ScreenConnect RAT + ValleyRAT Crypto Fraud + Telerik Exploitation: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Trojanized ScreenConnect Execution via Phishing Lure
id: 9e8d7c6b-5a4f-4e3d-8c2b-1a0f9e8d7c6b
status: experimental
description: Detects execution of ScreenConnect client from suspicious paths or with unusual command-line arguments following phishing lure patterns
author: Security Arsenal Threat Intelligence
date: 2026/10/29
references:
    - https://www.cloudsek.com/blog/fake-adobe-acrobat-lures-deliver-screenconnect-remote-access-clients
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\ScreenConnect.Client.exe'
        - Image|endswith: '\ScreenConnect.WindowsClient.exe'
    selection_path:
        - Image|contains: '\Temp\'
        - Image|contains: '\AppData\Local\Temp\'
        - Image|contains: '\Downloads\'
        - Image|contains: '\Users\Public\'
    selection_cmd:
        CommandLine|contains:
            - 'relay'
            - 'session'
            - 'connect'
    condition: selection_img and (selection_path or selection_cmd)
falsepositives:
    - Legitimate IT administrative use of ScreenConnect
    - Managed service provider deployments
level: high
tags:
    - attack.execution
    - attack.t1219
    - attack.command_and_control
    - attack.t1105
---
title: Godzilla Webshell Memory Execution
id: 8f7e6d5c-4b3a-4f2e-9d1c-0b9a8f7e6d5c
status: experimental
description: Detects characteristics of Godzilla webshell deployment including unusual IIS worker process behavior and memory-resident execution patterns
author: Security Arsenal Threat Intelligence
date: 2026/10/29
references:
    - https://asec.ahnlab.com/ko/95560/
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\w3wp.exe'
    selection_img:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\powershell.exe'
            - '\cmd.exe'
    selection_cmd:
        CommandLine|contains:
            - 'JScript'
            - 'VBScript'
            - 'FromBase64String'
            - 'MemoryStream'
            - 'DeflateStream'
    condition: selection_parent and selection_img and selection_cmd
falsepositives:
    - Legitimate IIS application initialization
    - Administrative maintenance scripts
level: critical
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.defense_evasion
    - attack.t1027
---
title: CVE-2019-18935 Telerik UI Exploitation Attempt
id: 7c6b5a4f-3e2d-4c1b-8a0f-9e8d7c6b5a4f
status: experimental
description: Detects exploitation attempts against CVE-2019-18935 through suspicious POST requests to Telerik WebResource handler
author: Security Arsenal Threat Intelligence
date: 2026/10/29
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-18935
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-stem|contains: 'Telerik.Web.UI.WebResource.axd'
        cs-method: 'POST'
    selection_exploit:
        cs-uri-query|contains:
            - 'type=rau'
            - 'download'
            - 'serialize'
    condition: selection and selection_exploit
falsepositives:
    - Legitimate Telerik UI resource requests (GET method only)
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059

// Hunt for ScreenConnect trojanized installations, Godzilla webshell indicators, and ValleyRAT C2
let ScreenConnectHashes = dynamic(["1552fa772ad501e9b7024a0952bbc30637be23778896492e372a9aee463fa06a", "56a0c57d46e182827f1356e566337f9fd54404f9637c19369b188c39d3d127d3", "c7a4e83ae354d5c60acb878cc3a7c9fc06287e03a054fb7e8bc0b8fe6fa0a3f9", "dcd9db5cfaa4d1351d6d54e1be1ab87a21bcd9289e966e79d550ebffb2903660"]);
let SuspiciousIPs = dynamic(["14.128.53.155", "206.82.6.22", "2.59.133.147"]);
let ValleyRATDomains = dynamic(["chumchurumcc.com", "chumchurum.org", "chumchuru.com", "chumchurum.xyz", "chumchurumc.com"]);
union isfuzzy=true
    (DeviceProcessEvents
    | where FileName has_any ("ScreenConnect", "rundll32", "regsvr32", "powershell", "cmd")
    | where ProcessCommandLine has_any ("relay", "JScript", "FromBase64String", "MemoryStream") 
       or InitiatingProcessFileName =~ "w3wp.exe"
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256, ReportId
    | extend DetectionType = "ScreenConnect/Godzilla Process"),
    (DeviceNetworkEvents
    | where RemoteIP in (SuspiciousIPs) or RemoteUrl has_any (ValleyRATDomains)
    | project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, ReportId
    | extend DetectionType = "C2 Communication"),
    (DeviceFileEvents
    | where SHA256 in (ScreenConnectHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ReportId
    | extend DetectionType = "Malicious File Hash")
| summarize by TimeGenerated, DeviceName, DetectionType, FileName, ProcessCommandLine, RemoteIP, RemoteUrl, SHA256, ReportId
| order by TimeGenerated desc

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Security Arsenal IOC Hunt Script — ScreenConnect RAT, ValleyRAT, Blue Mockingbird
.DESCRIPTION
    Hunts for indicators of compromise across three campaigns: trojanized ScreenConnect,
    ValleyRAT infrastructure, and Blue Mockingbird Telerik exploitation artifacts
.NOTES
    Author: Security Arsenal Threat Intelligence
    Date: 2026-10-29
#>

$ErrorActionPreference = 'SilentlyContinue'
$OutputPath = "$env:TEMP\SA_IOC_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$Results = @()

# IOC Definitions
$ScreenConnectHashes = @("1552fa772ad501e9b7024a0952bbc30637be23778896492e372a9aee463fa06a",
    "56a0c57d46e182827f1356e566337f9fd54404f9637c19369b188c39d3d127d3",
    "c7a4e83ae354d5c60acb878cc3a7c9fc06287e03a054fb7e8bc0b8fe6fa0a3f9",
    "dcd9db5cfaa4d1351d6d54e1be1ab87a21bcd9289e966e79d550ebffb2903660")
$SuspiciousIPs = @("14.128.53.155", "206.82.6.22", "2.59.133.147")
$ValleyRATDomains = @("chumchurumcc.com", "chumchurum.org", "chumchuru.com", "chumchurum.xyz", "chumchurumc.com")

Write-Host "[+] Security Arsenal IOC Hunt — $(Get-Date)" -ForegroundColor Cyan
Write-Host "[+] Checking for trojanized ScreenConnect installations..." -ForegroundColor Yellow

# Check for ScreenConnect in suspicious locations
$ScreenConnectPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:PUBLIC", "$env:USERPROFILE\Downloads")
foreach ($Path in $ScreenConnectPaths) {
    $Files = Get-ChildItem -Path $Path -Recurse -Filter "*ScreenConnect*" -ErrorAction SilentlyContinue | Select-Object -First 50
    foreach ($File in $Files) {
        $Hash = (Get-FileHash -Path $File.FullName -Algorithm SHA256).Hash
        $Status = if ($ScreenConnectHashes -contains $Hash) { "MALICIOUS HASH" } else { "Suspicious Location" }
        $Results += [PSCustomObject]@{
            Timestamp = Get-Date
            Computer = $env:COMPUTERNAME
            DetectionType = "ScreenConnect File"
            Path = $File.FullName
            Hash = $Hash
            Status = $Status
            Campaign = "Fake Adobe/ScreenConnect"
        }
    }
}

# Check running processes for ScreenConnect
$ScreenConnectProcs = Get-Process | Where-Object { $_.Name -like "*ScreenConnect*" }
foreach ($Proc in $ScreenConnectProcs) {
    $Results += [PSCustomObject]@{
        Timestamp = Get-Date
        Computer = $env:COMPUTERNAME
        DetectionType = "ScreenConnect Process"
        Path = $Proc.Path
        Hash = "N/A"
        Status = "Active Process — Investigate"
        Campaign = "Fake Adobe/ScreenConnect"
    }
}

Write-Host "[+] Checking network connections to malicious IPs..." -ForegroundColor Yellow

# Check active network connections
$Connections = Get-NetTCPConnection | Where-Object { $SuspiciousIPs -contains $_.RemoteAddress }
foreach ($Conn in $Connections) {
    $OwningProcess = (Get-Process -Id $Conn.OwningProcess).Path
    $Results += [PSCustomObject]@{
        Timestamp = Get-Date
        Computer = $env:COMPUTERNAME
        DetectionType = "Malicious IP Connection"
        Path = "$($Conn.LocalAddress):$($Conn.LocalPort) -> $($Conn.RemoteAddress):$($Conn.RemotePort)"
        Hash = $OwningProcess
        Status = "ACTIVE CONNECTION"
        Campaign = "ValleyRAT/Blue Mockingbird"
    }
}

Write-Host "[+] Checking DNS cache for ValleyRAT domains..." -ForegroundColor Yellow

# Check DNS cache
$DNSCache = Get-DnsClientCache | Where-Object { $ValleyRATDomains -contains $_.Entry }
foreach ($DNS in $DNSCache) {
    $Results += [PSCustomObject]@{
        Timestamp = Get-Date
        Computer = $env:COMPUTERNAME
        DetectionType = "Malicious Domain Resolution"
        Path = $DNS.Entry
        Hash = $DNS.Data
        Status = "DNS Cache Entry"
        Campaign = "RATatouille/ValleyRAT"
    }
}

Write-Host "[+] Checking for Godzilla webshell persistence (IIS anomalies)..." -ForegroundColor Yellow

# Check IIS worker processes for suspicious command lines
$W3WPProcs = Get-WmiObject Win32_Process | Where-Object { $_.Name -eq "w3wp.exe" }
foreach ($Proc in $W3WPProcs) {
    if ($Proc.CommandLine -match "JScript|VBScript|FromBase64String|MemoryStream") {
        $Results += [PSCustomObject]@{
            Timestamp = Get-Date
            Computer = $env:COMPUTERNAME
            DetectionType = "Suspicious IIS Process"
            Path = $Proc.ExecutablePath
            Hash = $Proc.CommandLine.Substring(0, [Math]::Min(200, $Proc.CommandLine.Length))
            Status = "Possible Godzilla Webshell"
            Campaign = "Blue Mockingbird"
        }
    }
}

Write-Host "[+] Checking Telerik UI vulnerability status..." -ForegroundColor Yellow

# Check for Telerik WebResource handler (indicator of potentially vulnerable installation)
$IISPaths = @("C:\inetpub\wwwroot", "C:\inetpub")
foreach ($IISPath in $IISPaths) {
    $TelerikFiles = Get-ChildItem -Path $IISPath -Recurse -Filter "Telerik.Web.UI.dll" -ErrorAction SilentlyContinue | Select-Object -First 10
    foreach ($File in $TelerikFiles) {
        $Version = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($File.FullName).FileVersion
        $Vulnerable = if ($Version -lt "2020.2.617") { "VULNERABLE to CVE-2019-18935" } else { "Patched" }
        $Results += [PSCustomObject]@{
            Timestamp = Get-Date
            Computer = $env:COMPUTERNAME
            DetectionType = "Telerik UI Installation"
            Path = $File.FullName
            Hash = $Version
            Status = $Vulnerable
            Campaign = "Blue Mockingbird"
        }
    }
}

# Check for scheduled tasks with suspicious names (common persistence)
$SuspiciousTasks = Get-ScheduledTask | Where-Object { $_.TaskName -match "Update|Maintenance|Adobe|Document|View" } | Select-Object -First 20
foreach ($Task in $SuspiciousTasks) {
    $TaskInfo = Get-ScheduledTaskInfo -TaskName $Task.TaskName
    $Results += [PSCustomObject]@{
        Timestamp = Get-Date
        Computer = $env:COMPUTERNAME
        DetectionType = "Suspicious Scheduled Task"
        Path = $Task.TaskPath + $Task.TaskName
        Hash = $TaskInfo.LastRunTime
        Status = "Review Required"
        Campaign = "Multiple"
    }
}

# Output results
if ($Results.Count -gt 0) {
    $Results | Export-Csv -Path $OutputPath -NoTypeInformation
    Write-Host "[!] $($Results.Count) indicators found. Results exported to: $OutputPath" -ForegroundColor Red
    $Results | Format-Table -AutoSize
} else {
    Write-Host "[+] No indicators found. System appears clean." -ForegroundColor Green
}

Write-Host "[+] Hunt complete. Review any findings and isolate affected systems immediately." -ForegroundColor Cyan