Project CAV3RN Espionage Framework: Google Apps Script C2 + DNS Channel Rotation Targeting Israel — OTX Detection Pack

---
title: Project CAV3RN - DNS Query to Attacker Nameserver Infrastructure
id: 7f3a1c2e-9b4d-4e1a-a5c6-cav3rn000001
status: experimental
description: Detects DNS resolution of studiotikva.com infrastructure used by Project CAV3RN for channel selection and C2. A-record responses from these nameservers drive the implant's HTTPS vs Google Apps Script relay decision.
author: Security Arsenal Threat Intelligence
references:
  - https://securelist.com/project-cav3rn-continues/120991/
date: 2026/08/15
modified: 2026/08/15
tags:
  - attack.command_and_control
  - attack.t1071.004
logsource:
  category: dns
product: windows
detection:
  selection:
    query|contains:
      - 'studiotikva.com'
      - 'api.studiotikva.com'
      - 'ns1.studiotikva.com'
      - 'ns2.studiotikva.com'
  condition: selection
falsepositives:
  - Threat research and sandbox detonation
level: high
---
title: Project CAV3RN - Suspicious Module Names Masquerading as System or Google DLLs
id: 7f3a1c2e-9b4d-4e1a-a5c6-cav3rn000002
status: experimental
description: Detects load or image events for CAV3RN framework modules (GoogleService.dll, CommunicationUxTheme.dll, net.dll, rnp.dll, texture.dll) which masquerade as legitimate Windows or Google components.
author: Security Arsenal Threat Intelligence
references:
  - https://securelist.com/project-cav3rn-continues/120991/
date: 2026/08/15
modified: 2026/08/15
tags:
  - attack.defense_evasion
  - attack.t1036.005
  - attack.t1574.002
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith:
      - '\GoogleService.dll'
      - '\CommunicationUxTheme.dll'
      - '\texture.dll'
      - '\rnp.dll'
  filter_legit_paths:
    ImageLoaded|startswith:
      - 'C:\Program Files\Google\'
      - 'C:\Program Files (x86)\Google\'
  condition: selection and not 1 of filter_legit_paths*
falsepositives:
  - Legitimate Google software loading GoogleService.dll from sanctioned install paths
level: high
---
title: Project CAV3RN - Anomalous Egress to Google Apps Script from Non-Browser Processes
id: 7f3a1c2e-9b4d-4e1a-a5c6-cav3rn000003
status: experimental
description: Detects network connections to Google Apps Script endpoints from processes other than browsers, consistent with CAV3RN's Apps Script C2 relay channel.
author: Security Arsenal Threat Intelligence
references:
  - https://securelist.com/project-cav3rn-continues/120991/
date: 2026/08/15
modified: 2026/08/15
tags:
  - attack.command_and_control
  - attack.t1102.002
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'script.google.com'
      - 'script.googleusercontent.com'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  condition: selection and not filter_browsers
falsepositives:
  - Developer tooling, CI/CD pipelines, or IT automation legitimately calling Apps Script web apps
level: medium

// Project CAV3RN hunt: C2 infrastructure, module loads, and Apps Script relay abuse
// Microsoft Sentinel / Defender XDR — run with 90-day lookback
let cav3rn_iocs = dynamic(["studiotikva.com","api.studiotikva.com","ns1.studiotikva.com","ns2.studiotikva.com","12.19.29.30","12.121.234.120"]);
let cav3rn_modules = dynamic(["GoogleService.dll","CommunicationUxTheme.dll","net.dll","rnp.dll","texture.dll"]);
let browsers = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where Timestamp > ago(90d)
    | where RemoteUrl has_any (cav3rn_iocs) or RemoteIP in (cav3rn_iocs)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType),
    (DeviceNetworkEvents
    | where Timestamp > ago(90d)
    | where RemoteUrl has_any ("script.google.com","script.googleusercontent.com")
    | where not(InitiatingProcessFileName in~ (browsers))
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType),
    (DeviceImageLoadEvents
    | where Timestamp > ago(90d)
    | where FileName has_any (cav3rn_modules)
    | where not(FolderPath startswith @"C:\Program Files\Google\" or FolderPath startswith @"C:\Program Files (x86)\Google\")
    | project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256),
    (DeviceEvents
    | where Timestamp > ago(90d)
    | where ActionType == "DnsQueryResponse" and AdditionalInfo has_any (cav3rn_iocs)
    | project Timestamp, DeviceName, ActionType, AdditionalInfo)
| sort by Timestamp desc

# Project CAV3RN IOC Hunt Script - Security Arsenal
# Checks for CAV3RN module artifacts, suspicious network connections, and DNS cache evidence
# Run elevated on suspected endpoints; output to console and CSV

$report = @()

Write-Host "[*] Hunting for CAV3RN module files..." -ForegroundColor Cyan
$modules = @("GoogleService.dll","CommunicationUxTheme.dll","texture.dll","rnp.dll")
$searchPaths = @("$env:ProgramFiles","${env:ProgramFiles(x86)}","$env:ProgramData","$env:APPDATA","$env:LOCALAPPDATA","$env:TEMP")
foreach ($path in $searchPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Include $modules -ErrorAction SilentlyContinue |
        Where-Object { $_.FullName -notmatch "Program Files(\\| \(x86\)\\)Google" } |
        ForEach-Object {
            $hash = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            $report += [PSCustomObject]@{Type="File"; Indicator=$_.FullName; Detail=$hash; Time=$_.LastWriteTime}
        }
    }
}

Write-Host "[*] Checking active and recent network connections to CAV3RN infrastructure..." -ForegroundColor Cyan
$c2ips = @("12.19.29.30","12.121.234.120")
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $c2ips -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $report += [PSCustomObject]@{Type="Network"; Indicator=$_.RemoteAddress; Detail="$($proc.ProcessName) [$($proc.Path)] State=$($_.State)"; Time=Get-Date}
}

Write-Host "[*] Inspecting DNS client cache for studiotikva.com resolution..." -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match "studiotikva\.com" } | ForEach-Object {
    $report += [PSCustomObject]@{Type="DNSCache"; Indicator=$_.Entry; Detail="$($_.Data) Type=$($_.Type)"; Time=Get-Date}
}

Write-Host "[*] Checking loaded DLLs in running processes for CAV3RN modules..." -ForegroundColor Cyan
Get-Process | ForEach-Object {
    try {
        $_.Modules | Where-Object { $modules -contains $_.ModuleName } | ForEach-Object {
            $report += [PSCustomObject]@{Type="LoadedModule"; Indicator=$_.FileName; Detail="Process: $($_.ModuleName)"; Time=Get-Date}
        }
    } catch {}
}

Write-Host "[*] Reviewing scheduled tasks for suspicious persistence referencing DLL execution..." -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $task.Actions | Where-Object { $_.Execute -match "rundll32|regsvr32" -or $_.Arguments -match ($modules -join "|") } | ForEach-Object {
        $report += [PSCustomObject]@{Type="ScheduledTask"; Indicator=$task.TaskName; Detail="$($_.Execute) $($_.Arguments)"; Time=Get-Date}
    }
}

Write-Host "[*] Checking Run keys for DLL-based persistence..." -ForegroundColor Cyan
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce")
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).$($_.Name)
            if ($val -match "rundll32|regsvr32|\.dll") {
                $report += [PSCustomObject]@{Type="RunKey"; Indicator="$key\$($_.Name)"; Detail=$val; Time=Get-Date}
            }
        }
    }
}

if ($report.Count -gt 0) {
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path "CAV3RN_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[ALERT] $($report.Count) potential CAV3RN artifacts found. Results exported to CSV." -ForegroundColor Red
} else {
    Write-Host "[OK] No CAV3RN indicators found on this host." -ForegroundColor Green
}