Turla's Kazuar P2P Backdoor: Detection and Eradication of a Mesh Command Network

---
title: Potential Kazuar P2P Mesh Activity - Process Listening and Connecting
id: 8f4a9b1c-6d2e-4a5f-9b0c-1d2e3f4a5b6c
status: experimental
description: Detects processes that are simultaneously establishing outbound connections and listening on non-standard ports, indicative of P2P malware like Kazuar.
references:
 - https://thehackernews.com/2026/05/turla-turns-kazuar-backdoor-into.html
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
 category: network_connection
 product: windows
detection:
 selection:
 Initiated: true
 DestinationPort|notin:
   - 80
   - 443
   - 8080
   - 53
 filter:
 Image|contains:
   - '\System32\'
   - '\Program Files\'
   - '\Program Files (x86)\'
 condition: selection and not filter
falsepositives:
  - Legitimate P2P applications (e.g. BitTorrent)
  - Authorized collaboration tools
level: high
---
title: Kazuar Persistence via Registry Run Keys
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious .NET executables or unsigned binaries establishing persistence in user Run keys, a common TTP for Kazuar.
references:
 - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.persistence
 - attack.t1547.001
logsource:
 category: registry_set
 product: windows
detection:
 selection:
 TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Run'
 Details|contains:
   - '.exe'
 filter_legit_paths:
 Details|contains:
   - 'Program Files'
   - 'AppData\Local\Microsoft\OneDrive'
   - 'AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'
 condition: selection and not filter_legit_paths
falsepositives:
  - Legitimate software auto-starters
level: medium
---
title: Suspicious .NET Runtime Loading via LOLBins
id: 9e8f7a6b-5c4d-3e2f-1a0b-9c8d7e6f5a4b
status: experimental
description: Detects execution of .NET assemblies using LOLBins like regsvcs or regasm, often used to load Kazuar memory-only modules.
references:
 - https://thehackernews.com/2026/05/turla-turns-kazuar-backdoor-into.html
author: Security Arsenal
date: 2026/05/15
tags:
 - attack.defense_evasion
 - attack.t1218.009
logsource:
 category: process_creation
 product: windows
detection:
 selection_img:
   Image|endswith:
     - '\regsvcs.exe'
     - '\regasm.exe'
     - '\installutil.exe'
     - '\msbuild.exe'
 selection_cli:
   CommandLine|contains:
     - '.dll'
     - '/u' # Uninstall switch sometimes abused
 condition: selection_img and selection_cli
falsepositives:
  - Developer activity
  - Software installation
level: high

let TimeRange = 1d;
let HighPorts = dynamic([1024, 65535]);
DeviceNetworkEvents
| where Timestamp > ago(TimeRange)
| where InitiatingProcessVersionInfoCompanyName != "Microsoft Corporation" 
   or InitiatingProcessVersionInfoCompanyName == ""
| where RemotePort between(HighPorts[0] .. HighPorts[1])
| summarize P2P_Score = dcount(RemoteIP), ConnectionCount = count() by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath
| where P2P_Score > 5 and ConnectionCount > 10
| project DeviceName, Process = InitiatingProcessFileName, Path = InitiatingProcessFolderPath, P2P_Score, ConnectionCount
| order by P2P_Score desc

-- Hunt for processes listening on non-standard high ports
LET ListeningProcesses = SELECT
   Pid, Name, Exe, Username
FROM listen_sockets()
WHERE Port > 1024
   AND Family = "AF_INET"
   AND NOT Name =~ "svchost.exe"
   AND NOT Name =~ "lsass.exe"
   AND NOT Name =~ "services.exe"
   AND NOT Exe =~ "C:\\Windows\\System32\\";

-- Correlate with processes making outbound connections
LET P2PCandidates = SELECT
   P.Pid, P.Name, P.Exe, P.Username
FROM foreach(row=ListeningProcesses)
   JOIN process_network_connections(on=Pid)
WHERE RemotePort > 1024
   AND RemoteAddress != "127.0.0.1"
   AND RemoteAddress NOT IN ("::1");

-- Scan AppData for unsigned executables often dropped by Kazuar
LET SuspiciousFiles = SELECT
   FullPath, Mtime, Atime, Size
FROM glob(globs="C:\\Users\\*\\AppData\\Roaming\\*.exe")
WHERE Mtime < now() - 24h
   AND NOT FullPath =~ "Microsoft";

SELECT P.Pid, P.Name, P.Exe, P.Username, S.FullPath as SuspiciousDrop
FROM P2PCandidates AS P
LEFT JOIN SuspiciousFiles AS S ON P.Username = S.FullPath
GROUP BY P.Pid, P.Name, P.Exe, P.Username, SuspiciousDrop

# Identify processes listening on high ports (>1024) not signed by Microsoft or trusted vendors
$suspiciousProcesses = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | 
    Where-Object { $_.LocalPort -gt 1024 } | 
    Get-Process -ErrorAction SilentlyContinue | 
    Where-Object { 
        $_.Path -and 
        ($_.Path -notlike "*Windows\System32*" -and $_.Path -notlike "*Program Files*")
    }

if ($suspiciousProcesses) {
    Write-Host "[!] Identified potential P2P mesh nodes. Terminating suspicious listeners:" -ForegroundColor Red
    foreach ($proc in $suspiciousProcesses) {
        Write-Host "Stopping PID: $($proc.Id) - Path: $($proc.Path)"
        Stop-Process -Id $proc.Id -Force
    }
} else {
    Write-Host "[+] No obvious high-port listeners in non-standard paths found." -ForegroundColor Green
}

# Check for Suspicious Registry Persistence in HKCU Run Keys
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Write-Host "[+] Checking $key for suspicious executables..."
        Get-Item -Path $key | Select-Object -ExpandProperty Property | ForEach-Object {
            $propVal = (Get-ItemProperty -Path $key -Name $_).$_
            if ($propVal -match ".exe" -and $propVal -notmatch "Program Files" -and $propVal -notmatch "Windows") {
                Write-Host "[!] Suspicious persistence found: $_ = $propVal" -ForegroundColor Yellow
                # Optional: Remove-ItemProperty -Path $key -Name $_ -Force
            }
        }
    }
}