---
title: Potential JadeProx C2 Infrastructure Access
id: 8a7f6c1e-5b9d-4a3e-8f2a-1c0d9e8a7b6c
description: Detects network connections to known JadeProx C2 infrastructure and phishing domains identified in OTX Pulse.
status: experimental
author: Security Arsenal
date: 2026/07/23
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'sylverixstrategy.com'
    condition: selection
falsepositives:
    - Legitimate administrative access (unlikely)
level: high
---
title: Helix Extortion Group Infrastructure Connection
id: 9b8g7d2f-6c0e-5b4f-9g3b-2d1e0f9a8c7d
description: Detects outbound connections to IP infrastructure associated with the Helix data extortion group (Private Layer).
status: experimental
author: Security Arsenal
date: 2026/07/23
tags:
    - attack.exfiltration
    - attack.cve
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp|cidr:
            - '179.43.185.226/32'
            - '179.43.185.230/32'
            - '179.43.171.42/32'
    condition: selection
falsepositives:
    - Legitimate traffic to Swiss hosting providers
level: critical
---
title: JadeProx Malware File Execution
id: 0c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
description: Detects execution of files with hashes associated with the JadeProx campaign (TriBack/PlugX).
status: experimental
author: Security Arsenal
date: 2026/07/23
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Hashes|contains:
            - 'e82ecbe3823046a27d8c39cc0a4acb498f415549946c9ff0e241838b34ed5a21'
            - 'b8053bcd04ce9d7d19c7f36830a9f26b'
    condition: selection
falsepositives:
    - None
level: critical


kql
// Hunt for Helix Infrastructure Connections (DeviceNetworkEvents)
DeviceNetworkEvents
| where RemoteIP in ("179.43.185.226", "179.43.185.230", "179.43.171.42") 
   or RemoteUrl has "oskeysync.com"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl
| order by Timestamp desc

// Hunt for JadeProx Malware Artifacts (DeviceProcessEvents)
DeviceProcessEvents
| where SHA256 in ("e82ecbe3823046a27d8c39cc0a4acb498f415549946c9ff0e241838b34ed5a21", "3ba9a74f8faeff3de03e4c834f266582e2eb46a8")
   or MD5 in ("b8053bcd04ce9d7d19c7f36830a9f26b")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath, SHA256

// Hunt for potential CVE exploitation related to JadeProx
DeviceProcessEvents
| where ProcessCommandLine contains "CVE-2021-31755" or ProcessCommandLine contains "CVE-2021-32305" or ProcessCommandLine contains "TriBack"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName


powershell
# IOC Hunt Script for JadeProx and Helix Activity
# Requires Admin Privileges

Write-Host "[+] Starting Hunt for JadeProx/Helix IOCs..." -ForegroundColor Cyan

# Define IOCs
$MaliciousHashes = @(
    "e82ecbe3823046a27d8c39cc0a4acb498f415549946c9ff0e241838b34ed5a21",
    "b8053bcd04ce9d7d19c7f36830a9f26b"
)
$MaliciousIPs = @(
    "179.43.185.226",
    "179.43.185.230",
    "179.43.171.42"
)
$MaliciousDomains = @(
    "sylverixstrategy.com",
    "oskeysync.com"
)

# Check Network Connections for Malicious IPs
$ActiveConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($IP in $MaliciousIPs) {
    $Hit = $ActiveConnections | Where-Object { $_.RemoteAddress -eq $IP }
    if ($Hit) {
        Write-Host "[!] ALERT: Active connection found to Helix IP: $IP (PID: $($Hit.OwningProcess))" -ForegroundColor Red
        Get-Process -Id $Hit.OwningProcess | Select-Object ProcessName, Path
    }
}

# Check DNS Cache for Malicious Domains
$DNSCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($Domain in $MaliciousDomains) {
    $Hit = $DNSCache | Where-Object { $_.Entry -like "*$Domain*" }
    if ($Hit) {
        Write-Host "[!] ALERT: DNS cache entry found for domain: $Domain" -ForegroundColor Red
    }
}

# Scan C:\ for Malicious Hashes (Basic Scan)
Write-Host "[*] Scanning common directories for malicious file hashes..." -ForegroundColor Yellow
$Paths = @("C:\Windows\Temp", "C:\Users", "C:\ProgramData")
foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $Hash) {
                Write-Host "[!] CRITICAL: Malicious file found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green


# Response Priorities