Levi Strauss Social Engineering Breach: Defending Against Helpdesk Scams and Corporate Data Exfiltration

---
title: Remote Access Tool Execution - Helpdesk Impersonation Pattern
id: 3f8a1b2c-7d4e-4f91-a6c3-9e2b5d8f1a07
status: experimental
description: Detects execution of commonly abused remote access tools (AnyDesk, ScreenConnect, TeamViewer, Atera, Splashtop) frequently deployed via social engineering and helpdesk impersonation. Tune against an approved-RMM allowlist.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://www.securityweek.com/corporate-data-stolen-in-levi-strauss-cyberattack/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\anydesk.exe'
      - '\screenconnect.client.exe'
      - '\teamviewer.exe'
      - '\teamviewer_service.exe'
      - '\atera_agent.exe'
      - '\splashtop.exe'
      - '\sr_manager.exe'
  selection_cli:
    CommandLine|contains:
      - 'anydesk'
      - 'screenconnect'
      - 'teamviewer'
      - 'atera'
      - 'splashtop'
  condition: 1 of selection_*
falsepositives:
  - Approved RMM platforms deployed by internal IT - allowlist sanctioned tools and installation paths
level: high
---
title: Suspicious Cloud Storage Access for Data Exfiltration
id: 8c2e4d71-1a9b-4c55-b3e8-6f0d2a7c4b19
status: experimental
description: Detects processes associated with file staging or browser access reaching consumer cloud storage services commonly abused for data exfiltration (MEGA, Dropbox, WeTransfer, file.io). Correlate with upload volume.
references:
  - https://attack.mitre.org/techniques/T1567/002/
  - https://www.securityweek.com/corporate-data-stolen-in-levi-strauss-cyberattack/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.exfiltration
  - attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - '.mega.nz'
      - '.mega.io'
      - '.dropbox.com'
      - '.wetransfer.com'
      - '.file.io'
      - '.transfer.sh'
      - '.gofile.io'
      - '.pixeldrain.com'
  condition: selection
falsepositives:
  - Business-sanctioned use of file transfer services - restrict to unsanctioned destinations via proxy policy and allowlist approved tenants
level: medium
---
title: Archive Utility Execution Followed by Browser Activity - Staging Pattern
id: 5b1d9e43-8f2a-4c76-9d31-4e8a6c0b7f52
status: experimental
description: Detects execution of archive utilities (rar, 7z, winrar) with compression arguments, a common data-staging step before exfiltration of collected corporate files from endpoints.
references:
  - https://attack.mitre.org/techniques/T1560/001/
  - https://www.securityweek.com/corporate-data-stolen-in-levi-strauss-cyberattack/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\7za.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -r'
      - ' -p'
  condition: selection
falsepositives:
  - Legitimate backup and software packaging workflows - baseline per-user archive tool usage and alert on first-seen
level: medium

// Hunt 1: First-seen remote access tool execution per device (last 14 days vs 30-day baseline)
let lookback = 14d;
let baseline = 30d;
let rmm_tools = dynamic(["anydesk.exe","screenconnect.client.exe","teamviewer.exe","atera_agent.exe","splashtop.exe","sr_manager.exe"]);
let known = DeviceProcessEvents
| where TimeGenerated between (ago(baseline) .. ago(lookback))
| where FileName in~ (rmm_tools)
| summarize by DeviceName, FileName;
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ (rmm_tools)
| where not(known has (DeviceName, FileName))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName
| sort by TimeGenerated desc;

// Hunt 2: High-volume outbound transfers to unsanctioned cloud storage (exfil staging)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("mega.nz","mega.io","wetransfer.com","file.io","gofile.io","transfer.sh","pixeldrain.com")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| where ConnectionCount > 20
| sort by ConnectionCount desc;

// Hunt 3: MFA reset or auth-method change followed by new sign-in from unusual location (helpdesk social engineering indicator)
AuditLogs
| where TimeGenerated > ago(14d)
| where OperationName has_any ("Update user","Reset user password","Update authentication methods")
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| project ResetTime = TimeGenerated, Actor, TargetUser, OperationName
| join kind=inner (
    SigninLogs
    | where TimeGenerated > ago(14d)
    | where ResultType == 0
    | project SigninTime = TimeGenerated, UserPrincipalName, IPAddress, LocationDetails, AppDisplayName
  ) on $left.TargetUser == $right.UserPrincipalName
| where SigninTime between (ResetTime .. ResetTime + 2h)
| project ResetTime, Actor, TargetUser, OperationName, SigninTime, IPAddress, LocationDetails, AppDisplayName
| sort by ResetTime desc;

-- Hunt: RMM tools outside sanctioned paths and recently created archives
LET rmm = SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Users/*/Downloads/**/anydesk*.exe',
  'C:/Users/*/Downloads/**/teamviewer*.exe',
  'C:/Users/*/Downloads/**/screenconnect*.exe',
  'C:/Users/*/AppData/**/atera*.exe',
  'C:/ProgramData/**/splashtop*.exe'
])
WHERE NOT FullPath =~ '(?i)Program Files'

LET archives = SELECT FullPath, Size, Mtime
FROM glob(globs=['C:/Users/*/**/*.zip','C:/Users/*/**/*.rar','C:/Users/*/**/*.7z'])
WHERE Mtime > now() - 604800
  AND Size > 10485760

SELECT * FROM rmm
UNION ALL
SELECT * FROM archives

# Levi Strauss-pattern IR sweep: RMM artifacts, persistence, staged archives
# Run elevated. Review output before removing anything.

$report = @()

# 1. Enumerate services and auto-runs tied to common RMM tooling
$rmmNames = 'AnyDesk|ScreenConnect|TeamViewer|Atera|Splashtop|ConnectWise'
$services = Get-CimInstance Win32_Service | Where-Object { $_.Name -match $rmmNames -or $_.PathName -match $rmmNames }
foreach ($s in $services) {
    $report += [pscustomobject]@{ Type='Service'; Name=$s.Name; Path=$s.PathName; State=$s.State; StartMode=$s.StartMode }
}

# 2. Check Run keys for RMM persistence
$runKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
           'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
           'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | Where-Object { $_.Name -match $rmmNames } | ForEach-Object {
            $report += [pscustomobject]@{ Type='RunKey'; Name=$_.Name; Path=(Get-ItemPropertyValue $key -Name $_.Name); State='Persistent'; StartMode='Auto' }
        }
    }
}

# 3. Find archives >10MB created in the last 7 days under user profiles (staging indicator)
$cutoff = (Get-Date).AddDays(-7)
Get-ChildItem 'C:\Users' -Recurse -Include *.zip,*.rar,*.7z -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff -and $_.Length -gt 10MB } | ForEach-Object {
        $report += [pscustomobject]@{ Type='StagedArchive'; Name=$_.Name; Path=$_.FullName; State="$([math]::Round($_.Length/1MB,1)) MB"; StartMode=$_.LastWriteTime }
    }

# 4. Output and optional removal of unapproved RMM services (uncomment to enforce)
$report | Format-Table -AutoSize
$report | Export-Csv ".\rmm_sweep_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation

# foreach ($s in $services) {
#     Stop-Service -Name $s.Name -Force -ErrorAction SilentlyContinue
#     Set-Service -Name $s.Name -StartupType Disabled
#     sc.exe delete $s.Name
# }