Project CAV3RN Espionage Framework: DNS-Driven C2 via Google Apps Script — OTX Pulse Detection Pack

---
title: Project CAV3RN C2 DNS or HTTPS Communication to studiotikva Infrastructure
description: Detects DNS resolution or HTTPS requests to known Project CAV3RN C2 infrastructure, including the attacker-controlled nameservers used for DNS A-record based channel selection.
logsource:
  category: dns
product: windows
author: Security Arsenal Threat Intelligence
date: 2026/08/12
status: experimental
references:
  - https://securelist.com/project-cav3rn-continues/120991
detection:
  selection:
    query|contains:
      - 'studiotikva.com'
  condition: selection
falsepositives:
  - Unlikely; domain is adversary-registered infrastructure
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1071.004
---
title: Project CAV3RN Suspicious DLL Module Load from Non-Standard Path
description: Detects loading of Project CAV3RN framework modules (GoogleService.dll, CommunicationUxTheme.dll, net.dll, rnp.dll, texture.dll) from outside legitimate system or application directories. Filename masquerading is a core evasion trait of this framework.
logsource:
  category: image_load
  product: windows
author: Security Arsenal Threat Intelligence
date: 2026/08/12
status: experimental
references:
  - https://securelist.com/project-cav3rn-continues/120991
detection:
  selection_dll:
    ImageLoaded|endswith:
      - '\GoogleService.dll'
      - '\CommunicationUxTheme.dll'
      - '\net.dll'
      - '\rnp.dll'
      - '\texture.dll'
  filter_legit:
    ImageLoaded|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_dll and not filter_legit
falsepositives:
  - Third-party applications shipping similarly named libraries; verify signer and hash
level: high
tags:
  - attack.defense_evasion
  - attack.t1574.002
  - attack.t1036
---
title: Project CAV3RN Google Apps Script C2 Relay Usage
description: Detects network connections to Google Apps Script web app endpoints by processes that do not normally use Google Workspace scripting, consistent with Project CAV3RN relay-channel behavior.
logsource:
  category: network_connection
  product: windows
author: Security Arsenal Threat Intelligence
date: 2026/08/12
status: experimental
references:
  - https://securelist.com/project-cav3rn-continues/120991
detection:
  selection:
    DestinationHostname|contains:
      - 'script.google.com'
      - 'script.googleusercontent.com'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
      - '\brave.exe'
  condition: selection and not filter_browsers
falsepositives:
  - Enterprise Google Workspace automation, Apps Script CLI tooling, RMM platforms
level: medium
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1090

// Project CAV3RN hunt: C2 infrastructure, suspicious module loads, and Apps Script relay behavior
let cav3rn_iocs = dynamic(["studiotikva.com", "api.studiotikva.com", "ns1.studiotikva.com", "ns2.studiotikva.com", "12.19.29.30", "12.121.234.120"]);
let cav3rn_modules = dynamic(["googleservice.dll", "communicationuxtheme.dll", "net.dll", "rnp.dll", "texture.dll"]);
let lookback = 14d;
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any (cav3rn_iocs) or RemoteIP in (cav3rn_iocs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
    | extend Signal = "C2 Network Connection";
let ModuleLoads = DeviceImageLoadEvents
    | where TimeGenerated > ago(lookback)
    | where FileName has_any (cav3rn_modules)
    | where FolderPath !startswith "C:\\Windows\\System32" and FolderPath !startswith "C:\\Windows\\SysWOW64"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256
    | extend Signal = "Suspicious CAV3RN Module Load";
let AppsScriptRelay = DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any ("script.google.com", "script.googleusercontent.com")
    | where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "brave.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl
    | extend Signal = "Non-Browser Apps Script Traffic";
union NetworkHits, ModuleLoads, AppsScriptRelay
| sort by TimeGenerated desc

# Project CAV3RN IOC hunt script - run on suspected endpoints
# Checks: C2 DNS resolution cache, named DLL artifacts, network connections, persistence

$ErrorActionPreference = 'SilentlyContinue'
$Cav3rnDomains = @('studiotikva.com')
$Cav3rnIPs     = @('12.19.29.30', '12.121.234.120')
$Cav3rnDLLs    = @('GoogleService.dll','CommunicationUxTheme.dll','net.dll','rnp.dll','texture.dll')

Write-Host "=== [1] DNS Cache check for CAV3RN C2 domains ===" -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $_.Entry -match ($Cav3rnDomains -join '|') } |
    Format-Table Entry, Data, Status -AutoSize

Write-Host "=== [2] Active / recent network connections to CAV3RN IPs ===" -ForegroundColor Cyan
Get-NetTCPConnection | Where-Object { $Cav3rnIPs -contains $_.RemoteAddress } |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess,
        @{N='Process';E={(Get-Process -Id $_.OwningProcess).ProcessName}} | Format-Table -AutoSize

Write-Host "=== [3] Filesystem sweep for CAV3RN module DLLs (non-standard paths) ===" -ForegroundColor Cyan
$searchRoots = @("$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData","$env:TEMP","C:\Users\Public")
foreach ($root in $searchRoots) {
    Get-ChildItem -Path $root -Recurse -Include $Cav3rnDLLs -Force -ErrorAction SilentlyContinue |
        Select-Object FullName, Length, LastWriteTime,
            @{N='Signer';E={($_ | Get-AuthenticodeSignature).SignerCertificate.Subject}} |
        Format-List
}

Write-Host "=== [4] Persistence: Run keys and scheduled tasks referencing CAV3RN modules ===" -ForegroundColor Cyan
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'rundll32|regsvr32|GoogleService|texture\.dll|rnp\.dll' } |
            Select-Object @{N='Key';E={$key}}, Name, Value
    }
}
Get-ScheduledTask | Where-Object {
    ($_.Actions.Execute -match 'rundll32|regsvr32') -or
    ($_.Actions.Arguments -match 'GoogleService|texture\.dll|rnp\.dll|CommunicationUxTheme')
} | Select-Object TaskName, TaskPath, @{N='Action';E={$_.Actions.Execute}}, @{N='Args';E={$_.Actions.Arguments}} | Format-List

Write-Host "=== [5] Proxy/WPAD traffic to Google Apps Script relay endpoints ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=3} -MaxEvents 5000 |
    Where-Object { $_.Message -match 'script\.google(com|usercontent\.com)' } |
    Select-Object TimeCreated, Message -First 25 | Format-List

Write-Host "Hunt complete. Escalate any hits from sections 1-4 to IR immediately." -ForegroundColor Yellow