PIVOTPIPE .NET Beacon & Mythic C2 Infrastructure at Scale: OTX Pulse Analysis — Enterprise Detection Pack

---
title: PIVOTPIPE .NET Beacon - In-Memory Assembly Load and AMSI Tampering
id: 8f3a1c2e-7b4d-4e9a-b6f1-pivotpipe001
status: experimental
description: Detects .NET in-memory assembly loading and AMSI patching behavior consistent with PIVOTPIPE's EDR-evasion loader (OTX pulse, IIJ research 2026-09)
references:
    - https://sect.iij.ad.jp/blog/2026/09/pivotpipe/
author: Security Arsenal Threat Intel
date: 2026/09/16
tags:
    - attack.defense_evasion
    - attack.t1620
    - attack.t1562.001
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_scriptblock:
        EventID: 4104
        ScriptBlockText|contains:
            - 'Assembly]::Load'
            - 'Reflection.Assembly]::Load'
            - 'amsiInitFailed'
            - 'AmsiScanBuffer'
            - 'System.Management.Automation.AmsiUtils'
    selection_clr_hosting:
        Image|endswith:
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\dotnet.exe'
        CommandLine|contains:
            - 'Load('
            - 'FromBase64String'
            - 'IEX'
    condition: selection_scriptblock or selection_clr_hosting
falsepositives:
    - Legitimate administrative PowerShell; .NET developer tooling
level: high
---
title: Beacon-Style C2 - Default Cobalt Strike Profile URI Patterns (PIVOTPIPE Emulation)
id: 8f3a1c2e-7b4d-4e9a-b6f1-pivotpipe002
status: experimental
description: PIVOTPIPE communicates with C2 using configurations close to Cobalt Strike default Malleable C2 profiles. Detects outbound requests matching stock Beacon URIs from non-browser processes.
references:
    - https://sect.iij.ad.jp/blog/2026/09/pivotpipe/
author: Security Arsenal Threat Intel
date: 2026/09/16
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1573
logsource:
    category: webproxy
detection:
    selection_uri:
        cs-uri|contains:
            - '/jquery-3.3.1.min.js'
            - '/jquery-3.3.2.min.js'
            - '/pixel.gif'
            - '/__utm.gif'
            - '/pixel?__utma='
            - '/load.js'
            - '/updates.rss'
            - '/activity'
            - '/push'
    selection_proc:
        c-useragent|contains:
            - ''
    filter_browsers:
        cs-process|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\iexplore.exe'
            - '\safari.exe'
    condition: selection_uri and not filter_browsers
falsepositives:
    - Legitimate software update mechanisms using jQuery asset names (rare from non-browser processes)
level: high
---
title: Outbound Connection to Known Mythic C2 Infrastructure
id: 8f3a1c2e-7b4d-4e9a-b6f1-mythicc2003
status: experimental
description: Detects network connections to internet-exposed Mythic C2 servers identified by Censys scanning (OTX pulse 2026-09-16). Mythic agents include Apollo, nyx, and fys2.
references:
    - https://censys.com/blog/mythic-c2
author: Security Arsenal Threat Intel
date: 2026/09/16
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp:
            - '142.93.52.11'
            - '65.87.7.11'
            - '194.26.192.117'
            - '68.178.205.17'
            - '192.169.176.54'
            - '68.178.202.150'
            - '170.64.183.242'
    condition: selection
falsepositives:
    - Authorized red-team engagements using Mythic (validate against internal engagement schedule before escalation)
level: critical

// Sentinel/MDE hunt: PIVOTPIPE-style .NET in-memory loading + Mythic C2 contact
// Coverage: loader execution, beacon-like periodic C2, known Mythic IPs
let mythic_c2 = dynamic(["142.93.52.11","65.87.7.11","194.26.192.117","68.178.205.17","192.169.176.54","68.178.202.150","170.64.183.242"]);
let pivotpipe_hashes = dynamic(["715558e0ad32401c477d01412cc72fd07dc4ef6e122b6a730ba4b0a88a971677","ad9a03f3ea93c1a0a350f73b4ada485ce444f2352ea11eea05c87f075be80cf7","feeb5cae714d0d35f68ad1d1b29dccec0bdcc58ac076869559db53f6cb8137e8"]);
let HashHits = DeviceFileEvents
    | where TimeGenerated > ago(90d)
    | where SHA256 has_any (pivotpipe_hashes)
    | project Hunt="PIVOTPIPE Hash", TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessCommandLine;
let NetHits = DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteIP has_any (mythic_c2)
    | project Hunt="Mythic C2 Contact", TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine;
let DotNetLoader = DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where ProcessCommandLine has_any ("Assembly]::Load","FromBase64String","amsiInitFailed","AmsiScanBuffer")
       or (FileName in~ ("rundll32.exe","regsvr32.exe","mshta.exe","wscript.exe","cscript.exe") and ProcessCommandLine has_any ("Load(","IEX","DownloadString"))
    | project Hunt=".NET In-Memory Load / AMSI Tamper", TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let BeaconJitter = DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemotePort in (80, 443, 7443, 8080)
    | where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","svchost.exe","MsMpEng.exe","teams.exe","outlook.exe")
    | summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Ports=make_set(RemotePort) by DeviceName, InitiatingProcessFileName, RemoteIP
    | where Connections >= 40   // periodic tasking loop with sleep/jitter
    | project Hunt="Beacon-Like Periodic C2", FirstSeen, LastSeen, DeviceName, InitiatingProcessFileName, RemoteIP, Connections, Ports;
union HashHits, NetHits, DotNetLoader, BeaconJitter
| sort by TimeGenerated desc

# PIVOTPIPE / Mythic C2 — Host IOC Hunt Script (run elevated; deploy via GPO/Intune/EDR live response)
# Checks: persistence keys, suspicious .NET loader artifacts, scheduled tasks, live C2 connections

$ErrorActionPreference = 'SilentlyContinue'
$Report = @()

Write-Host "[+] Security Arsenal — PIVOTPIPE/Mythic Host Hunt — $(Get-Date -Format 'yyyy-MM-dd HH:mm')" -ForegroundColor Cyan

# --- 1. Known PIVOTPIPE hashes (quick scan of common staging dirs) ---
$Hashes = @(
    "715558e0ad32401c477d01412cc72fd07dc4ef6e122b6a730ba4b0a88a971677",
    "ad9a03f3ea93c1a0a350f73b4ada485ce444f2352ea11eea05c87f075be80cf7",
    "feeb5cae714d0d35f68ad1d1b29dccec0bdcc58ac076869559db53f6cb8137e8",
    "9c20927c77efe4119dc46fabf1a6cffebf0acc63"
)
$ScanDirs = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:PUBLIC","$env:ProgramData","$env:USERPROFILE\Downloads")
foreach ($dir in $ScanDirs) {
    Get-ChildItem -Path $dir -Recurse -File -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
        $h256 = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        $h1   = (Get-FileHash $_.FullName -Algorithm SHA1).Hash.ToLower()
        if ($Hashes -contains $h256 -or $Hashes -contains $h1) {
            $Report += "[!CRITICAL] PIVOTPIPE hash match: $($_.FullName) SHA256=$h256"
        }
    }
}

# --- 2. Persistence: Run keys with suspicious .NET/scripting values ---
$RunKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($key in $RunKeys) {
    if (Test-Path $key) {
        (Get-Item $key).Property | ForEach-Object {
            $val = (Get-ItemProperty -Path $key -Name $_).$_
            if ($val -match 'powershell|rundll32|regsvr32|mshta|wscript|cscript|AppData|Temp|ProgramData|\.dll|FromBase64') {
                $Report += "[!HIGH] Suspicious Run key: $key\$_ = $val"
            }
        }
    }
}

# --- 3. Scheduled tasks launching from user-writable dirs or scripting hosts ---
Get-ScheduledTask | ForEach-Object {
    $action = $_.Actions.Execute
    $args   = $_.Actions.Arguments
    if (("$action $args") -match 'AppData|Temp|ProgramData|powershell.*-enc|rundll32.*\.dll|mshta|Assembly') {
        $Report += "[!HIGH] Suspicious scheduled task: $($_.TaskName) -> $action $args"
    }
}

# --- 4. Live connections to known Mythic C2 IPs ---
$MythicC2 = @("142.93.52.11","65.87.7.11","194.26.192.117","68.178.205.17","192.169.176.54","68.178.202.150","170.64.183.242")
Get-NetTCPConnection -State Established | Where-Object { $MythicC2 -contains $_.RemoteAddress } | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess).ProcessName
    $Report += "[!CRITICAL] Active Mythic C2 connection: $($_.RemoteAddress):$($_.RemotePort) by $proc (PID $($_.OwningProcess))"
}

# --- 5. .NET CLR loaded in unusual processes (PIVOTPIPE loader heuristic) ---
Get-Process | Where-Object { $_.Modules.FileName -match 'clr\.dll|mscoree\.dll' } | Where-Object {
    $_.ProcessName -notmatch '^(devenv|powershell|dotnet|msbuild|sqlservr|w3wp|explorer|dwm)$'
} | ForEach-Object {
    $Report += "[!MEDIUM] CLR loaded in unusual process: $($_.ProcessName) (PID $($_.Id)) Path: $($_.Path)"
}

# --- Output ---
if ($Report.Count -gt 0) {
    $Report | ForEach-Object { Write-Host $_ -ForegroundColor Red }
    $out = "$env:ProgramData\pivotpipe_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').log"
    $Report | Out-File $out
    Write-Host "`n[+] Findings written to $out — escalate to IR immediately." -ForegroundColor Yellow
} else {
    Write-Host "[+] No PIVOTPIPE/Mythic indicators found on this host." -ForegroundColor Green
}