Rogue ScreenConnect Worm-Like Propagation (XMRig) + SockTz AI-Enabled LATAM Campaign: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Rogue ScreenConnect Installation or Worm-Like RMM Execution
id: 9f2a1c3e-7b4d-4e5a-a1f2-sc01nn3ct001
status: experimental
description: Detects installation or execution of ScreenConnect RMM clients from non-standard paths or with suspicious naming, consistent with rogue ScreenConnect intrusions delivering XMRig via VBScript staging.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains: 'ScreenConnect'
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
  selection_child:
    ParentImage|contains:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  condition: selection_img and (selection_path or selection_child)
falsepositives:
  - Legitimate managed ScreenConnect deployments (whitelist known IT paths)
level: high
tags:
  - attack.execution
  - attack.command_and_control
  - attack.t1219
  - attack.t1059.005
date: 2026/10/03
---
title: VBScript Security Product Enumeration and Staging Chain
id: 8e1b2d4f-6c3a-4d2b-b9e1-vb5cr1pt0002
status: experimental
description: Detects sequential VBScript execution patterns (numbered .vbs payloads) and WMI-based AV enumeration consistent with the 1.vbs-4.vbs staging chain observed in rogue ScreenConnect/XMRig intrusions.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  selection_scriptname:
    CommandLine|contains:
      - '1.vbs'
      - '2.vbs'
      - '3.vbs'
      - '4.vbs'
  selection_avenum:
    CommandLine|contains:
      - 'AntiVirusProduct'
      - 'root\\SecurityCenter2'
      - 'Win32_ComputerSystem'
  condition: selection_proc and 1 of selection_*
falsepositives:
  - Legitimate administrative VBScript (rare in modern environments)
level: high
tags:
  - attack.execution
  - attack.discovery
  - attack.t1059.005
  - attack.t1518.001
date: 2026/10/03
---
title: SockTz C2 Dynamic DNS Resolution or XMRig Mining Callback
id: 7d0c3e5a-5f2b-4c1a-c8d2-s0cktz000003
status: experimental
description: Detects DNS resolution or network connections to known SockTz C2 duckdns subdomains, anondns.net ScreenConnect C2, and the opik.net staging URL observed in current OTX pulses.
author: Security Arsenal Threat Intelligence
logsource:
  category: dns
  product: windows
detection:
  selection:
    QueryName|contains:
      - 'm-doxa-apodo.duckdns.org'
      - 'm-doxa-geo.duckdns.org'
      - 'm-doxa-intel.duckdns.org'
      - 'm-doxa-vacunas.duckdns.org'
      - 'm-doxa-repuve.duckdns.org'
      - 'borertors92.anondns.net'
      - 'homehub.opik.net'
  condition: selection
falsepositives:
  - None expected; all listed hosts are confirmed malicious infrastructure
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1568.002
  - attack.t1090
date: 2026/10/03

// Security Arsenal — Rogue ScreenConnect / XMRig + SockTz Hunt (Sentinel)
// Part 1: Network indicators from OTX pulses
let maliciousHosts = dynamic(["m-doxa-apodo.duckdns.org","m-doxa-geo.duckdns.org","m-doxa-intel.duckdns.org","m-doxa-vacunas.duckdns.org","m-doxa-repuve.duckdns.org","borertors92.anondns.net","homehub.opik.net"]);
let netHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (maliciousHosts)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| extend Hunt = "IOC-Network";
// Part 2: VBScript staging + ScreenConnect execution behavior
let procHits = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where (FileName in~ ("wscript.exe","cscript.exe") and ProcessCommandLine has_any ("1.vbs","2.vbs","3.vbs","4.vbs","AntiVirusProduct","SecurityCenter2"))
   or (FileName has "ScreenConnect" and (FolderPath has_any ("\\Temp\\","\\Public\\","\\Roaming\\","\\ProgramData\\")))
   or (InitiatingProcessFileName has "ScreenConnect" and FileName in~ ("powershell.exe","cmd.exe","wscript.exe","cscript.exe","bitsadmin.exe","certutil.exe"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, SHA256
| extend Hunt = "Behavior-Execution";
// Part 3: File hash retro-hunt for OTX SHA256 indicators
let iocHashes = dynamic(["08bc4e82883eb42fc5219b206555b7a02a879860c76b4a12b2f82a64f6cc9020","110fffc85370bb7cc60fa023447165c7e99175473d76bc5ffb2abecaa3a41d66","19a3534da9f60c726be426ec5cc2b72c2d1254fefa0782bd2f08ef08117f3260","de3b6836a88ae4b117e3b6de0e9cce3cd56a2b27b462d69e50c2fcac4089a457","de89d560fc8302c778d88e3938327b240fa0db9a64fc1d5643067eedcbd2aede","ffd6d23f579571cc61936145791975da78b6ae914d780a9447a8f53c3688a0de","7d766942ef34542cee39c852286599958c4c2e23187010c4d38dbf88fcb40bf8","4e218e70afdbb116209ec0ebe8fc556e296e69648aa4e0425b83c0e863a8fee5","46ac289ce0c13666de616446f5d5a68da8bd150f4f065c3bec02f63776d3899c"]);
let hashHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where SHA256 has_any (iocHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine
| extend Hunt = "IOC-Hash";
union netHits, procHits, hashHits
| sort by TimeGenerated desc

# Security Arsenal — Rogue ScreenConnect / XMRig / SockTz Host Hunt
# Run elevated on suspect endpoints or deploy fleet-wide via GPO/Intune/EDR
$Report = @()

# 1. Rogue ScreenConnect services (legit installs have known, documented names)
$scServices = Get-CimInstance Win32_Service | Where-Object { $_.Name -match 'ScreenConnect' -or $_.DisplayName -match 'ScreenConnect' }
foreach ($s in $scServices) {
    $suspicious = $s.PathName -match 'Temp|Public|Roaming|ProgramData(?!\\ScreenConnect)'
    $Report += [PSCustomObject]@{Check='ScreenConnect Service'; Finding="$($s.Name) | $($s.PathName) | State=$($s.State)"; Suspicious=$suspicious}
}

# 2. Numbered VBScript staging files in common drop locations
$vbsPaths = @("$env:TEMP","$env:PUBLIC","$env:APPDATA","$env:LOCALAPPDATA","C:\ProgramData")
foreach ($p in $vbsPaths) {
    Get-ChildItem -Path $p -Recurse -ErrorAction SilentlyContinue -Include '1.vbs','2.vbs','3.vbs','4.vbs' |
        ForEach-Object { $Report += [PSCustomObject]@{Check='VBScript Stager'; Finding=$_.FullName; Suspicious=$true} }
}

# 3. Run-key persistence referencing scripts or RMM tooling
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
    if (Test-Path $k) {
        (Get-ItemProperty $k).PSObject.Properties | Where-Object { $_.Value -match 'vbs|ScreenConnect|xmrig|duckdns|anondns' } |
            ForEach-Object { $Report += [PSCustomObject]@{Check='Run Key Persistence'; Finding="$k :: $($_.Name) = $($_.Value)"; Suspicious=$true} }
    }
}

# 4. Scheduled tasks launching scripts/miners
Get-ScheduledTask | Where-Object { ($_.Actions.Execute -match 'wscript|cscript|powershell') -and ($_.Actions.Arguments -match 'vbs|xmrig|duckdns|anondns|http') } |
    ForEach-Object { $Report += [PSCustomObject]@{Check='Scheduled Task'; Finding="$($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)"; Suspicious=$true} }

# 5. Active connections to known C2 infrastructure
$c2Patterns = 'duckdns\.org|anondns\.net|opik\.net'
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $dns = (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost
        if ($dns -match $c2Patterns) {
            $Report += [PSCustomObject]@{Check='C2 Connection'; Finding="PID $($_.OwningProcess) -> $($_.RemoteAddress):$($_.RemotePort) [$dns]"; Suspicious=$true}
        }
    } catch {}
}

# 6. XMRig artifacts (miner binary, config, high-CPU unknown processes)
Get-ChildItem -Path 'C:\' -Recurse -Depth 4 -ErrorAction SilentlyContinue -Include 'xmrig*.exe','config.json' |
    Where-Object { $_.FullName -match 'xmrig' } |
    ForEach-Object { $Report += [PSCustomObject]@{Check='XMRig Artifact'; Finding=$_.FullName; Suspicious=$true} }

$Report | Where-Object { $_.Suspicious } | Format-Table -AutoSize
if (-not ($Report | Where-Object { $_.Suspicious })) { Write-Host '[+] No indicators of compromise found.' -ForegroundColor Green }