TeamPCP PyPI Supply Chain Attack, LofyStealer, and GhostSocks Proxy Botnet: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential TeamPCP Supply Chain Attack - Python Spawning MsBuild
id: a9b2c3d4-e5f6-4789-a012-345678901abc
description: Detects Python processes (pip/python.exe) spawning msbuild.exe, a technique used in the TeamPCP Telnyx SDK supply chain attack.
status: experimental
date: 2026/05/04
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64321d192f8e3e8a7e5b4e5c
tags:
    - attack.execution
    - attack.t1203
    - attack.supply_chain
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\python.exe'
            - '\pip.exe'
        Image|endswith:
            - '\msbuild.exe'
        CommandLine|contains:
            - 'telnyx'
    condition: selection
falsepositives:
    - Legitimate developer builds using Python scripts
level: high

---
title: Suspicious Node.js Browser Data Access - LofyStealer
id: b1c2d3e4-f5a6-4789-b012-345678901bcd
description: Detects Node.js processes accessing browser cookie or history databases, indicative of infostealers like LofyStealer.
status: experimental
date: 2026/05/04
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64321d192f8e3e8a7e5b4e5d
tags:
    - attack.credential_access
    - attack.t1005
logsource:
    category: file_access
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        TargetFilename|contains:
            - '\Google\Chrome\User Data\Default\Cookies'
            - '\Google\Chrome\User Data\Default\History'
            - '\Mozilla\Firefox\Profiles'
    condition: selection
falsepositives:
    - Legitimate web development testing
level: high

---
title: DNS Query for Typosquatted Security Domain - TeamPCP C2
id: c2d3e4f5-a6b7-4789-c012-345678901cde
description: Detects DNS queries for 'aquasecurtiy.org', a known C2 domain used in TeamPCP campaigns targeting developer environments.
status: experimental
date: 2026/05/04
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64321d192f8e3e8a7e5b4e5c
tags:
    - attack.command_and_control
    - attack.1071
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|contains: 'aquasecurtiy.org'
    condition: selection
falsepositives:
    - None (Typosquat)
level: critical

// Hunt for TeamPCP and LofyStealer Network/Process Activity
// 1. Network Connections to known malicious domains/IPs
DeviceNetworkEvents
| where RemoteUrl in ("aquasecurtiy.org", "retreaw.click", "bruggebogeyed.site", "raw.icp0.io") or RemoteIP == "24.152.36.241"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| extend IOCTag = "Known_Malicious_Domain_IP"

// 2. Process Creation Anomalies (Python spawning MsBuild, Node accessing sensitive files)
DeviceProcessEvents
| where (InitiatingProcessFileName =~ "python.exe" and FileName =~ "msbuild.exe") or 
        (InitiatingProcessFileName =~ "node.exe" and FileName has "powershell.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| extend IOCTag = "Suspicious_Process_Chain"

// 3. File Hash Hunt
DeviceFileEvents
| where SHA256 in ("6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a", "8395c3268d5c5dbae1c7c6d4bb3c318c752ba4608cfcd90eb97ffb94a910eac2", "d2a0d5f564628773b6af7b9c11f6b86531a875bd2d186d7081ab62748a800ebb", "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881", "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256
| extend IOCTag = "Malicious_File_Hash"

# IOC Hunt Script for TeamPCP, LofyStealer, and GhostSocks
# Requires Admin privileges

# 1. Define Malicious Hashes (SHA256)
$MaliciousHashes = @(
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a",
    "8395c3268d5c5dbae1c7c6d4bb3c318c752ba4608cfcd90eb97ffb94a910eac2",
    "d2a0d5f564628773b6af7b9c11f6b86531a875bd2d186d7081ab62748a800ebb",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881",
    "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7"
)

Write-Host "[+] Scanning for malicious file hashes..."

# Get-ChildItem on C: (Optimized for common load points)
$Paths = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp")

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | Where-Object { $MaliciousHashes -contains $_.Hash } | ForEach-Object {
            Write-Host "[!] ALERT: Malicious file found: $($_.Path)" -ForegroundColor Red
        }
    }
}

# 2. Check for Suspicious DNS Cache Entries (TeamPCP C2)
Write-Host "[+] Checking DNS Cache for malicious domains..."
$BadDomains = @("aquasecurtiy.org", "retreaw.click", "bruggebogeyed.site")
$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue

if ($DnsCache) {
    foreach ($Domain in $BadDomains) {
        $Matches = $DnsCache | Where-Object { $_.Entry -like "*$Domain*" }
        if ($Matches) {
            Write-Host "[!] ALERT: Suspicious DNS entry found for: $Domain" -ForegroundColor Red
        }
    }
}

# 3. Check for Python/Pip spawning MsBuild (Requires Log Analysis usually, but checking for recent processes)
Write-Host "[+] Checking for suspicious process relationships..."
$MsBuild = Get-WmiObject Win32_Process -Filter "Name='msbuild.exe'"
if ($MsBuild) {
    foreach ($Proc in $MsBuild) {
        $Parent = Get-WmiObject Win32_Process -Filter "ProcessId = $($Proc.ParentProcessId)"
        if ($Parent.Name -eq "python.exe") {
            Write-Host "[!] ALERT: MsBuild spawned by Python: PID $($Proc.ProcessId)" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Hunt complete."