Secret Blizzard’s Kazuar: Evolving into a Modular P2P Botnet — Detection and Defense

---
title: Potential Kazuar P2P Network Activity
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential P2P botnet behavior characteristic of Kazuar evolution, where a process creates multiple outbound connections to non-standard ports on diverse external IPs.
references:
  - https://www.bleepingcomputer.com/news/security/russian-hackers-turn-kazuar-backdoor-into-modular-p2p-botnet/
author: Security Arsenal
date: 2025/04/10
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort|notin:
      - '80'
      - '443'
      - '53'
  filter_main_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
  filter_main_os:
    Image|endswith:
      - '\svchost.exe'
      - '\services.exe'
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate update managers
  - Games or specialized business software
level: high
---
title: Kazuar Backdoor Persistence via Rundll32
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects suspicious execution of unsigned DLLs via rundll32, a common loader method for Kazuar, specifically when executed from user profile directories.
references:
  - https://attack.mitre.org/techniques/T1218/
author: Security Arsenal
date: 2025/04/10
tags:
  - attack.defense_evasion
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\rundll32.exe'
    CommandLine|contains: '.dll'
  selection_path:
    CommandLine|contains:
      - 'C:\Users\'
      - 'C:\ProgramData\'
  filter_signed:
    Signed: 'true'
  condition: selection and selection_path and not filter_signed
falsepositives:
  - Legacy software installers
level: medium
---
title: Suspicious PowerShell Encoded Command (Kazuar Loader)
id: c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects PowerShell execution with encoded commands, a technique often used by Kazuar to load .NET assemblies in memory.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2025/04/10
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - ' -enc '
      - ' -EncodedCommand '
  filter_legit:
    ParentImage|contains:
      - '\Windows Defender\'
      - '\System Center Operations Manager\'
  condition: selection and not filter_legit
falsepositives:
  - System management scripts
level: high

let TimeFrame = 1h;
DeviceNetworkEvents
| where Timestamp > ago(TimeFrame)
| where ActionType == "ConnectionAccepted" or ActionType == "ConnectionSuccess"
| where RemotePort not in (80, 443, 22, 53)
// Exclude known business apps and browsers based on process name
| where InitiatingProcessFileName !in ("chrome.exe", "firefox.exe", "msedge.exe", "outlook.exe", "teams.exe")
| summarize UniqueRemoteIPs = dcount(RemoteIP), ConnectionCount = count() by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath
| where UniqueRemoteIPs > 10 and ConnectionCount > 50
| order by UniqueRemoteIPs desc

-- Hunt for suspicious persistence mechanisms often used by Kazuar
SELECT 
  Data.key AS RegistryKey,
  Data.value AS Value,
  Data.type AS ValueType,
  Mtime AS ModifiedTime
FROM glob(globs="""C:\Users\*\NTUSER.DAT""")
LET RegFile <= pathspec(Path=Source)
LET WinReg <= read_reg_key(hive=RegFile, path="""Software\Microsoft\Windows\CurrentVersion\Run""")
SELECT * FROM foreach(row=WinReg, query={
    SELECT
      key AS RunKey,
      value.data AS TargetPath,
      stat(file=TargetPath) AS FileStat
    FROM scope()
})
WHERE TargetPath =~ "\\.(dll|exe|ps1)$"
  AND NOT FileStat.LinkName =~ "C:\\Program Files"  
  AND NOT FileStat.LinkName =~ "C:\\Windows\\System32"
-- Check for unsigned binaries in AppData

<#
    .SYNOPSIS
    Security Arsenal - Kazuar P2P Botnet Remediation Script
    .DESCRIPTION
    Scans for suspicious persistence in Registry Run keys and terminates unauthorized rundll32 processes.
#>

Write-Host "[+] Starting Kazuar Remediation Scan..." -ForegroundColor Cyan

# 1. Check for Suspicious Run Keys (User and System)
$suspiciousPaths = @("$env:APPDATA", "$env:TEMP", "$env:USERPROFILE\Downloads")
$runKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | Where-Object {$_.Name -ne "PSPath" -and $_.Name -ne "PSParentPath"} | ForEach-Object {
            $propName = $_.Name
            $propValue = (Get-ItemProperty $key).$propName
            
            # Check if the value points to a suspicious location or is an obscure file
            if ($propValue -match ".dll" -or $propValue -match ".vbs") {
                $isSuspicious = $false
                foreach ($badPath in $suspiciousPaths) {
                    if ($propValue -like "*$badPath*") { $isSuspicious = $true }
                }

                if ($isSuspicious) {
                    Write-Host "[!] Suspicious persistence found: $key -> $propValue" -ForegroundColor Red
                    # Remove-ItemProperty -Path $key -Name $propName -Force # Uncomment to remediate
                }
            }
        }
    }
}

# 2. Kill Suspicious Rundll32 Processes (General Heuristic)
Write-Host "[+] Checking for suspicious rundll32.exe processes..." -ForegroundColor Cyan
Get-Process -Name "rundll32" -ErrorAction SilentlyContinue | ForEach-Object {
    $cmdLine = (Get-CimInstance Win32_Process -Filter "ProcessId=$($_.Id)").CommandLine
    if ($cmdLine -match ".dll" -and ($cmdLine -match ".exe .dll")) {
        # Heuristic: rundll32 executing a DLL from a non-system path
        if ($cmdLine -notmatch "System32" -and $cmdLine -notmatch "SysWOW64") {
            Write-Host "[!] Terminating suspicious process: $($_.Id) - $cmdLine" -ForegroundColor Yellow
            Stop-Process -Id $_.Id -Force
        }
    }
}

Write-Host "[+] Scan complete. Please review findings and restart affected endpoints." -ForegroundColor Green