UAT-8616, Interlock & The Gentlemen: Cisco Edge Exploitation, Sliver C2, and PlasmaLoader OTX Pulse Analysis

title: Potential UAT-8616 Sliver C2 Implant Activity
id: 4c2f7b3d-1a9e-4b5c-9e8d-1f2a3b4c5d6e
description: Detects process execution and network patterns consistent with Sliver C2 framework, frequently used by UAT-8616 following webshell deployment.
status: experimental
date: 2026/05/20
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/...
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - \sliver.exe
            - \sliver-client.exe
    selection_cli:
        CommandLine|contains:
            - 'generate --mtls'
            - 'http-profile'
    selection_network:
        CommandLine|contains:
            - 'connect'
            - ' beacon'
    condition: 1 of selection_*
falsepositives:
    - Legitimate security testing or administrator usage of Sliver
level: high

---
title: Godzilla or Behinder Webshell File Creation
id: 5d3e8c4e-2b0f-5c6d-0f9e-2g3b4c5d6e7f
description: Detects the creation of files often associated with JSP/ASPX webshells like Godzilla or Behinder observed in UAT-8616 campaigns.
status: experimental
date: 2026/05/20
author: Security Arsenal
references:
    - https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: file_event
    product: windows
detection:
    selection_extension:
        TargetFilename|endswith:
            - '.jsp'
            - '.jspx'
            - '.asp'
            - '.aspx'
    selection_keywords:
        TargetFilename|contains:
            - 'shell.jsp'
            - 'behinder'
            - 'godzilla'
    condition: all of selection_*
falsepositives:
    - Legitimate application deployment (rarely uses these specific file names)
level: critical

---
title: SystemBC Proxy Installation - The Gentlemen
id: 6e4f9d5f-3c1g-6d7e-1g0f-3h4c5d6e7f8g
description: Detects installation or execution of SystemBC, a proxy tool used by The Gentlemen group to tunnel traffic after credential theft.
status: experimental
date: 2026/05/20
author: Security Arsenal
references:
    - https://research.checkpoint.com/2026/thus-spoke-the-gentlemen/
tags:
    - attack.command_and_control
    - attack.t1090.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - \systembc.exe
            - \sbclient.exe
    selection_cli:
        CommandLine|contains:
            - '-socks'
            - '-proxy'
            - '127.0.0.1:1080'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

// Hunt for Sliver C2 and SystemBC process execution
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessName has "sliver" 
   or ProcessName has "systembc"
   or ProcessCommandLine has "-mtls" 
   or ProcessCommandLine has "-socks"
| extend DeviceName = DeviceName, AccountName = InitiatingProcessAccountName
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

// Hunt for file hashes associated with The Gentlemen and UAT-8616
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in (
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235",
    "51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2"
)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256

# IOC Hunter for UAT-8616 and The Gentlemen Campaigns
# Scans file system for specific hashes and process anomalies.

$TargetHashes = @( 
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa", # UAT-8616 Payload
    "d75cb9920d1d3d280518ddccfe4789d2",
    "18821dbb53892d6faa14b1f063517a0302057290",
    "adf675ffc1acb357f2d9f1a94e016f52", # The Gentlemen Payloads
    "2cd15d5d4cc58d06cfb6be5eabc681925d0ce5ce",
    "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235",
    "51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2",
    "4200b46a93c6ab059e2b34ce200c4a5b"
)

Write-Host "[+] Hunting for specific file hashes associated with OTX Pulse activity..." -ForegroundColor Cyan

$DrivesToScan = @("C:\", "D:\")

foreach ($Drive in $DrivesToScan) {
    if (Test-Path $Drive) {
        Write-Host "Scanning $Drive..."
        Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | Where-Object { 
            !$_.PSIsContainer -and $_.Length -gt 0kb 
        } | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $Hash) {
                Write-Host "[!] ALERT: Malicious file found: $($_.FullName)" -ForegroundColor Red
                Write-Host "    Hash: $Hash"
            }
        }
    }
}

Write-Host "[+] Checking for active processes associated with Sliver or SystemBC..." -ForegroundColor Cyan
$MaliciousProcesses = @("sliver", "systembc", "sbclient", "xmrig", "kscan")
Get-Process | Where-Object { $MaliciousProcesses -contains $_.ProcessName.ToLower() } | ForEach-Object {
    Write-Host "[!] ALERT: Suspicious process running: $($_.ProcessName) (PID: $($_.Id))" -ForegroundColor Red
}

Write-Host "Scan complete."