4d5e
description: Detects potential SystemBC C2 communication characterized by specific HTTP headers and frequent POST requests to suspicious domains.
status: experimental
date: 2026/08/03
author: Security Arsenal
logsource:
    category: proxy
detection:
    selection:
        Method: 'POST'
        cs-host|contains:
            - '.shop'
            - '.xyz'
            - '.top'
        c-user-agent|contains:
            - 'Mozilla/5.0'
    filter:
        cs-host|contains:
            - 'microsoft.com'
            - 'google.com'
            - 'apple.com'
    condition: selection and not filter
falsepositives:
    - Legitimate e-commerce activity
level: medium
tags:
    - attack.command_and_control
    - attack.t1071.001
    - malware.systembc
---
title: Procurement Lure Phishing Keywords
id: c4d0e1f2-3g5b-6c7d-0e1f-2a3b4c5d6e7f
description: Identifies emails with procurement-themed lures often used in AiTM campaigns targeting institutions.
status: experimental
date: 2026/08/03
author: Security Arsenal
logsource:
    product: email
detection:
    keywords:
        Subject|contains:
            - 'Request for Information'
            - 'Bid Invitation'
            - 'Procurement'
            - 'Project Quotation'
            - 'Tender Document'
    attachment:
        AttachmentExtension|contains:
            - '.htm'
            - '.html'
            - '.docx'
            - '.xlsx'
    condition: keywords and attachment
falsepositives:
    - Legitimate vendor communications
level: low
tags:
    - attack.initial_access
    - attack.t1566.001
    - aitm-phishing


kql
// Hunt for Interlock/Rhysida IOCs and Procurement Phishing Domains
// Network Connections to Malicious Domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in (
    "leadslaw.com", 
    "apple-online.shop",
    "sohantraders.com",
    "satoriestate.com",
    "assessmentevaluationreport.com"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP

// File Hash Hunt for Malicious Payloads
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in (
    "64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983",
    "c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f",
    "43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2"
)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256

// Process Creation associated with trojanized installers
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("setup.exe", "install.exe", "ChromeSetup.exe")
| where FileName in ("powershell.exe", "cmd.exe", "regsvr32.exe")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, CommandLine


powershell
# IOC Hunt Script: Interlock & Procurement Phasing Indicators
# Requires Administrative Privileges

Write-Host "[+] Starting Hunt for Interlock/Rhysida and AiTM Indicators..." -ForegroundColor Cyan

$MaliciousHashes = @(
    "64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983",
    "c9920e995fbc98cd3883ef4c4520300d5e82bab5d2a5c781e9e9fe694a43e82f",
    "edbf152ed9ac79e5d9e0111d1071af48"
)

$MaliciousDomains = @(
    "leadslaw.com",
    "sohantraders.com",
    "satoriestate.com",
    "duemineral.uk"
)

# 1. Check File System for Specific Malware Hashes
Write-Host "[*] Scanning for malicious file hashes..." -ForegroundColor Yellow
$drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root
foreach ($drive in $drives) {
    Get-ChildItem -Path $drive -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0kb -and $_.Length -lt 50mb } | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($MaliciousHashes -contains $hash) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }
}

# 2. Check Hosts File for Domain Poisoning
Write-Host "[*] Checking HOSTS file for domain redirections..." -ForegroundColor Yellow
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $hostsPath) {
    $hostsContent = Get-Content $hostsPath
    foreach ($domain in $MaliciousDomains) {
        if ($hostsContent -match $domain) {
            Write-Host "[!] SUSPICIOUS ENTRY IN HOSTS FILE related to: $domain" -ForegroundColor Red
        }
    }
}

# 3. Check for Suspicious Scheduled Tasks (SystemBC/Interlock Persistence)
Write-Host "[*] Checking for suspicious scheduled tasks..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { 
    $_.TaskName -match "Update" -or 
    $_.TaskName -match "Chrome" -or 
    $_.Actions.Execute -match "powershell" -or 
    $_.Actions.Execute -match "cmd"
} | ForEach-Object {
    $taskInfo = $_
    $action = $taskInfo.Actions.Execute
    if ($action -match "http" -or $action -match "-enc") {
        Write-Host "[!] SUSPICIOUS TASK: $($taskInfo.TaskName) | Action: $action" -ForegroundColor Red
    }
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green