TencShell/Vshell AI-Assisted Intrusions + Project CAV3RN Google Apps Script C2: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Webshell Process Spawn from Web Server - TencShell/Vshell/Gshell Campaign
description: Detects command shell or scripting engine spawned by web server processes, consistent with Vshell/Gshell webshell activity observed in the AI-assisted government intrusion campaign
date: 2026/08/13
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
    service: security-auditing
detection:
    selection_parent:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
            - '\tomcat.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cscript.exe'
            - '\wscript.exe'
            - '\certutil.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate web application deployment scripts (rare in production)
level: high
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.t1059
---
title: Project CAV3RN - Suspicious Outbound to Google Apps Script from Non-Browser Process
description: Detects non-browser processes establishing connections to Google Apps Script endpoints, matching CAV3RN's abuse of Google Apps Script as a C2 relay
date: 2026/08/13
author: Security Arsenal Threat Intel
logsource:
    category: network_connection
    product: windows
detection:
    selection_dest:
        DestinationHostname|endswith:
            - 'script.google.com'
            - 'script.googleusercontent.com'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\iexplore.exe'
            - '\brave.exe'
    condition: selection_dest and not filter_browsers
falsepositives:
    - Enterprise automation legitimately calling Apps Script webhooks (allowlist by process hash and signing cert)
level: high
tags:
    - attack.command_and_control
    - attack.t1102
    - attack.t1071.001
---
title: CAV3RN DNS Channel Selection - High Volume TXT/A Query Pattern from Single Process
description: Detects processes generating abnormally high DNS query volume consistent with CAV3RN's DNS A-record based C2 channel negotiation and DNS tunneling behavior
date: 2026/08/13
author: Security Arsenal Threat Intel
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|contains:
            - 'studiotikva.com'
    condition: selection
falsepositives:
    - None expected - IOC-matched queries indicate compromise
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.004

// Project CAV3RN + TencShell Campaign Hunt — Microsoft Sentinel
// Hunts: C2 infrastructure hits, Apps Script abuse from non-browsers, webshell process chains
let cav3rn_ips = dynamic(["12.19.29.30", "12.121.234.120"]);
let cav3rn_hosts = dynamic(["studiotikva.com", "api.studiotikva.com", "ns1.studiotikva.com", "ns2.studiotikva.com"]);
let scriptHosts = dynamic(["script.google.com", "script.googleusercontent.com"]);
let browsers = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "iexplore.exe", "brave.exe"]);
union isfuzzy=true
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteIP in (cav3rn_ips)
       or RemoteUrl has_any (cav3rn_hosts)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
    | extend HuntReason = "CAV3RN direct C2 infrastructure"
),
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (scriptHosts)
    | where not(InitiatingProcessFileName has_any (browsers))
    | summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
        by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl
    | extend HuntReason = "Non-browser process to Google Apps Script (CAV3RN relay pattern)"
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName in~ ("w3wp.exe", "httpd.exe", "nginx.exe", "tomcat.exe")
    | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "cscript.exe", "wscript.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
    | extend HuntReason = "Webshell child process (Vshell/Gshell/TencShell pattern)"
)
| order by TimeGenerated desc

# Security Arsenal — CAV3RN & TencShell/Vshell IOC Hunt Script
# Run elevated on suspected endpoints or deploy via your EDR/Intune
$report = @()

# --- 1. Network connections to CAV3RN infrastructure ---
$c2Targets = @("12.19.29.30","12.121.234.120","studiotikva.com","api.studiotikva.com","ns1.studiotikva.com","ns2.studiotikva.com")
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.State -eq "Established" }
foreach ($c in $conns) {
    if ($c2Targets -contains $c.RemoteAddress) {
        $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
        $report += [pscustomobject]@{Check="C2 Connection"; Finding="$($proc.ProcessName) (PID $($c.OwningProcess)) -> $($c.RemoteAddress):$($c.RemotePort)"; Severity="CRITICAL"}
    }
}

# --- 2. DNS cache check for CAV3RN / Apps Script beaconing ---
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($entry in $dns) {
    if ($entry.Entry -match "studiotikva|script\.google\.com|script\.googleusercontent\.com") {
        $report += [pscustomobject]@{Check="DNS Cache"; Finding="$($entry.Entry) -> $($entry.Data)"; Severity="HIGH"}
    }
}

# --- 3. CAV3RN module names on disk (masquerading DLLs) ---
$modules = @("GoogleService.dll","CommunicationUxTheme.dll","net.dll","rnp.dll","texture.dll")
$searchPaths = @("$env:ProgramData","$env:APPDATA","$env:TEMP","C:\Users\Public")
foreach ($p in $searchPaths) {
    foreach ($m in $modules) {
        $hits = Get-ChildItem -Path $p -Filter $m -Recurse -ErrorAction SilentlyContinue -Force
        foreach ($h in $hits) {
            $report += [pscustomobject]@{Check="Malicious Module"; Finding="$($h.FullName)"; Severity="CRITICAL"}
        }
    }
}

# --- 4. Persistence artifacts referencing suspicious DLLs ---
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
    if (Test-Path $k) {
        (Get-ItemProperty $k).PSObject.Properties | Where-Object { $_.Value -match "GoogleService|CommunicationUxTheme|rundll32.*AppData|ProgramData" } | ForEach-Object {
            $report += [pscustomobject]@{Check="Run Key Persistence"; Finding="$k :: $($_.Name) = $($_.Value)"; Severity="HIGH"}
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { ($_.Actions.Execute + $_.Actions.Arguments) -match "GoogleService|CommunicationUxTheme|rundll32" } | ForEach-Object {
    $report += [pscustomobject]@{Check="Scheduled Task"; Finding="$($_.TaskName) :: $($_.Actions.Execute) $($_.Actions.Arguments)"; Severity="HIGH"}
}

# --- 5. Webshell artifacts in web roots (Vshell/Gshell/TencShell) ---
$webRoots = @("C:\inetpub\wwwroot","C:\xampp\htdocs")
$shellPatterns = "eval\(|System\(\)|passthru|shell_exec|FromBase64String|IEX|Invoke-Expression"
foreach ($root in $webRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Include *.aspx,*.asp,*.php,*.jsp,*.ashx -ErrorAction SilentlyContinue | ForEach-Object {
            if ((Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue) -match $shellPatterns) {
                $report += [pscustomobject]@{Check="Webshell Pattern"; Finding="$($_.FullName)"; Severity="CRITICAL"}
            }
        }
    }
}

if ($report.Count -eq 0) { Write-Output "[CLEAN] No CAV3RN/TencShell indicators found on $env:COMPUTERNAME" }
else { $report | Sort-Object Severity | Format-Table -AutoSize; $report | Export-Csv -Path "C:\ioc-hunt-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmm').csv" -NoTypeInformation }