OpenSUpdater SFX Evasion, Sliver C2 Against Philippine Nuclear/Defense, and SilentXMRMiner On-Endpoint Compilation: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Suspicious 7zip SFX Execution With Embedded Reflective Loader Behavior
id: 8a1f3e2c-9d4b-4c7a-a1e5-0p9u2l6s5e01
status: experimental
description: Detects execution of recompiled 7zip SFX installers associated with OpenSUpdater/Snackarcin campaigns, identified by SFX binaries spawning unexpected child processes or making network connections to known distribution domains.
author: Security Arsenal Threat Intelligence
date: 2026/09/26
references:
    - https://blog.gdatasoftware.com/2026/09/38490-opensupdater-evades-with-recompiled-7zip-sfx
logsource:
    category: process_creation
    product: windows
detection:
    selection_sfx:
        Image|endswith:
            - '\7z.sfx.exe'
            - 'sfx.exe'
        CommandLine|contains:
            - '-o'
            - '/D='
    selection_child:
        ParentImage|endswith:
            - 'sfx.exe'
            - '\7zG.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\mshta.exe'
    selection_network:
        DestinationHostname|contains:
            - 'codeonicinc.com'
            - 'setupsoftwarecenter.com'
    condition: selection_sfx and (selection_child or selection_network)
falsepositives:
    - Legitimate enterprise software deployment using 7zip SFX packaging
level: high
tags:
    - attack.defense_evasion
    - attack.execution
    - attack.t1218
---
title: Rogue AnyDesk Deployment via Certutil or PowerShell Download Cradle
id: 5b2c8f1a-3e7d-4a9c-b6f2-xmr0ld6ad202
status: experimental
description: Detects download and execution of AnyDesk from non-standard infrastructure as observed in the SilentXMRMiner campaign exploiting Samsung MagicINFO CVE-2025-4632. Covers certutil and PowerShell download cradles staging anydesk.exe from raw IP addresses.
author: Security Arsenal Threat Intelligence
date: 2026/09/26
references:
    - https://www.huntress.com/blog/threat-actor-compiles-cryptominer
logsource:
    category: process_creation
    product: windows
detection:
    selection_certutil:
        Image|endswith: '\certutil.exe'
        CommandLine|contains:
            - '-urlcache'
            - '-split'
    selection_dl:
        CommandLine|contains:
            - 'anydesk'
            - '194.87.89.30'
            - ':8899'
    selection_ps:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'DownloadFile'
            - 'Invoke-WebRequest'
            - 'Start-BitsTransfer'
    selection_ps_anydesk:
        CommandLine|contains: 'anydesk'
    condition: (selection_certutil and selection_dl) or (selection_ps and selection_ps_anydesk)
falsepositives:
    - IT administrators deploying AnyDesk via scripted methods (rare; AnyDesk is typically MSI-deployed)
level: high
tags:
    - attack.command_and_control
    - attack.t1105
    - attack.t1059.001
---
title: Local Admin Account Creation and Defender Tampering Consistent With SilentXMRMiner
id: 7d3e9a4b-1c5f-4b8d-a2e6-min3r7tam203
status: experimental
description: Detects the SilentXMRMiner persistence and defense-evasion chain - creation of a local administrator account followed by disabling Microsoft Defender protections via PowerShell Set-MpPreference or registry manipulation.
author: Security Arsenal Threat Intelligence
date: 2026/09/26
references:
    - https://www.huntress.com/blog/threat-actor-compiles-cryptominer
logsource:
    category: process_creation
    product: windows
detection:
    selection_account:
        CommandLine|contains:
            - 'net user'
            - 'net localgroup administrators'
            - 'oldadministrator'
            - 'New-LocalUser'
            - 'Add-LocalGroupMember'
    selection_defender:
        CommandLine|contains:
            - 'Set-MpPreference'
            - 'DisableRealtimeMonitoring'
            - 'DisableBehaviorMonitoring'
            - 'Add-MpPreference -ExclusionPath'
            - 'DisableAntiSpyware'
    condition: selection_account or selection_defender
falsepositives:
    - Legitimate administrative provisioning scripts
    - Enterprise AV migration tooling
level: critical
tags:
    - attack.persistence
    - attack.t1136.001
    - attack.defense_evasion
    - attack.t1562.001

// Security Arsenal Threat Hunt: Sliver C2 beaconing, rogue AnyDesk, and OpenSUpdater distribution infrastructure
// Scope: Microsoft Sentinel / Defender XDR — last 30 days
let lookback = 30d;
let C2Domains = dynamic(["fine-work-team.com", "timelevel12.com", "snake.zooparkko.com", "codeonicinc.com", "setupsoftwarecenter.com"]);
let C2IPs = dynamic(["194.87.89.30"]);
// Part 1: Network connections to known C2 / distribution infrastructure
let NetworkHits = DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where RemoteUrl in~ (C2Domains) or RemoteIP in (C2IPs) or RemotePort == 8899
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ActionType;
// Part 2: Certutil / PowerShell download cradles pulling remote access tooling
let DownloadCradles = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where (FileName =~ "certutil.exe" and ProcessCommandLine has_any ("urlcache", "anydesk", "8899"))
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("anydesk", "194.87.89.30", "DownloadFile"))
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName;
// Part 3: Local admin account creation consistent with 'oldadministrator' persistence
let AccountCreation = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine has_any ("net user", "net localgroup administrators", "New-LocalUser", "Add-LocalGroupMember")
    or ProcessCommandLine has "oldadministrator"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName;
// Part 4: Defender tampering
let DefenderTamper = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where ProcessCommandLine has_any ("DisableRealtimeMonitoring", "DisableBehaviorMonitoring", "Set-MpPreference", "Add-MpPreference -ExclusionPath")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName;
union NetworkHits, DownloadCradles, AccountCreation, DefenderTamper
| sort by Timestamp desc

# Security Arsenal IOC Hunt Script — OpenSUpdater SFX / Sliver C2 / SilentXMRMiner
# Run elevated on suspected endpoints or via EDR live response / GPO scheduled task
# Output: CSV of findings for SIEM ingestion

$Findings = @()
$ReportPath = "$env:TEMP\SA_ThreatHunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"

# --- 1. Network connections to known C2 / distribution infrastructure ---
$C2Indicators = @('194.87.89.30', 'codeonicinc.com', 'setupsoftwarecenter.com', 'fine-work-team.com', 'timelevel12.com', 'snake.zooparkko.com')
$Conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($conn in $Conns) {
    if ($C2Indicators -contains $conn.RemoteAddress -or $conn.RemotePort -eq 8899) {
        $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        $Findings += [PSCustomObject]@{ Category='NetworkC2'; Detail="$($conn.RemoteAddress):$($conn.RemotePort)"; Process=$proc.ProcessName; PID=$conn.OwningProcess }
    }
}
# DNS cache check for domain indicators
$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($entry in $DnsCache) {
    foreach ($ioc in $C2Indicators) {
        if ($entry.Entry -like "*$ioc*") {
            $Findings += [PSCustomObject]@{ Category='DNSCache'; Detail=$entry.Entry; Process='N/A'; PID='N/A' }
        }
    }
}

# --- 2. Persistence: 'oldadministrator' account and unexpected local admins ---
$LocalUsers = Get-LocalUser -ErrorAction SilentlyContinue
foreach ($u in $LocalUsers) {
    if ($u.Name -match 'oldadministrator') {
        $Findings += [PSCustomObject]@{ Category='PersistenceAccount'; Detail="Suspicious local account: $($u.Name) Enabled=$($u.Enabled)"; Process='N/A'; PID='N/A' }
    }
}
$Admins = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue
foreach ($a in $Admins) {
    if ($a.Name -notmatch 'Administrator|Domain Admins|Enterprise Admins' -and $a.ObjectClass -eq 'User') {
        $Findings += [PSCustomObject]@{ Category='ReviewLocalAdmin'; Detail=$a.Name; Process='N/A'; PID='N/A' }
    }
}

# --- 3. Rogue AnyDesk artifacts (non-standard install paths / unsigned binary) ---
$AnyDeskPaths = @("$env:ProgramFiles\AnyDesk", "${env:ProgramFiles(x86)}\AnyDesk", "$env:APPDATA\AnyDesk", "$env:TEMP\anydesk.exe", "C:\anydesk.exe")
foreach ($p in $AnyDeskPaths) {
    if (Test-Path $p) {
        $sig = Get-AuthenticodeSignature (Get-ChildItem $p -Filter *.exe -Recurse -ErrorAction SilentlyContinue | Select-Object -First 1).FullName -ErrorAction SilentlyContinue
        $Findings += [PSCustomObject]@{ Category='AnyDeskArtifact'; Detail="$p SignatureStatus=$($sig.Status)"; Process='N/A'; PID='N/A' }
    }
}

# --- 4. Defender tampering indicators ---
$MpPref = Get-MpPreference -ErrorAction SilentlyContinue
if ($MpPref -and ($MpPref.DisableRealtimeMonitoring -eq $true -or $MpPref.DisableBehaviorMonitoring -eq $true)) {
    $Findings += [PSCustomObject]@{ Category='DefenderTamper'; Detail='Realtime/Behavior monitoring disabled'; Process='N/A'; PID='N/A' }
}
$DefenderReg = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'
if ((Get-ItemProperty -Path $DefenderReg -Name DisableAntiSpyware -ErrorAction SilentlyContinue).DisableAntiSpyware -eq 1) {
    $Findings += [PSCustomObject]@{ Category='DefenderTamper'; Detail='DisableAntiSpyware registry value set'; Process='N/A'; PID='N/A' }
}

# --- 5. On-endpoint compilation artifacts (miner source build chains) ---
$CompilerProcs = @('gcc','cc','make','cmake','mingw32-make','cl')
foreach ($cp in $CompilerProcs) {
    $procs = Get-Process -Name $cp -ErrorAction SilentlyContinue
    foreach ($pr in $procs) {
        $Findings += [PSCustomObject]@{ Category='OnEndpointCompilation'; Detail="Compiler running: $($pr.Path)"; Process=$pr.ProcessName; PID=$pr.Id }
    }
}

# --- 6. Suspicious SFX binaries: check for bloated certificates on recent installers ---
$InstallerDirs = @($env:TEMP, "$env:USERPROFILE\Downloads")
foreach ($dir in $InstallerDirs) {
    Get-ChildItem $dir -Filter *.exe -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        if ($sig.SignerCertificate -and $sig.SignerCertificate.RawData.Length -gt 20000) {
            $Findings += [PSCustomObject]@{ Category='CertBloating'; Detail="$($_.FullName) CertSize=$($sig.SignerCertificate.RawData.Length)"; Process='N/A'; PID='N/A' }
        }
    }
}

$Findings | Export-Csv -Path $ReportPath -NoTypeInformation
Write-Host "[+] Hunt complete. $($Findings.Count) findings written to $ReportPath"