---
title: Mythic C2 Agent Apollo Post-Exploitation Process Execution
id: 9c4e1a72-3b7d-4f2a-a1e5-mythicapollo01
status: experimental
description: Detects execution patterns consistent with Mythic Apollo agent post-exploitation jobs, including sacrificial process spawning (rundll32, regsvcs, regasm) from unusual parent processes and inline .NET assembly execution.
author: Security Arsenal Threat Intelligence
references:
    - https://censys.com/blog/mythic-c2
date: 2026/09/17
modified: 2026/09/17
tags:
    - attack.command_and_control
    - attack.execution
    - attack.t1059
    - attack.t1218
logsource:
    category: process_creation
    product: windows
 detection:
    selection_img:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvcs.exe'
            - '\regasm.exe'
            - '\mshta.exe'
            - '\installutil.exe'
    selection_parent:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wmiprvse.exe'
            - '\svchost.exe'
    selection_cmd:
        CommandLine|contains:
            - 'appdata'
            - 'programdata'
            - 'temp\'
            - 'users\public'
    condition: selection_img and selection_parent and selection_cmd
falsepositives:
    - Legitimate software deployment tooling
    - Admin scripts
level: high
---
title: Operation QUICSILVER — VHD/VHDX Mounted from User-Writable Path
id: 7d2f8b41-quic-silver-vhd-0001
status: experimental
description: Detects mounting or execution of Virtual Hard Disk files from user-writable directories, a delivery technique used by Operation QUICSILVER to bypass Mark-of-the-Web and deliver the QUICAgent Go backdoor via JPEG-masqueraded VHD files.
author: Security Arsenal Threat Intelligence
references:
    - https://www.seqrite.com/blog/operation-quicsilver-china-nexus-actor-targets-myanmar-diplomats-via-vhd-delivered-go-backdoor/
date: 2026/09/17
modified: 2026/09/17
tags:
    - attack.initial_access
    - attack.defense_evasion
    - attack.t1566.001
    - attack.t1036
logsource:
    category: file_event
    product: windows
detection:
    selection_ext:
        TargetFilename|endswith:
            - '.vhd'
            - '.vhdx'
    selection_path:
        TargetFilename|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - 'Users\Public\'
            - 'INetCache\'
    condition: selection_ext and selection_path
falsepositives:
    - Legitimate IT virtualization workflows (rare on end-user endpoints)
level: high
---
title: QUICAgent — Outbound QUIC (UDP 443) to Cloudflare from Non-Browser Process
id: 3e9a1c55-quic-agent-udp443-0001
status: experimental
description: Detects non-browser processes initiating QUIC/HTTP3 (UDP 443) connections to Cloudflare IP space, consistent with QUICAgent C2 abusing Cloudflare Workers as a relay. Browsers legitimately use QUIC; Go backdoors doing so is highly anomalous.
author: Security Arsenal Threat Intelligence
references:
    - https://www.seqrite.com/blog/operation-quicsilver-china-nexus-actor-targets-myanmar-diplomats-via-vhd-delivered-go-backdoor/
date: 2026/09/17
modified: 2026/09/17
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102
logsource:
    category: network_connection
    product: windows
detection:
    selection_port:
        DestinationPort: 443
        Protocol: udp
    selection_cf:
        DestinationIp|cidr:
            - '104.16.0.0/13'
            - '172.64.0.0/13'
            - '162.158.0.0/15'
            - '198.41.128.0/17'
            - '173.245.48.0/20'
            - '103.21.244.0/22'
            - '141.101.64.0/18'
            - '108.162.192.0/18'
            - '190.93.240.0/20'
            - '188.114.96.0/20'
            - '197.234.240.0/22'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\msedgewebview2.exe'
    condition: selection_port and selection_cf and not filter_browsers
falsepositives:
    - Cloudflare WARP client (warp-svc.exe) — exclude by Image if deployed
    - Some Electron-based apps using HTTP/3
level: high

// Security Arsenal — Mythic C2 + Operation QUICSILVER hunt
// Hunts known Mythic C2 IPv4 indicators, non-browser QUIC egress to Cloudflare,
// and VHD file artifacts associated with QUICAgent delivery.
let MythicIPs = dynamic(["142.93.52.11","65.87.7.11","194.26.192.117","68.178.205.17","192.169.176.54","68.178.202.150","170.64.183.242"]);
let QuicAgentHashes = dynamic([
  "c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02",
  "0803521a7e9081f46f8f9f61d72371ecc1f49657f10202fffa9a33f581d8bb39",
  "6e66d673306fc57d6479422e1e8cc17c5dbf94e8",
  "9216fcae1736e8ff7cbed130677a52e3daf93dc1",
  "c06b90b06caf4e2e8d9eeef84c34ca84a2f40fa7"]);
let Browsers = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe","msedgewebview2.exe"]);
union isfuzzy=true
(
  // Leg 1: Known Mythic C2 IP communications
  DeviceNetworkEvents
  | where TimeGenerated > ago(30d)
  | where RemoteIP in~ (MythicIPs)
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType, HuntLeg="Mythic-C2-IP"
),
(
  // Leg 2: Non-browser QUIC (UDP 443) egress to Cloudflare ranges — QUICAgent C2 pattern
  DeviceNetworkEvents
  | where TimeGenerated > ago(30d)
  | where RemotePort == 443
  | where InitiatingProcessFileName !in~ (Browsers)
  | where ipv4_is_in_range(RemoteIP, "104.16.0.0/13")
       or ipv4_is_in_range(RemoteIP, "172.64.0.0/13")
       or ipv4_is_in_range(RemoteIP, "162.158.0.0/15")
       or ipv4_is_in_range(RemoteIP, "198.41.128.0/17")
  | where InitiatingProcessFolderPath has_any ("appdata", "programdata", "temp", "public")
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, HuntLeg="NonBrowser-QUIC-Cloudflare"
),
(
  // Leg 3: QUICAgent file hash matches
  DeviceFileEvents
  | where TimeGenerated > ago(30d)
  | where SHA256 in~ (QuicAgentHashes) or SHA1 in~ (QuicAgentHashes)
  | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, SHA1, InitiatingProcessFileName, HuntLeg="QUICAgent-Hash"
),
(
  // Leg 4: VHD/VHDX files written to user-writable paths (QUICSILVER delivery)
  DeviceFileEvents
  | where TimeGenerated > ago(30d)
  | where FileName endswith ".vhd" or FileName endswith ".vhdx"
  | where FolderPath has_any ("\\Downloads\\", "\\Temp\\", "\\AppData\\", "\\Public\\")
  | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, HuntLeg="VHD-Delivery"
)
| sort by TimeGenerated desc

# Security Arsenal — Mythic C2 + Operation QUICSILVER Endpoint IOC Hunt
# Run on suspected endpoints (or via your EDR's Live Response / RTR shell).
# Checks: QUICAgent hashes, VHD artifacts, suspicious Run keys, non-browser
# UDP/443 connections, and Mythic C2 IP contact evidence.

$ErrorActionPreference = 'SilentlyContinue'
$report = [System.Collections.Generic.List[object]]::new()

function Add-Finding($Category, $Detail) {
    $report.Add([pscustomobject]@{
        Time     = (Get-Date).ToString('yyyy-MM-dd HH:mm:ss')
        Hostname = $env:COMPUTERNAME
        Category = $Category
        Detail   = $Detail
    })
    Write-Host "[HIT] $Category :: $Detail" -ForegroundColor Red
}

# --- 1. Known Mythic C2 IPv4 indicators ---
$MythicIPs = @('142.93.52.11','65.87.7.11','194.26.192.117','68.178.205.17','192.169.176.54','68.178.202.150','170.64.183.242')

Write-Host "[*] Checking active/historical TCP connections for Mythic C2 IPs..." -ForegroundColor Cyan
$conns = Get-NetTCPConnection | Where-Object { $MythicIPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess
    Add-Finding 'Mythic-C2-Connection' "PID $($c.OwningProcess) ($($proc.ProcessName)) -> $($c.RemoteAddress):$($c.RemotePort) [$($c.State)]"
}

# DNS cache check for resolution history
$dnsHits = Get-DnsClientCache | Where-Object { $MythicIPs -contains $_.Data }
foreach ($d in $dnsHits) { Add-Finding 'Mythic-C2-DNSCache' "$($d.Entry) resolved to $($d.Data)" }

# --- 2. QUICAgent file hashes ---
$QuicHashes = @(
    'c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02',
    '0803521a7e9081f46f8f9f61d72371ecc1f49657f10202fffa9a33f581d8bb39',
    '6e66d673306fc57d6479422e1e8cc17c5dbf94e8',
    '9216fcae1736e8ff7cbed130677a52e3daf93dc1',
    'c06b90b06caf4e2e8d9eeef84c34ca84a2f40fa7',
    '5a91a13e681788ab02354f2fc2f82355',
    'a204bc8249df2b64dfab8181172c25ee',
    'b9622eb982f7c8b9885c932ca54339a0'
)

Write-Host "[*] Hashing files in user-writable paths for QUICAgent matches..." -ForegroundColor Cyan
$scanPaths = @("$env:USERPROFILE\Downloads","$env:TEMP","$env:APPDATA","C:\Users\Public","C:\ProgramData")
foreach ($p in $scanPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue |
          Where-Object { $_.Length -lt 100MB } | ForEach-Object {
            $h = Get-FileHash -Path $_.FullName -Algorithm SHA256
            if ($QuicHashes -contains $h.Hash.ToLower()) {
                Add-Finding 'QUICAgent-Hash-Match' "$($_.FullName) [SHA256=$($h.Hash)]"
            }
        }
    }
}

# --- 3. VHD/VHDX artifacts (QUICSILVER delivery vector) ---
Write-Host "[*] Searching for VHD/VHDX files in user paths..." -ForegroundColor Cyan
foreach ($p in $scanPaths) {
    Get-ChildItem -Path $p -Recurse -Include *.vhd,*.vhdx -ErrorAction SilentlyContinue | ForEach-Object {
        Add-Finding 'VHD-Artifact' "$($_.FullName) created $($_.CreationTime)"
    }
}
# Files with image extensions but mismatched signatures in Downloads
Get-ChildItem "$env:USERPROFILE\Downloads" -Include *.jpg,*.jpeg,*.png -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $bytes = [System.IO.File]::ReadAllBytes($_.FullName)[0..7]
    $sig = ($bytes | ForEach-Object { $_.ToString('X2') }) -join ' '
    if ($sig -notmatch 'FF D8 FF|89 50 4E 47') {   # not JPEG or PNG magic
        Add-Finding 'Masqueraded-File' "$($_.FullName) has image extension but non-image magic bytes [$sig]"
    }
}

# --- 4. Persistence: suspicious Run keys and scheduled tasks ---
Write-Host "[*] Auditing persistence locations..." -ForegroundColor Cyan
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
    if (Test-Path $k) {
        (Get-ItemProperty $k).PSObject.Properties | Where-Object {
            $_.Value -match 'appdata|programdata|temp|users\\public|\.vhd|rundll32|regsvcs'
        } | ForEach-Object { Add-Finding 'Persistence-RunKey' "$k :: $($_.Name) = $($_.Value)" }
    }
}
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'appdata|programdata|users\\public' -and
    $_.TaskPath -notlike '\Microsoft\*'
} | ForEach-Object { Add-Finding 'Persistence-SchedTask' "$($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" }

# --- 5. Non-browser UDP/443 (QUIC) listeners/connections ---
Write-Host "[*] Checking UDP/443 usage by non-browser processes (QUICAgent pattern)..." -ForegroundColor Cyan
$browserNames = @('chrome','msedge','firefox','brave','opera','msedgewebview2','warp-svc')
Get-NetUDPEndpoint -LocalPort 443 -ErrorAction SilentlyContinue | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    if ($proc -and $browserNames -notcontains $proc.ProcessName) {
        Add-Finding 'QUIC-NonBrowser-UDP443' "PID $($_.OwningProcess) ($($proc.ProcessName)) path=$($proc.Path)"
    }
}

# --- Summary ---
Write-Host "`n[*] Hunt complete. $($report.Count) finding(s)." -ForegroundColor Cyan
$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:TEMP\mythic_quicsilver_hunt_$(Get-Date -Format yyyyMMdd_HHmmss).csv" -NoTypeInformation