Leveraging Real-Time Intelligence to Disrupt APT Infrastructure and C2

---
title: Potential C2 Beaconing Activity - High Entropy Domains
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects processes resolving domains with high entropy, often indicative of DGA-based C2 infrastructure used by APT groups.
references:
  - https://attack.mitre.org/techniques/T1071/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.004
logsource:
  category: dns_query
  product: windows
detection:
  selection:
    QueryLength|gte: 10
  filter_main_generic:
    Query|contains:
      - 'windowsupdate'
      - 'microsoft'
      - 'google'
      - 'apple'
  condition: selection and not 1 of filter_main*
falsepositives:
  - Legitimate software updates
  - New SaaS applications
level: high
---
title: Suspicious PowerShell Encoded Command - APT Obfuscation
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects PowerShell commands using encoded commands (FromBase64String), a common technique used by APTs to obfuscate C2 payloads.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
    CommandLine|contains:
      - 'FromBase64String'
      - 'EncodedCommand'
      - 'IEX '
  filter_main_admin:
    ParentImage|contains:
      - '\\System32\\WindowsPowerShell\\v1.0\\powershell.exe'
  condition: selection and not filter_main_admin
falsepositives:
  - System management scripts
  - Legitimate admin automation
level: high
---
title: Unusual Parent-Child Process Relationship (Office App spawning Shell)
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects Office applications spawning cmd.exe or powershell.exe, a common initial access/folf hod technique used in APT phishing campaigns.
references:
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\\WINWORD.EXE'
      - '\\EXCEL.EXE'
      - '\\POWERPNT.EXE'
      - '\\OUTLOOK.EXE'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
  condition: selection
falsepositives:
  - Legitimate macro usage
level: critical

// Hunt for potential C2 beaconing and high-risk IP connections
let HighRiskIPs = _Imputation_DynamicIPRisk // Replace with your specific Threat Intelligence provider table or watchlist
| where RiskScoreCalculated >= 80;
DeviceNetworkEvents
| where ActionType in ("ConnectionAllowed", "ConnectionSuccess")
| where RemoteIP has_any (HighRiskIPs) or RemotePort in (443, 80, 22)
| summarize ConnectionCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceId, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend Duration = LastSeen - FirstSeen
| where ConnectionCount > 5 and Duration > 1h
| order by ConnectionCount desc

-- Hunt for WMI Event Consumers used for APT persistence
SELECT 
  Name,
  EventClassName,
  ConsumerCreationClassName,
  ConsumerName,
  ScriptText,
  CreatedTime
FROM wmi(query="SELECT * FROM __EventConsumer")
WHERE ScriptText =~ 'cmd' OR ScriptText =~ 'powershell' OR ScriptText =~ 'http'

# Audit and Remediate APT Persistence Mechanisms
# Requires Administrator privileges

Write-Host "Starting APT Persistence Audit and Remediation..." -ForegroundColor Cyan

# 1. Check for Suspicious WMI Event Consumers
Write-Host "Checking WMI Event Consumers for malicious scripts..."
$maliciousConsumers = Get-WmiObject -Namespace root\subscription -Class __EventConsumer | Where-Object { 
    $_.ScriptText -match 'powershell' -or 
    $_.ScriptText -match 'Invoke-Expression' -or 
    $_.ScriptText -match 'FromBase64String' -or
    $_.ScriptText -match 'http://' 
}

if ($maliciousConsumers) {
    Write-Host "[ALERT] Found suspicious WMI Event Consumers. Removing..." -ForegroundColor Red
    foreach ($consumer in $maliciousConsumers) {
        Write-Host "Removing Consumer: $($consumer.Name)"
        $consumer | Remove-WmiObject
    }
} else {
    Write-Host "[OK] No suspicious WMI Event Consumers found." -ForegroundColor Green
}

# 2. Audit Scheduled Tasks for non-Microsoft signed executables
Write-Host "Auditing Scheduled Tasks for unsigned binaries..."
$suspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.State -eq 'Ready' -and 
    $_.Principal.UserId -ne 'SYSTEM' -and
    $_.Actions.Execute -ne $null
} | ForEach-Object {
    $task = $_
    $action = $task.Actions.Execute
    # Check if the file exists and is unsigned (basic check)
    if (Test-Path $action) {
        $sig = Get-AuthenticodeSignature $action
        if ($sig.Status -ne 'Valid') {
            return $task
        }
    }
}

if ($suspiciousTasks) {
    Write-Host "[ALERT] Found Scheduled Tasks running unsigned code. Please Review:" -ForegroundColor Yellow
    $suspiciousTasks | Select-Object TaskName, TaskPath, Actions
} else {
    Write-Host "[OK] No suspicious Scheduled Tasks found." -ForegroundColor Green
}

Write-Host "Remediation Audit Complete."