JadeProx TriBack Loader: Defending Government and Healthcare Against Active Intrusions

---
title: Potential TriBack Loader Execution
id: 8c4d2a10-5b6f-4a1c-9e2d-3f5a6b7c8d9e
status: experimental
description: Detects execution of processes named with variants of 'TriBack' or suspicious loader activity involving PowerShell spawning from non-standard parents.
references:
  - Internal Threat Intel - JadeProx July 2026
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1055.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_main:
    Image|contains:
      - 'TriBack'
      - 'triback'
  selection_loader_behavior:
    ParentImage|endswith:
      - '\svchost.exe'
      - '\services.exe'
      - '\explorer.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
      - 'FromBase64String'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative scripts (review parent process)
level: high
---
title: Suspicious Memory Injection via API Calls
id: 9d5e3b21-6c7a-5b2d-0f3e-4g6b7c8d9e0f
status: experimental
description: Detects potential process hollowing or injection techniques often used by loaders like TriBack to hide malicious code.
references:
  - MITRE ATT&CK T1055.001
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.defense_evasion
  - attack.t1055.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
    CommandLine|contains:
      - 'shell32.dll'
      - 'javascript:'
  condition: selection
falsepositives:
  - Legacy system administration tasks
level: medium

// Hunt for TriBack Loader indicators and generic loader behaviors
let ProcessCreation = DeviceProcessEvents;
let SuspiciousProcessNames = dynamic(["TriBack", "triback"]);
let SuspiciousParents = dynamic(["svchost.exe", "services.exe", "wininit.exe"]);
let SuspiciousChildren = dynamic(["powershell.exe", "cmd.exe", "pwsh.exe"]);
// Specific name match
ProcessCreation
| where FileName in~ (SuspiciousProcessNames)
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
| union (
    // Generic loader behavior: Suspicious parent spawning shell
    ProcessCreation
    | where InitiatingProcessFileName in~ (SuspiciousParents) and FileName in~ (SuspiciousChildren)
    | where ProcessCommandLine has_any ("DownloadString", "IEX", "-enc", "FromBase64String")
    | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine
)
| order by Timestamp desc

-- Hunt for TriBack process artifacts and suspicious memory injection patterns
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'TriBack'
   OR Name =~ 'triback'
   OR (Name =~ 'powershell.exe' AND CommandLine =~ 'DownloadString')
   OR (Name =~ 'rundll32.exe' AND CommandLine =~ 'shell32.dll')

# TriBack Loader Response Script
# Run as Administrator

Write-Host "[+] Starting TriBack Loader Hunt and Remediation..." -ForegroundColor Cyan

# 1. Kill Suspicious Processes
$suspiciousProcesses = @("TriBack", "triback")
foreach ($proc in $suspiciousProcesses) {
    $found = Get-Process -Name $proc -ErrorAction SilentlyContinue
    if ($found) {
        Write-Host "[!] Terminating process: $proc" -ForegroundColor Red
        Stop-Process -Name $proc -Force
    }
}

# 2. Check for Persistence in Run Keys (Common for Loaders)
$runPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

Write-Host "[+] Checking Registry Persistence..." -ForegroundColor Cyan
foreach ($path in $runPaths) {
    if (Test-Path $path) {
        Get-ItemProperty $path | ForEach-Object {
            $props = Get-Item $path
            $props.Property | ForEach-Object {
                $value = (Get-ItemProperty $path).$_
                if ($value -match "TriBack|triback" -or $value -match "powershell.*IEX") {
                    Write-Host "[!] Suspicious persistence found in $path : $_ = $value" -ForegroundColor Yellow
                    # Uncomment to remove automatically:
                    # Remove-ItemProperty -Path $path -Name $_
                }
            }
        }
    }
}

Write-Host "[+] Hunt Complete. Review findings and isolate affected hosts if compromise is confirmed." -ForegroundColor Green