NightEagle (APT-Q-95), Hacking Cat, and Toy Ghouls Targeting Enterprises With Backdoors, Ransomware, and Wipers — Detection and Hardening Guide

---
title: Suspicious Persistence via Run Key or Service Pointing to Non-Standard Path
id: 1f3a9c74-2b6e-4d81-9a5c-7e2f0b8d4a31
status: experimental
description: Detects persistence registrations (Run keys, services, scheduled tasks) where the binary resides in user-writable or unusual directories, consistent with APT implant persistence behavior observed in NightEagle/APT-Q-95 style intrusions.
references:
  - https://attack.mitre.org/techniques/T1547/001/
  - https://attack.mitre.org/techniques/T1543/003/
  - https://attack.mitre.org/techniques/T1053/005/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.t1543.003
  - attack.t1053.005
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run\'
      - '\CurrentVersion\RunOnce\'
  selection_path:
    Details|contains:
      - '\AppData\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\Temp\'
      - '\Perflogs\'
  filter_legit:
    Details|contains:
      - '\AppData\Local\Microsoft\'
      - 'onedrive.exe'
      - 'teams.exe'
  condition: selection_key and selection_path and not filter_legit
falsepositives:
  - Legitimate user-context updaters (browsers, collaboration tools) - tune filter list per environment
level: high
---
title: Ransomware or Wiper Pre-Impact Behavior - Shadow Copy Deletion and Recovery Disable
id: 6c2d8e41-9f47-4b3a-a5d1-2e8c0f7b9d52
status: experimental
description: Detects deletion of Volume Shadow Copies and disabling of boot recovery options via vssadmin, wmic, or bcdedit - a near-universal precursor to ransomware encryption and wiper destruction, as seen in Hacking Cat and Toy Ghouls style operations.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith:
      - '\wmic.exe'
      - '\powershell.exe'
      - '\powershell_ise.exe'
    CommandLine|contains: 'shadowcopy delete'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: 1 of selection_*
falsepositives:
  - Rare: legitimate backup or storage management tooling - inventory authorized backup software before deployment
level: critical
---
title: Remote Service Binary Dropped via Admin Share - PsExec-Style Lateral Movement
id: 9b4e1a06-3d58-4c72-b8e6-5a1d2f3c7e48
status: experimental
description: Detects executable files written to administrative shares on remote hosts followed by service execution, a hallmark of APT lateral movement techniques (PsExec-style tooling) consistent with evolved NightEagle movement tradecraft.
references:
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1569/002/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1569.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: 'C:\Windows\'
    TargetFilename|endswith: '.exe'
    Image|endswith: '\System\svchost.exe'
  filter_known_tools:
    TargetFilename|contains:
      - '\SoftwareDistribution\'
      - '\WinSxS\'
      - '\servicing\'
  condition: selection and not filter_known_tools
falsepositives:
  - Legitimate remote administration tools (SCCM, PDQ, Tanium) - baseline approved admin tooling and filter by service name
level: high

// Hunt 1: Pre-impact destruction behavior (ransomware/wiper precursor)
let Lookback = 14d;
let DestructiveProcs = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_any ("delete shadows", "resize shadowstorage"))
   or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy delete")
   or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "bootstatuspolicy ignoreallfailures"))
| project DestructiveTime=TimeGenerated, DeviceName, AccountName, DestructiveCmd=ProcessCommandLine, InitiatingProcessFileName;
// Hunt 2: Suspicious service installs (lateral movement / persistence)
let SuspiciousServices = SecurityEvent
| where TimeGenerated > ago(Lookback)
| where EventID == 7045
| where ServiceFileName has_any ("\\AppData\\", "\\ProgramData\\", "\\Users\\Public\\", "\\Temp\\", "\\Perflogs\\")
   or ServiceFileName has "ADMIN$"
| project ServiceInstallTime=TimeGenerated, Computer, Account, ServiceName, ServiceFileName;
// Correlate: hosts showing BOTH destructive prep AND suspicious services within 24h are priority IR candidates
DestructiveProcs
| join kind=inner (SuspiciousServices) on $left.DeviceName == $right.Computer
| where abs(datetime_diff('hour', DestructiveTime, ServiceInstallTime)) <= 24
| project DeviceName, DestructiveTime, DestructiveCmd, ServiceName, ServiceFileName, AccountName
| order by DestructiveTime asc;
// Hunt 3 (network lateral movement): inbound SMB admin share writes tracked via Defender network events
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemotePort == 445
| join kind=inner (DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where FolderPath startswith "C:\\Windows\\"
    | where FileName endswith ".exe"
    | where InitiatingProcessFileName =~ "svchost.exe") on DeviceId
| project TimeGenerated, DeviceName, RemoteIP, FileName, FolderPath
| order by TimeGenerated desc;

-- Hunt for persistence mechanisms (Run keys + services) pointing to non-standard binary paths
-- Triage artifact for NightEagle-style implant persistence
LET suspicious_paths = '(?i)(\\\\AppData\\\\|\\\\ProgramData\\\\|\\\\Users\\\\Public\\\\|\\\\Temp\\\\|\\\\Perflogs\\\\)'

SELECT 'RunKey' AS PersistenceType,
       fullpath AS KeyPath,
       data.value AS ValueData,
       mtime AS LastWrite
FROM foreach(row={
    SELECT FullPath AS fullpath, Data AS data, Mtime AS mtime
    FROM read_reg_key(globs='HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*')
}, query={
    SELECT fullpath, data, mtime FROM scope()
})
WHERE data.value =~ suspicious_paths

UNION ALL

SELECT 'Service' AS PersistenceType,
       Name AS KeyPath,
       PathName AS ValueData,
       NULL AS LastWrite
FROM services()
WHERE PathName =~ suspicious_paths
  AND NOT PathName =~ '(?i)(microsoft|windows defender|onedrive)'

#Requires -RunAsAdministrator
# NightEagle / Hacking Cat / Toy Ghouls - Audit and Harden Script
# Security Arsenal - IR Readiness

$report = @()

# --- 1. Audit Run-key persistence pointing to non-standard paths ---
$runKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
$suspiciousPaths = 'AppData|ProgramData|Users\\Public|Temp|Perflogs'
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).($_.Name)
            if ($val -match $suspiciousPaths) {
                $report += [pscustomobject]@{Finding='Suspicious RunKey'; Location=$key; Value=$val}
            }
        }
    }
}

# --- 2. Audit services with binaries in non-standard paths ---
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match $suspiciousPaths -and $_.PathName -notmatch 'Microsoft|Windows Defender'
} | ForEach-Object {
    $report += [pscustomobject]@{Finding='Suspicious Service'; Location=$_.Name; Value=$_.PathName}
}

# --- 3. Verify shadow copies exist (wiper/ransomware resilience check) ---
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    $report += [pscustomobject]@{Finding='NO SHADOW COPIES PRESENT'; Location='VSS'; Value='Possible prior shadow deletion or VSS disabled - investigate'}
}

# --- 4. Verify boot recovery settings not tampered ---
$bcd = bcdedit /enum '{current}' 2>$null | Out-String
if ($bcd -match 'recoveryenabled\s+No') {
    $report += [pscustomobject]@{Finding='Boot recovery DISABLED'; Location='BCD'; Value='bcdedit shows recoveryenabled No - ransomware/wiper indicator'}
}

# --- 5. Hardening: enable ASR rules blocking common ransomware behavior (Defender) ---
if (Get-Command Set-MpPreference -ErrorAction SilentlyContinue) {
    # Block executable content from email/webmail; block abuse of exploited vulnerable signed drivers
    Set-MpPreference -AttackSurfaceReductionRules_Ids 'BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550' -AttackSurfaceReductionRules_Actions Enabled
    # Block credential stealing from lsass (limits lateral movement tooling)
    Set-MpPreference -AttackSurfaceReductionRules_Ids '9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2' -AttackSurfaceReductionRules_Actions Enabled
    # Block process creations from PSExec/WMI commands (lateral movement)
    Set-MpPreference -AttackSurfaceReductionRules_Ids 'd1e49aac-8f56-4280-b9ba-993a6d77406c' -AttackSurfaceReductionRules_Actions Enabled
    $report += [pscustomobject]@{Finding='ASR rules enabled'; Location='Defender'; Value='LSASS protection + PSExec/WMI child process block'}
}

# --- 6. Hardening: disable SMBv1 (legacy lateral movement vector) ---
$smb1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue
if ($smb1 -and $smb1.State -eq 'Enabled') {
    Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart -ErrorAction SilentlyContinue
    $report += [pscustomobject]@{Finding='SMBv1 disabled'; Location='OS Feature'; Value='Restart required'}
}

# --- 7. Enable advanced audit policies for service install + process creation w/ command line ---
auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable | Out-Null
New-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1 -PropertyType DWord -Force | Out-Null
$report += [pscustomobject]@{Finding='Audit policy hardened'; Location='auditpol/registry'; Value='7045 + command-line logging enabled'}

$report | Format-Table -AutoSize
$report | Export-Csv -Path "$env:TEMP\APT_Audit_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "`nAudit complete. Review findings above; any 'Suspicious' entries warrant immediate IR triage." -ForegroundColor Yellow