---
title: Project CAV3RN Module Load or DNS-Selected C2 Activity
id: 7f3a1c2e-9cav-4d31-8b21-cav3rn000001
status: experimental
description: Detects loading of Project CAV3RN espionage framework modules (GoogleService.dll, CommunicationUxTheme.dll, net.dll, rnp.dll, texture.dll) or network/DNS activity toward known CAV3RN C2 infrastructure including attacker nameservers used for A-record channel selection.
author: Security Arsenal Threat Intelligence
references:
  - https://securelist.com/project-cav3rn-continues/120991/
date: 2026/09/13
logsource:
  category: image_load
  product: windows
detection:
  selection_modules:
    ImageLoaded|endswith:
      - '\GoogleService.dll'
      - '\CommunicationUxTheme.dll'
      - '\net.dll'
      - '\rnp.dll'
      - '\texture.dll'
  condition: selection_modules
falsepositives:
  - Rare; net.dll and texture.dll may collide with legitimate software - validate signer and path
level: high
tags:
  - attack.command_and_control
  - attack.t1071.004
  - attack.t1573
  - attack.t1029
---
title: Project CAV3RN DNS C2 Channel Selection and C2 Beacon
id: 7f3a1c2e-9cav-4d31-8b21-cav3rn000002
status: experimental
description: Detects DNS queries or network connections to Project CAV3RN C2 domains and nameservers. CAV3RN uses DNS A-record responses to select between direct HTTPS and Google Apps Script relay per transaction.
author: Security Arsenal Threat Intelligence
references:
  - https://securelist.com/project-cav3rn-continues/120991/
date: 2026/09/13
logsource:
  category: dns
  product: windows
detection:
  selection_dns:
    query|contains:
      - 'studiotikva.com'
      - 'api.studiotikva.com'
      - 'ns1.studiotikva.com'
      - 'ns2.studiotikva.com'
  condition: selection_dns
falsepositives:
  - Threat researchers validating infrastructure
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.004
  - attack.t1568
---
title: Non-Browser Process Beaconing to Google Apps Script - Possible CAV3RN Relay C2
id: 7f3a1c2e-9cav-4d31-8b21-cav3rn000003
status: experimental
description: Detects non-browser, non-Google processes initiating HTTPS connections to Google Apps Script endpoints. CAV3RN relays C2 traffic through Google Apps Script to evade domain-reputation controls.
author: Security Arsenal Threat Intelligence
references:
  - https://securelist.com/project-cav3rn-continues/120991/
date: 2026/09/13
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|endswith:
      - 'script.google.com'
      - 'script.googleusercontent.com'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\GoogleDriveFS.exe'
      - '\GoogleUpdater.exe'
  condition: selection_dest and not filter_browsers
falsepositives:
  - Internal automation or RPA tooling using Apps Script webhooks
  - Google Workspace sync utilities
level: high
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1071.001
---
title: JFrog Artifactory Exploitation - Suspicious Child Process or Groovy Execution
id: 8a4b2d3f-art1-4e42-9c32-artifactory01
status: experimental
description: Detects the Artifactory Java process spawning shells, script interpreters, or download cradles consistent with in-the-wild exploitation of CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329 leading to Groovy plugin abuse and Rust backdoor deployment.
author: Security Arsenal Threat Intelligence
references:
  - https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201
date: 2026/09/13
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\artifactory.exe'
    ParentCommandLine|contains:
      - 'artifactory'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\curl.exe'
      - '\bitsadmin.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Artifactory user plugins executing legitimate build hooks - baseline per server
level: critical
tags:
  - attack.execution
  - attack.t1059
  - attack.t1190
  - attack.t1505.003

// Project CAV3RN + Artifactory exploitation hunt — Microsoft Sentinel / Defender XDR
// Part 1: CAV3RN C2 infrastructure contact (direct HTTPS or attacker DNS control plane)
let Cav3rnIoCs = dynamic(["studiotikva.com", "api.studiotikva.com", "ns1.studiotikva.com", "ns2.studiotikva.com"]);
let C2Hits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (Cav3rnIoCs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType;
// Part 2: Suspicious non-browser processes reaching Google Apps Script (CAV3RN relay channel)
let AppsScriptRelay = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any ("script.google.com", "script.googleusercontent.com")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "GoogleDriveFS.exe", "GoogleUpdater.exe", "googledrivesync.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
// Part 3: CAV3RN module loads observed in process command lines / file events
let ModuleLoads = DeviceImageLoadEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("GoogleService.dll", "CommunicationUxTheme.dll", "rnp.dll", "texture.dll")
   or (FileName =~ "net.dll" and FolderPath !has_any ("dotnet", "Microsoft.NET", "Windows\\Microsoft.NET"))
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName;
// Part 4: Artifactory exploitation - attacker IPs and suspicious Java-spawned processes
let AttackerIPs = dynamic(["146.19.216.120", "105.188.75.16", "176.88.121.152"]);
let ArtifactoryNet = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP has_any (AttackerIPs)
| project TimeGenerated, DeviceName, LocalPort, RemoteIP, InitiatingProcessFileName;
let ArtifactoryProc = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "java.exe" or InitiatingProcessCommandLine has "artifactory"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "sh", "bash", "curl.exe", "certutil.exe", "wscript.exe", "cscript.exe", "bitsadmin.exe", "rundll32.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;
union C2Hits, AppsScriptRelay, ModuleLoads, ArtifactoryNet, ArtifactoryProc
| sort by TimeGenerated desc

<#
.SYNOPSIS
  Project CAV3RN + Artifactory exploitation IOC hunt — Security Arsenal
.DESCRIPTION
  Checks a Windows host for CAV3RN module artifacts, malicious file hashes,
  DNS cache residue for CAV3RN C2 domains, connections to Artifactory attacker
  IPs, and suspicious processes talking to Google Apps Script.
#>

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

Write-Host "=== Security Arsenal IOC Hunt: CAV3RN / Artifactory ===" -ForegroundColor Cyan

# --- 1. CAV3RN module file search (common staging paths) ---
$modules = @('GoogleService.dll','CommunicationUxTheme.dll','rnp.dll','texture.dll')
$paths   = @("$env:ProgramData", "$env:AppData", "$env:LocalAppData", "$env:Temp", 'C:\Users\Public')
foreach ($p in $paths) {
    foreach ($m in $modules) {
        Get-ChildItem -Path $p -Recurse -Filter $m -File -ErrorAction SilentlyContinue | ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm MD5).Hash
            $report += [PSCustomObject]@{Check='CAV3RN Module'; Finding=$_.FullName; MD5=$h}
        }
    }
}
# net.dll is name-collidable with .NET — flag only outside framework dirs
Get-ChildItem -Path "$env:AppData","$env:LocalAppData","$env:Temp",'C:\Users\Public' -Recurse -Filter 'net.dll' -File -ErrorAction SilentlyContinue | ForEach-Object {
    $report += [PSCustomObject]@{Check='CAV3RN Module (net.dll, suspicious path)'; Finding=$_.FullName; MD5=((Get-FileHash $_.FullName -Algorithm MD5).Hash)}
}

# --- 2. Known malicious hashes (CAV3RN modules + Artifactory Rust backdoor) ---
$badHashes = @(
    '904784c9943d019da332bea2cd03996f',
    'f9156d42410c8a5429dec43329bd72e0',
    'ac6c52632fcf8b072be3b1c5bc076fdd'
)
foreach ($f in $report) {
    if ($badHashes -contains $f.MD5.ToLower()) {
        Write-Host "[CRITICAL] Known-bad hash match: $($f.Finding)" -ForegroundColor Red
    }
}

# --- 3. DNS cache residue for CAV3RN C2 ---
$c2 = @('studiotikva.com','api.studiotikva.com','ns1.studiotikva.com','ns2.studiotikva.com')
$dns = Get-DnsClientCache | Where-Object { $e=$_.Entry; ($c2 | Where-Object { $e -like "*$_*" }) }
if ($dns) {
    $dns | ForEach-Object { $report += [PSCustomObject]@{Check='DNS Cache - CAV3RN C2'; Finding="$($_.Entry) -> $($_.Data)"; MD5=''} }
    Write-Host "[ALERT] DNS cache contains CAV3RN C2 entries" -ForegroundColor Red
}

# --- 4. Active/historical connections to Artifactory attacker IPs ---
$attackerIPs = @('146.19.216.120','105.188.75.16','176.88.121.152')
Get-NetTCPConnection | Where-Object { $attackerIPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess).ProcessName
    $report += [PSCustomObject]@{Check='Connection - Artifactory attacker IP'; Finding="$($_.RemoteAddress):$($_.RemotePort) [$proc] State=$($_.State)"; MD5=''}
    Write-Host "[ALERT] Connection to attacker IP $($_.RemoteAddress) by $proc" -ForegroundColor Red
}

# --- 5. Processes with live connections to Google Apps Script (CAV3RN relay) ---
Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' } | ForEach-Object {
    $ip = $_.RemoteAddress
    $rdns = (Resolve-DnsName -Name $ip -Reverse -ErrorAction SilentlyContinue).NameHost
    if ($rdns -match 'googleusercontent|google') {
        $p = Get-Process -Id $_.OwningProcess
        if ($p.ProcessName -notmatch '^(chrome|msedge|firefox|brave|GoogleDriveFS|googledrivesync)$') {
            $report += [PSCustomObject]@{Check='Non-browser -> Google (possible Apps Script C2)'; Finding="$($p.ProcessName) ($($p.Path)) -> $ip ($rdns)"; MD5=''}
        }
    }
}

# --- 6. Persistence sweep: Run keys & recent scheduled tasks referencing staging paths ---
$runKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
foreach ($k in $runKeys) {
    Get-ItemProperty $k | Get-Member -MemberType NoteProperty | ForEach-Object {
        $v = (Get-ItemProperty $k).($_.Name)
        if ($v -match 'ProgramData|AppData|Public|rundll32|regsvr32') {
            $report += [PSCustomObject]@{Check='Persistence - Run key'; Finding="$k\$($_.Name) = $v"; MD5=''}
        }
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'rundll32|regsvr32|powershell' -and $_.Actions.Arguments -match 'AppData|ProgramData|Public' } | ForEach-Object {
    $report += [PSCustomObject]@{Check='Persistence - Scheduled Task'; Finding="$($_.TaskName): $($_.Actions.Execute) $($_.Actions.Arguments)"; MD5=''}
}

# --- Output ---
if ($report.Count -eq 0) {
    Write-Host "[OK] No CAV3RN/Artifactory indicators found on $env:COMPUTERNAME" -ForegroundColor Green
} else {
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path ".\ioc_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
    Write-Host "Report written to .\ioc_hunt_$env:COMPUTERNAME.csv" -ForegroundColor Yellow
}