ShadowPad, PlugX & DestroyRAT: TAG-179 Dual-Nexus Espionage Against Pakistani Law Enforcement — OTX Pulse Detection Pack

---
title: ShadowPad or PlugX DLL Sideloading via Legitimate Signed Binary
id: 7a1c9e2d-4f3b-4c8a-9e1d-2b5f6a7c8d9e
status: experimental
description: Detects DLL sideloading patterns associated with ShadowPad and PlugX implants - a signed legitimate executable loading a DLL from an unusual path, as observed in TAG-179 intrusions against Pakistani law enforcement.
author: Security Arsenal Threat Intelligence
date: 2026/08/09
references:
    - https://www.sentinelone.com/labs/one-target-china-india-espionage-converge-on-pakistani-law-enforcement/
logsource:
    category: image_load
    product: windows
detection:
    selection_signed_parent:
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    selection_suspicious_dll_path:
        ImageLoaded|contains:
            - '\AppData\'
            - '\ProgramData\'
            - '\Users\Public\'
            - '\Windows\Temp\'
            - '\Temp\'
    filter_signed_dll:
        Signed: 'true'
        SignatureStatus: 'validated'
    condition: selection_signed_parent and selection_suspicious_dll_path and not filter_signed_dll
falsepositives:
    - Legitimate software loading plugins from user directories
level: high
tags:
    - attack.defense_evasion
    - attack.t1574.002
    - attack.t1218
---
title: Suspicious Service Creation for APT Backdoor Persistence
id: 8b2d0f3e-5a4c-4d9b-0f2e-3c6a7b8d9e0f
status: experimental
description: Detects creation of Windows services with characteristics consistent with ShadowPad/PlugX persistence - services created via sc.exe or registry with randomized or masquerading names executing from non-system paths.
author: Security Arsenal Threat Intelligence
date: 2026/08/09
references:
    - https://www.sentinelone.com/labs/one-target-china-india-espionage-converge-on-pakistani-law-enforcement/
logsource:
    category: process_creation
    product: windows
detection:
    selection_sc:
        Image|endswith:
            - '\sc.exe'
        CommandLine|contains:
            - 'create'
    selection_suspicious_path:
        CommandLine|contains:
            - '\AppData\'
            - '\ProgramData\'
            - '\Users\Public\'
            - 'rundll32.exe'
            - 'regsvr32.exe'
    condition: selection_sc and selection_suspicious_path
falsepositives:
    - Software installers registering legitimate services
level: high
tags:
    - attack.persistence
    - attack.t1543.003
---
title: TAG-179 Known C2 Network Communication
id: 9c3e1a4f-6b5d-4e0c-1a3f-4d7b8c9e0f1a
status: experimental
description: Detects network connections to known TAG-179 command and control infrastructure identified in the AlienVault OTX pulse covering dual-nexus espionage against Pakistani law enforcement.
author: Security Arsenal Threat Intelligence
date: 2026/08/09
references:
    - https://www.sentinelone.com/labs/one-target-china-india-espionage-converge-on-pakistani-law-enforcement/
logsource:
    category: network_connection
    product: windows
detection:
    selection_ipv4:
        DestinationIp:
            - '172.94.9.19'
            - '172.111.233.105'
            - '172.111.233.96'
            - '172.111.233.12'
            - '142.171.183.8'
            - '193.42.25.65'
    filter_ports:
        DestinationPort:
            - 53
    condition: selection_ipv4 and not filter_ports
falsepositives:
    - None expected for confirmed C2 addresses
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1572

// TAG-179 Dual-Nexus Espionage Hunt - ShadowPad / PlugX / Cobalt Strike / AsyncRAT / Remcos
// Hunts network IOCs, DLL sideloading behavior, and persistence artifacts
let C2_IPs = dynamic(["172.94.9.19","172.111.233.105","172.111.233.96","172.111.233.12","142.171.183.8","193.42.25.65"]);
let Lookback = 90d;
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteIP in (C2_IPs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ActionType
    | extend Detection = "Known TAG-179 C2 Connection";
let Sideloading = DeviceImageLoadEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName endswith ".dll"
    | where FolderPath has_any (@"\AppData\", @"\ProgramData\", @"\Users\Public\", @"\Temp\")
    | where InitiatingProcessFolderPath has_any (@"C:\Program Files\", @"C:\Program Files (x86)\")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, SHA256
    | extend Detection = "Potential DLL Sideloading (ShadowPad/PlugX pattern)";
let ServicePersistence = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName =~ "sc.exe" and ProcessCommandLine has "create"
    | where ProcessCommandLine has_any (@"\AppData\", @"\ProgramData\", @"\Users\Public\", "rundll32", "regsvr32")
    | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine
    | extend Detection = "Suspicious Service Persistence";
let RunKeyPersistence = DeviceRegistryEvents
    | where TimeGenerated > ago(Lookback)
    | where RegistryKey has_any (@"\CurrentVersion\Run", @"\CurrentVersion\RunOnce")
    | where RegistryValueData has_any (@"\AppData\", @"\ProgramData\", @"\Users\Public\", "rundll32")
    | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
    | extend Detection = "Registry Run Key Persistence (AsyncRAT/Remcos/PlugX pattern)";
union NetworkHits, Sideloading, ServicePersistence, RunKeyPersistence
| order by TimeGenerated desc

<#
.SYNOPSIS
    TAG-179 Dual-Nexus Espionage IOC & Artifact Hunt
.DESCRIPTION
    Hunts for indicators and persistence artifacts associated with ShadowPad, PlugX/Sogu/Korplug,
    Remcos, AsyncRAT, and Cobalt Strike implants observed in the TAG-179 campaign against
    Pakistani law enforcement infrastructure. Run elevated on endpoints and servers.
.NOTES
    Security Arsenal Threat Intelligence - OTX Pulse Analysis 2026-08-09
#>

$ErrorActionPreference = 'SilentlyContinue'
$Report = @()

# --- 1. Known TAG-179 C2 Addresses ---
$C2IPs = @('172.94.9.19','172.111.233.105','172.111.233.96','172.111.233.12','142.171.183.8','193.42.25.65')

Write-Host "[+] Checking active network connections against TAG-179 C2 list..." -ForegroundColor Cyan
$Conns = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -in $C2IPs }
foreach ($c in $Conns) {
    $proc = Get-Process -Id $c.OwningProcess
    $Report += [PSCustomObject]@{
        Category = 'C2 Connection (LIVE)'
        Finding  = "$($c.RemoteAddress):$($c.RemotePort) - Process: $($proc.ProcessName) (PID $($c.OwningProcess)) Path: $($proc.Path)"
        Severity = 'CRITICAL'
    }
}

# --- 2. DNS cache check for C2 resolution history ---
Write-Host "[+] Checking DNS client cache for victim/C2 domains..." -ForegroundColor Cyan
$DnsHits = Get-DnsClientCache | Where-Object { $_.Entry -match 'balochistanpolice' -or $_.Data -in $C2IPs }
foreach ($d in $DnsHits) {
    $Report += [PSCustomObject]@{ Category='DNS Cache Hit'; Finding="$($d.Entry) -> $($d.Data)"; Severity='HIGH' }
}

# --- 3. Registry Run-key persistence (AsyncRAT / Remcos / PlugX pattern) ---
Write-Host "[+] Checking Run/RunOnce keys for suspicious persistence..." -ForegroundColor Cyan
$RunKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $RunKeys) {
    if (Test-Path $key) {
        (Get-ItemProperty $key).PSObject.Properties | Where-Object {
            $_.Value -match 'AppData|ProgramData|Users\\Public|rundll32|regsvr32'
        } | ForEach-Object {
            $Report += [PSCustomObject]@{ Category='Run Key Persistence'; Finding="$key -> $($_.Name) = $($_.Value)"; Severity='HIGH' }
        }
    }
}

# --- 4. Suspicious services executing from non-system paths (ShadowPad/PlugX pattern) ---
Write-Host "[+] Checking services with suspicious binary paths..." -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'AppData|ProgramData|Users\\Public|rundll32.*\.dll|regsvr32'
} | ForEach-Object {
    $Report += [PSCustomObject]@{ Category='Suspicious Service'; Finding="$($_.Name): $($_.PathName) [State: $($_.State)]"; Severity='HIGH' }
}

# --- 5. DLL sideloading artifacts: signed EXE + unsigned DLL co-located outside Program Files ---
Write-Host "[+] Scanning common staging paths for EXE+DLL sideloading pairs..." -ForegroundColor Cyan
$StagingPaths = @("$env:ProgramData","$env:PUBLIC","$env:APPDATA")
foreach ($p in $StagingPaths) {
    Get-ChildItem -Path $p -Recurse -Depth 3 -Include *.exe -ErrorAction SilentlyContinue | ForEach-Object {
        $dlls = Get-ChildItem -Path $_.DirectoryName -Filter *.dll -ErrorAction SilentlyContinue
        foreach ($dll in $dlls) {
            $sig = Get-AuthenticodeSignature $dll.FullName
            if ($sig.Status -ne 'Valid') {
                $Report += [PSCustomObject]@{ Category='Possible Sideload Pair'; Finding="EXE: $($_.FullName) | Unsigned DLL: $($dll.FullName)"; Severity='MEDIUM' }
            }
        }
    }
}

# --- 6. Scheduled tasks referencing suspicious paths ---
Write-Host "[+] Checking scheduled tasks for persistence..." -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match 'AppData|ProgramData|Users\\Public|rundll32.*\.dll|powershell.*-enc') {
        $Report += [PSCustomObject]@{ Category='Suspicious Scheduled Task'; Finding="$($_.TaskName): $($actions.Trim())"; Severity='HIGH' }
    }
}

# --- Output ---
if ($Report.Count -gt 0) {
    Write-Host "`n[!] $($Report.Count) FINDINGS DETECTED - INVESTIGATE IMMEDIATELY`n" -ForegroundColor Red
    $Report | Sort-Object Severity | Format-Table -AutoSize -Wrap
    $Report | Export-Csv -Path ".\TAG179_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
} else {
    Write-Host "`n[+] No TAG-179 artifacts detected on this host.`n" -ForegroundColor Green
}