MODBEACON RAT: Detecting Silver Fox's Rust-Based gRPC C2 Infrastructure

---
title: Potential MODBEACON Fake Installer Execution
id: 9a1f2e3b-4c5d-6e7f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects the execution of unsigned binaries spawned from web browsers, a common Silver Fox delivery vector for counterfeit installers.
references:
 - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/07/08
tags:
 - attack.initial_access
 - attack.t1566.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith:
     - '\chrome.exe'
     - '\firefox.exe'
     - '\msedge.exe'
     - '\opera.exe'
   Image|endswith: '.exe'
   Signed: false
 condition: selection
falsepositives:
 - Legitimate software downloads from reputable vendors
level: high
---
title: Suspicious Unsigned Process gRPC Network Activity
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects unsigned processes establishing outbound connections on ports commonly used for gRPC (e.g., 8080, 9090, 50051) or standard ports from user directories.
references:
 - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/07/08
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
 category: network_connection
 product: windows
detection:
 selection:
   Initiated: true
   DestinationPort:
     - 443
     - 8080
     - 8443
     - 9090
     - 50051
   Image|contains: '\Users\'
 filter:
   Signed: true
 condition: selection and not filter
falsepositives:
 - Local development tools or internal applications using gRPC
level: medium

// Hunt for unsigned executables spawned by browsers
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("chrome.exe", "msedge.exe", "firefox.exe", "opera.exe")
| where FileName endswith ".exe"
| where isnull(Signer) or Signer != "Microsoft Windows Compatibility Publisher" // Filter out OS trusted binaries loosely, adjust based on environment
| project Timestamp, DeviceName, AccountName, FileName, SHA256, InitiatingProcessFileName
| extend SuspiciousScore = iff(isnull(Signer), 10, 0)
| order by SuspiciousScore desc


// Hunt for outbound gRPC-like connections from unsigned processes in user paths
DeviceNetworkEvents
| where Timestamp > ago(3d)
| where ActionType == "ConnectionSuccess"
| where RemotePort in (443, 8080, 8443, 9090, 50051)
| where DeviceName startswith "DESKTOP" or DeviceName startswith "LAPTOP" // Adjust to naming convention
| join kind=inner DeviceProcessEvents on $left.DeviceId == $right.DeviceId, $left.InitiatingProcessId == $right.ProcessId
| where isnull(Signer) or SigningStatus != "Valid"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, RemoteUrl, RemotePort, RemoteIP, SigningStatus

-- Hunt for unsigned executables in user directories with active network connections
SELECT Pid, Name, Exe, Username, Cmdline
FROM pslist()
WHERE Exe =~ 'C:\Users\.*\.exe'
  AND NOT SigInfo.Signer = 'Microsoft Windows'
  AND NOT SigInfo.Status = 'Valid'
-- Pivot to network connections for these processes
SELECT Net.RemoteAddress, Net.RemotePort, Net.State, P.Name, P.Pid
FROM foreach(row={
    SELECT Pid
    FROM pslist()
    WHERE Exe =~ 'C:\Users\.*\.exe' AND (NOT SigInfo.Signer = 'Microsoft Windows' OR SigInfo.Status != 'Valid')
}, query={
    SELECT *
    FROM netstat(pid=Pid)
    WHERE State = 'ESTABLISHED' AND (RemotePort = 443 OR RemotePort = 8080 OR RemotePort = 9090)
})

<#
.SYNOPSIS
    MODBEACON Remediation and Hunt Script.
.DESCRIPTION
    Scans for recently created executables in user profiles and checks for valid digital signatures.
    Identifies potential Silver Fox counterfeit installers.
#>

$DateThreshold = (Get-Date).AddDays(-7)
$UserProfiles = Get-ChildItem "C:\Users\" -Directory

$SuspiciousFiles = @()

foreach ($Profile in $UserProfiles) {
    $Paths = @(
        "$($Profile.FullName)\Downloads",
        "$($Profile.FullName)\AppData\Local\Temp",
        "$($Profile.FullName)\Desktop"
    )

    foreach ($Path in $Paths) {
        if (Test-Path $Path) {
            Write-Host "Scanning $Path..."
            $Files = Get-ChildItem -Path $Path -Filter *.exe -File -Recurse -ErrorAction SilentlyContinue | 
                     Where-Object { $_.LastWriteTime -gt $DateThreshold }

            foreach ($File in $Files) {
                $Sig = Get-AuthenticodeSignature -FilePath $File.FullName
                if ($Sig.Status -ne 'Valid') {
                    $SuspiciousFiles += [PSCustomObject]@{
                        File = $File.FullName
                        Created = $File.CreationTime
                        SignatureStatus = $Sig.Status
                        Signer = $Sig.SignerCertificate.Subject
                    }
                    # Optional: Quarantine logic here
                    # Remove-Item -Path $File.FullName -Force -WhatIf
                }
            }
        }
    }
}

if ($SuspiciousFiles.Count -gt 0) {
    Write-Host "[!] Found suspicious unsigned executables created in the last 7 days:" -ForegroundColor Red
    $SuspiciousFiles | Format-Table -AutoSize
} else {
    Write-Host "[+] No suspicious unsigned executables found." -ForegroundColor Green
}