The Gentlemen Ransomware Group — TukTuk C2 v2.0 Framework & EDRKiller BYOVD Toolkit: OTX Pulse Analysis + Enterprise Detection Pack

---
title: The Gentlemen BYOVD - Vulnerable Driver Load (GentleKiller / EDRKiller)
id: 8f3a1c2e-7b41-4e9a-b6d2-tuktuk000001
description: Detects loading of known vulnerable or Gentlemen-associated kernel drivers including eb.sys used by GentleKiller/EDRKiller for EDR neutralization
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
    category: driver_load
    product: windows
detection:
    selection_filename:
        ImageLoaded|endswith:
            - '\eb.sys'
            - '\gentlekiller.sys'
            - '\edrkiller.sys'
            - '\warsawkiller.sys'
    selection_hash:
        Hashes|contains:
            - '97bd65e98cdc4e93d49edd4ea905d43a61244df0fd3323e6649330de3b1be091'
            - 'e2b31ac7ee077b26332444a83a68ab75be641113e7d86979d844a0f3478f01f9'
            - 'e74088419de2e5b47b1889f2ba1369cb4b436405ce03cf07da452791681f9923'
            - '096ec37870eb401793592c9b53b5b52fc7a70b113bc2d9cd3f53231142d6c584'
    condition: selection_filename or selection_hash
falsepositives:
    - Legitimate signed drivers being abused (BYOVD) - investigate any match as high severity
level: critical
tags:
    - attack.defense_evasion
    - attack.t1068
    - attack.t1562.001
date: 2026/09/04
---
title: The Gentlemen TukTuk C2 - Agent Beacon to Known C2 Domain
id: 8f3a1c2e-7b41-4e9a-b6d2-tuktuk000002
description: Detects DNS resolution or network connection to confirmed TukTuk C2 v2.0 infrastructure domain
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'borjumaniya.store'
    condition: selection
falsepositives:
    - Threat research activity
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
date: 2026/09/04
---
title: The Gentlemen - Greenshot Surveillance and Service-Based Driver Install
id: 8f3a1c2e-7b41-4e9a-b6d2-tuktuk000003
description: Detects suspicious execution of Greenshot for screen-capture surveillance or sc.exe service creation for driver staging consistent with The Gentlemen tradecraft
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_greenshot:
        Image|endswith: '\greenshot.exe'
        ParentImage|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\rundll32.exe'
    selection_scdriver:
        Image|endswith: '\sc.exe'
        CommandLine|contains|all:
            - 'create'
            - 'type= kernel'
    condition: selection_greenshot or selection_scdriver
falsepositives:
    - Greenshot legitimately deployed by IT (filter by software inventory)
    - Administrative driver installation during maintenance windows
level: high
tags:
    - attack.collection
    - attack.t1113
    - attack.persistence
    - attack.t1543.003
date: 2026/09/04

// The Gentlemen - TukTuk C2 & BYOVD Hunt (Microsoft Sentinel)
// Part 1: Network connections / DNS to confirmed TukTuk C2 infrastructure
let C2Domain = "borjumaniya.store";
let KnownHashes = dynamic([
    "97bd65e98cdc4e93d49edd4ea905d43a61244df0fd3323e6649330de3b1be091",
    "e2b31ac7ee077b26332444a83a68ab75be641113e7d86979d844a0f3478f01f9",
    "e74088419de2e5b47b1889f2ba1369cb4b436405ce03cf07da452791681f9923",
    "096ec37870eb401793592c9b53b5b52fc7a70b113bc2d9cd3f53231142d6c584"
]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has C2Domain or RemoteUrl endswith ".store"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let DnsHits = DeviceEvents
| where TimeGenerated > ago(30d)
| where ActionType == "DnsQueryResponse"
| where AdditionalFields has C2Domain
| project TimeGenerated, DeviceName, ActionType, AdditionalFields;
// Part 2: BYOVD driver load or hash match
let DriverHits = DeviceEvents
| where TimeGenerated > ago(30d)
| where ActionType == "DriverLoad"
| where FileName has_any ("eb.sys", "gentlekiller", "edrkiller", "warsawkiller")
    or SHA256 in~ (KnownHashes)
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName;
// Part 3: Kernel service creation (driver staging) by non-admin tooling
let SvcHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "sc.exe"
| where ProcessCommandLine has_all ("create", "kernel")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName;
NetHits
| union DnsHits, DriverHits, SvcHits
| sort by TimeGenerated desc

# The Gentlemen - TukTuk C2 / GentleKiller BYOVD Hunt Script
# Run elevated on endpoints or via your RMM/EDR remote shell

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# --- 1. Hash sweep for known GentleKiller / TukTuk artifacts ---
$targetHashes = @(
    '97bd65e98cdc4e93d49edd4ea905d43a61244df0fd3323e6649330de3b1be091',
    'e2b31ac7ee077b26332444a83a68ab75be641113e7d86979d844a0f3478f01f9',
    'e74088419de2e5b47b1889f2ba1369cb4b436405ce03cf07da452791681f9923',
    '096ec37870eb401793592c9b53b5b52fc7a70b113bc2d9cd3f53231142d6c584'
)

$scanPaths = @("$env:SystemRoot\System32\drivers", "$env:TEMP", "$env:ProgramData", "$env:SystemRoot\Temp")
foreach ($path in $scanPaths) {
    Get-ChildItem -Path $path -Recurse -File -Include *.sys,*.exe,*.dll | ForEach-Object {
        $h = (Get-FileHash -Algorithm SHA256 $_.FullName).Hash.ToLower()
        if ($targetHashes -contains $h) {
            $findings += [PSCustomObject]@{ Type='HashMatch'; Path=$_.FullName; Hash=$h }
        }
    }
}

# --- 2. Check for suspicious kernel drivers (eb.sys and Killer-family) ---
Get-ChildItem "$env:SystemRoot\System32\drivers" -Filter *.sys |
    Where-Object { $_.Name -match '^(eb|gentlekiller|edrkiller|warsawkiller|unknownkiller)' } |
    ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        $findings += [PSCustomObject]@{ Type='SuspiciousDriver'; Path=$_.FullName; Hash=(Get-FileHash $_.FullName).Hash; Signature=$sig.Status }
    }

# --- 3. Registry: kernel service entries created recently (driver staging) ---
Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Services' | ForEach-Object {
    $p = Get-ItemProperty $_.PsPath
    if ($p.Type -eq 1 -and $p.ImagePath -match 'eb\.sys|killer') {
        $findings += [PSCustomObject]@{ Type='KernelServiceReg'; Path=$_.Name; Hash=$p.ImagePath }
    }
}

# --- 4. Network: active connections or DNS cache hits for TukTuk C2 ---
$dnsHits = Get-DnsClientCache | Where-Object { $_.Entry -match 'borjumaniya\.store' }
foreach ($d in $dnsHits) {
    $findings += [PSCustomObject]@{ Type='DNSCacheHit'; Path=$d.Entry; Hash=$d.Data }
}
Get-NetTCPConnection -State Established | Where-Object {
    (Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost -match 'borjumaniya\.store'
} | ForEach-Object {
    $findings += [PSCustomObject]@{ Type='C2Connection'; Path="$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort)"; Hash=(Get-Process -Id $_.OwningProcess).Path }
}

# --- 5. Greenshot surveillance artifacts ---
$greenshot = Get-Process greenshot -ErrorAction SilentlyContinue
if ($greenshot) {
    $findings += [PSCustomObject]@{ Type='GreenshotRunning'; Path=$greenshot.Path; Hash=(Get-FileHash $greenshot.Path).Hash }
}

$findings | Format-Table -AutoSize
if ($findings.Count -gt 0) {
    Write-Host "[!] $($findings.Count) indicator(s) found - escalate to IR immediately" -ForegroundColor Red
    $findings | Export-Csv ".\tuktuk_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
} else {
    Write-Host "[+] No TukTuk/GentleKiller indicators found on $env:COMPUTERNAME" -ForegroundColor Green
}