Needle C2, PCPJack Cloud Worm & Beagle Backdoor: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential Needle Crypto-Stealer Process Masquerading
description: Detects processes impersonating popular crypto wallets (Exodus, Trezor, Ledger) running from suspicious user directory paths, indicative of Needle or RustyStealer activity.
status: stable
date: 2026/05/13
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6641a0b0727952d4f6763b72
tags:
    - attack.defense_evasion
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\exodus.exe'
            - '\trezor.exe'
            - '\ledger.exe'
    filter_legit:
        Image|contains:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate installations moved to non-standard folders
level: high
---
title: Suspicious G DATA Updater DLL Sideloading
description: Detects the G DATA updater process loading a DLL from an unexpected location, a behavior associated with the Beagle backdoor campaign using DonutLoader.
status: stable
date: 2026/05/13
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6641a0b0727952d4f6763b72
tags:
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\g_update.exe'
    filter:
        ImageLoaded|contains: 'C:\Program Files\G DATA\'
    condition: selection and not filter_legit
falsepositives:
    - Rare development instances of the updater
level: critical
---
title: PCPJack Cloud Worm CVE Exploitation Attempt
description: Identifies potential exploitation attempts for CVEs associated with the PCPJack cloud worm activity in cloud environment logs.
status: stable
date: 2026/05/13
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6641a0b0727952d4f6763b72
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    product: cloud
    service: azure
detection:
    selection:
        AadTenantId|startswith: '...'
    condition: selection # Placeholder for specific cloud log syntax logic regarding CVE exploitation
falsepositives:
    - Vulnerability scanning
level: high

// Hunt for PCPJack and Needle C2 Network Connections
let IOCs = dynamic(["130.12.180.135", "lastpass-login-help.com", "claude-pro.com"]);
DeviceNetworkEvents
| where RemoteUrl has_any(IOCs) or RemoteIP in ("130.12.180.135")
| extend Timestamp = TimeGenerated, DeviceName = DeviceName, InitiatingProcessFileName = InitiatingProcessFileName, RemoteUrl = RemoteUrl
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort

// Hunt for Beagle Backdoor File Hashes
let FileHashes = pack_array("e41c635e4c3514e266d143d544ad1abde5db3dcfe6cccdf9bb7a218003f8ab6a", "b8e7288656eca9750a5490aa96d3594b");
DeviceFileEvents
| where SHA256 in FileHashes or MD5 in FileHashes
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, MD5, InitiatingProcessAccountName

<#
.SYNOPSIS
    IOC Hunt Script for Needle, PCPJack, and Beagle Indicators.
.DESCRIPTION
    Checks for suspicious crypto wallet processes in user directories, 
    specific file hashes, and DNS cache for malicious domains.
#>

$MaliciousHashes = @(
    "e41c635e4c3514e266d143d544ad1abde5db3dcfe6cccdf9bb7a218003f8ab6a",
    "b8e7288656eca9750a5490aa96d3594b"
)

$SuspiciousProcesses = @("exodus.exe", "trezor.exe", "ledger.exe")
$MaliciousDomains = @("claude-pro.com", "lastpass-login-help.com")

Write-Host "[+] Checking for impersonating wallet processes..." -ForegroundColor Cyan
Get-Process | Where-Object {
    $SuspiciousProcesses -contains $_.Name -and 
    $_.Path -notmatch "Program Files"
} | Select-Object ProcessName, Path, Id | Format-Table -AutoSize

Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Cyan
$PathsToScan = @("C:\Users\", "C:\ProgramData\")
foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem $Path -Recurse -ErrorAction SilentlyContinue | Where-Object {
            $_.Length -gt 0 -and $_.Extension -in @('.exe', '.dll', '.zip')
        } | ForEach-Object {
            $hash = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
            if ($MaliciousHashes -contains $hash.Hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: " $_.FullName -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking DNS Cache for malicious domains..." -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry } | Format-Table -AutoSize