Spring Ring Teams Vishing Campaign + Gryxa AI-Built RMM Toolkit: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Suspicious RMM or PowerShell RAT Execution Following Teams Interaction
id: 7f3a1c2e-9b4d-4e6a-a1c8-springring0001
status: experimental
description: Detects execution of RMM tooling installers or encoded PowerShell spawned in proximity to Microsoft Teams processes, consistent with Spring Ring help-desk vishing tradecraft.
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
 detection:
    selection_teams_parent:
        ParentImage|endswith: '\ms-teams.exe'
    selection_rmm_binary:
        Image|endswith:
            - '\anydesk.exe'
            - '\teamviewer.exe'
            - '\screenconnect.exe'
            - '\netsupportmanager.exe'
            - '\quickassist.exe'
            - '\aeroadmin.exe'
            - '\rustdesk.exe'
    selection_ps_rat:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - ' -enc '
            - ' -ec '
            - 'FromBase64String'
            - 'DownloadString'
            - 'san-sid.com'
    condition: selection_teams_parent and (selection_rmm_binary or selection_ps_rat)
falsepositives:
    - Legitimate help desk pushing RMM via Teams chat (verify against change tickets)
level: high
tags:
    - attack.initial_access
    - attack.t1566
    - attack.t1219
    - attack.t1059.001
date: 2026/09/30
---
title: Gryxa Toolkit Persistence — Scheduled Task or WMI Event Subscription
id: 8a4b2d3f-0c5e-5f7b-b2d9-gryxa0000002
status: experimental
description: Detects persistence mechanisms associated with the Gryxa AI-built toolkit — scheduled task creation and WMI permanent event subscription registration.
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains:
            - '/create'
            - '/sc onlogon'
            - '/sc onstart'
    selection_wmi_persistence:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wmic.exe'
            - '\mofcomp.exe'
        CommandLine|contains:
            - '__EventFilter'
            - 'CommandLineEventConsumer'
            - 'ActiveScriptEventConsumer'
            - '__FilterToConsumerBinding'
            - 'root\subscription'
    filter_legit_admin:
        CommandLine|contains:
            - 'Microsoft\Windows\'
            - 'SystemCenter'
    condition: (selection_schtasks or selection_wmi_persistence) and not filter_legit_admin
falsepositives:
    - Enterprise management tooling (SCCM, Intune) creating tasks — baseline and tune
level: high
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.t1546.003
date: 2026/09/30
---
title: Gryxa C2 Infrastructure DNS Resolution
id: 9b5c3e4a-1d6f-6a8c-c3e0-gryxa0000003
status: experimental
description: Detects DNS queries to known Gryxa toolkit command-and-control and staging infrastructure identified in OTX pulse reporting.
author: Security Arsenal Threat Intel
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'gryxa.com'
            - 'wirbe.com'
            - 'seczio.com'
            - 'sevrz.com'
            - 'san-sid.com'
    condition: selection
falsepositives:
    - None expected — these domains have no legitimate enterprise use
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
date: 2026/09/30

// Hunt: Spring Ring vishing + Gryxa RMM toolkit activity — Microsoft Sentinel
// 1) DNS/network connections to known C2 and staging infrastructure
let BadDomains = dynamic(["san-sid.com","gryxa.com","wirbe.com","seczio.com","sevrz.com","cdn.wirbe.com","mesh.wirbe.com","ui.gryxa.com","debian.seczio.com"]);
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (BadDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
// 2) RMM tooling or encoded PowerShell spawned by Teams (Spring Ring tradecraft)
let RMMList = dynamic(["anydesk.exe","teamviewer.exe","screenconnect.exe","quickassist.exe","rustdesk.exe","aeroadmin.exe","netsupportmanager.exe"]);
let TeamsSpawned =
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where InitiatingProcessFileName =~ "ms-teams.exe"
    | where FileName in~ (RMMList)
       or (FileName in~ ("powershell.exe","pwsh.exe") and ProcessCommandLine has_any ("-enc","-ec ","FromBase64String","DownloadString","san-sid.com"))
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256;
// 3) WMI event subscription persistence (Gryxa)
let WMIPersistence =
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where ProcessCommandLine has_any ("__EventFilter","CommandLineEventConsumer","ActiveScriptEventConsumer","__FilterToConsumerBinding","root\\subscription")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
// 4) Known malicious hash
let HashHits =
    DeviceProcessEvents
    | where SHA256 == "24ab9fe5d5be62d3bf055a0ca4508e8bca2996b6d78649dce8145d8a27bc1c5b"
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256;
union NetworkHits, TeamsSpawned, WMIPersistence, HashHits
| sort by TimeGenerated desc

# Security Arsenal — Spring Ring / Gryxa IOC & Persistence Sweep
# Run as Administrator on suspect endpoints (or deploy via GPO/Intune/EDR live response)

$ErrorActionPreference = 'SilentlyContinue'
$Report = @()

# --- 1) DNS cache check for known C2 / staging domains ---
$BadDomains = @('san-sid.com','gryxa.com','wirbe.com','seczio.com','sevrz.com',
                'cdn.wirbe.com','mesh.wirbe.com','ui.gryxa.com','debian.seczio.com')
$DnsHits = Get-DnsClientCache | Where-Object { $e = $_.Entry; $BadDomains | Where-Object { $e -like "*$_*" } }
if ($DnsHits) { $Report += [pscustomobject]@{Check='DNS Cache'; Finding=($DnsHits | Out-String)} }

# --- 2) Active connections to Gryxa-linked infrastructure ---
$ConnHits = Get-NetTCPConnection -State Established |
    Where-Object { $_.RemotePort -in 443,8443,8080 } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess
        try { $r = Resolve-DnsName $_.RemoteAddress -ErrorAction Stop } catch { $r = $null }
        if ($r -and ($BadDomains | Where-Object { $r.NameHost -like "*$_*" })) {
            [pscustomobject]@{Check='Network'; Finding="$($proc.ProcessName) ($($proc.Id)) -> $($r.NameHost) [$($_.RemoteAddress):$($_.RemotePort)]"}
        }
    }
if ($ConnHits) { $Report += $ConnHits }

# --- 3) Scheduled tasks persistence (Gryxa) ---
$SuspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.TaskPath -notlike '\Microsoft\*' -and
    ($_.Actions.Execute -match 'powershell|pwsh|cmd|rundll32|mshta|wscript' -or
     $_.Actions.Arguments -match '-enc|-ec |FromBase64String|http')
}
if ($SuspiciousTasks) {
    $Report += [pscustomobject]@{Check='ScheduledTasks'; Finding=($SuspiciousTasks | Select-Object TaskName,TaskPath,@{n='Action';e={$_.Actions.Execute + ' ' + $_.Actions.Arguments}} | Out-String)}
}

# --- 4) WMI event subscription persistence (Gryxa T1546.003) ---
$WmiFilters   = Get-WmiObject -Namespace root\subscription -Class __EventFilter
$WmiConsumers = Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer
$WmiConsumers += Get-WmiObject -Namespace root\subscription -Class ActiveScriptEventConsumer
if ($WmiFilters -or $WmiConsumers) {
    $Report += [pscustomobject]@{Check='WMI Persistence'; Finding=($WmiConsumers | Select-Object Name,CommandLineTemplate,ScriptText | Out-String)}
}

# --- 5) Known malicious hash sweep (common staging locations) ---
$TargetHash = '24AB9FE5D5BE62D3BF055A0CA4508E8BCA2996B6D78649DCE8145D8A27BC1C5B'
$Paths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData","$env:USERPROFILE\Downloads")
foreach ($p in $Paths) {
    Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        if ((Get-FileHash $_.FullName -Algorithm SHA256).Hash -eq $TargetHash) {
            $Report += [pscustomobject]@{Check='Hash Match'; Finding="MALICIOUS FILE: $($_.FullName)"}
        }
    }
}

# --- 6) Unsanctioned RMM tooling installed ---
$RmmNames = 'AnyDesk','TeamViewer','ScreenConnect','RustDesk','AeroAdmin','NetSupport','Gryxa'
$Installed = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
             HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
    Where-Object { $n = $_.DisplayName; $RmmNames | Where-Object { $n -like "*$_*" } } |
    Select-Object DisplayName, InstallDate
if ($Installed) { $Report += [pscustomobject]@{Check='RMM Installed'; Finding=($Installed | Out-String)} }

# --- Output ---
if ($Report) {
    Write-Host "[!] FINDINGS on $env:COMPUTERNAME" -ForegroundColor Red
    $Report | Format-List
    $Report | Export-Csv ".\ioc_sweep_$env:COMPUTERNAME.csv" -NoTypeInformation
} else {
    Write-Host "[+] Clean: $env:COMPUTERNAME — no Spring Ring / Gryxa indicators found." -ForegroundColor Green
}