Watch Where You Drink: APT TA423 Deploys ScanBox in Stealthy Watering Hole Attacks

title: Potential Watering Hole Reconnaissance Activity via Static Directories
id: 7a3c9d12-55b4-4c9a-9e1f-8d2e4a6b7c0d
status: experimental
description: |
    Detects suspicious POST requests to static resource directories (e.g., /images/, /css/, /fonts/). 
    Watering hole attacks utilizing frameworks like ScanBox often masquerade C2 or reconnaissance 
    data exfiltration as legitimate traffic to these static paths to avoid detection.
references:
    - https://attack.mitre.org/techniques/T1071/001/
    - Internal Research on ScanBox Framework
author: Security Arsenal
date: 2026/04/06
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: webserver
detection:
    selection:
        verb|startswith: 'POST'
        cs-uri-stem|contains:
            - '/images/'
            - '/img/'
            - '/css/'
            - '/fonts/'
            - '/assets/'
    condition: selection
falsepositives:
    - Legitimate misconfigured web applications posting data to static directories
    - Specific CMS plugins using non-standard locations
level: medium
---
title: Suspicious Process Spawned by Web Browser
id: 8f4b1e23-66c5-4d8b-0a2g-9e3f5b7c8d9e
status: experimental
description: |
    Detects a shell or script interpreter spawned directly by a web browser process. 
    This behavior is highly indicative of a successful drive-by download or exploit chain 
    initiated via a watering hole attack, where the browser is compromised to execute code.
references:
    - https://attack.mitre.org/techniques/T1203/
    - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/04/06
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1203
    - attack.t1059.001
logsource:
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\iexplore.exe'
            - '\opera.exe'
            - '\brave.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate browser extensions launching local utilities (rare)
    - User-initiated downloads of scripts that execute immediately (possible but less likely to spawn directly from browser process)
level: high

// Hunt for APT TA423 ScanBox / Watering Hole Activity
// Detects browsers connecting to low-prevalence domains with high-entropy URL paths, which is characteristic 
// of the ScanBox reconnaissance framework beaconing or data exfiltration after a user visits a compromised site.
DeviceNetworkEvents
| where Timestamp > ago(3d)
| where InitiatingProcessFileName in~ ('chrome.exe', 'msedge.exe', 'firefox.exe', 'iexplore.exe')
| where RemotePort in (80, 443)
| where ActionType in ("ConnectionSuccess", "ConnectionInitiated")
// Exclude standard high-volume CDNs and trusted domains to reduce false positives
| where RemoteUrl !matches regex @"(microsoft|office|google|facebook|apple|amazon|linkedin|cloudflare|akamai|yahoo|bing|doubleclick)\.(com|net|org)"
// Extract the URL path to analyze complexity (ScanBox beacons often have randomized query parameters)
| extend UrlPath = extract(@"(https?://[^/]+)(/.*)", 2, RequestURL)
| where isnotempty(UrlPath)
// Heuristic: Identify suspicious beaconing by looking for long, random strings in the URL path
| where strlen(UrlPath) > 25 and UrlPath matches regex @"/[a-zA-Z0-9_-]{25,}"
| summarize 
    ConnectionCount = count(), 
    UniqueDevices = dcount(DeviceName),
    FirstSeen = min(Timestamp),
    LastSeen = max(Timestamp) 
    by RemoteUrl, InitiatingProcessFileName
// Watering hole attacks are targeted; filter for infrastructure accessed by few devices in the org
| where UniqueDevices < 5
| order by UniqueDevices asc, ConnectionCount desc

name: TA423.ScanBox.Hunt
description: |
  Hunts for indicators associated with the TA423 APT group utilizing the 
  ScanBox reconnaissance framework via watering hole attacks. Focuses on 
  JavaScript artifacts in browser caches, network connections from browsers, 
  and suspicious process execution chains.

sources:
- name: Browser Cache JS Files
  description: |
    ScanBox is a JavaScript-based framework. This query hunts for .js files 
    stored in the cache directories of common browsers (Chrome, Edge, Firefox) 
    which may contain the reconnaissance payload.
  query: |
    -- Scan browser caches for JavaScript files
    SELECT FullPath, Size, Mtime, Atime
    FROM glob(globs=[
      ''/Users/*/AppData/Local/Google/Chrome/User Data/*/Cache/**/*'',
      ''/Users/*/AppData/Local/Google/Chrome/User Data/Default/Cache/**/*'',
      ''/Users/*/AppData/Local/Microsoft/Edge/User Data/*/Cache/**/*'',
      ''/Users/*/AppData/Local/Mozilla/Firefox/Profiles/**/cache2/entries/**/*''
    ])
    WHERE FullPath =~ '\.js$'

- name: Browser Network Connections
  description: |
    Identifies active network connections initiated by web browsers. 
    Watering hole attacks require the victim to connect to the compromised 
    server, so these sockets represent potential contact with the ScanBox C2.
  query: |
    -- Identify remote connections from common browser processes
    SELECT Pid, RemoteAddr, RemotePort, State, Name, Username
    FROM netstat()
    WHERE Name =~ '(chrome|msedge|firefox|iexplore)\.exe'

- name: Suspicious Browser Process Spawns
  description: |
    Hunts for suspicious processes (shells, scripts) spawned by browser processes. 
    While ScanBox primarily lives in the browser, initial access or follow-on 
    activity often involves the browser spawning a child process.
  query: |
    -- Look for shells or automation tools spawned by browsers
    SELECT Child.Name, Child.Pid, Child.Ppid, Child.CommandLine, 
           lookupSID(sid=Child.Uid).Name as User
    FROM pslist() AS Child
    WHERE Child.Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(chrome|msedge|firefox|iexplore)\.exe')
    AND Child.Name =~ '(powershell|cmd|wscript|cscript|rundll32)\.exe'

- name: Persistence Registry Keys
  description: |
    Checks for unusual persistence mechanisms often used by JS-based frameworks 
    to maintain access, specifically looking for Run keys pointing to scripts.
  query: |
    -- Hunt for Registry Run keys that might launch JS payloads
    SELECT Key, Value, Data, Mtime
    FROM read_reg_key(globs=[
      ''HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run/**'',
      ''HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run/**''
    ])
    WHERE Data =~ '\.js' OR Data =~ 'jscript'

# PowerShell Script to Detect and Harden against APT TA423 ScanBox Watering Hole Attacks
# Author: Senior Security Consultant
# Description: Hunts for JavaScript-based IOCs associated with ScanBox, verifies patch levels for common watering hole vectors, and hardens browser security zones.

# Define ScanBox specific indicators (Heuristic and IOCs)
# ScanBox is a modular JS framework often fingerprinting systems. 
# We look for common recon keywords in recent JS files.
$suspiciousJsKeywords = @(
    "navigator.plugins", 
    "navigator.userAgent", 
    "screen.colorDepth", 
    "canvas.fingerprint", 
    "WebGLRenderingContext", 
    "window.webkitRTCPeerConnection"
)

# Paths commonly used by watering hole attacks to drop payloads
$tempPaths = @(
    "$env:TEMP",
    "$env:LOCALAPPDATA\Microsoft\Windows\Temporary Internet Files",
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Cache",
    "$env:APPDATA\Mozilla\Firefox\Profiles"
)

Write-Host "[+] Initiating ScanBox IOC Hunt and Hardening..." -ForegroundColor Cyan

# 1. Hunt for suspicious JavaScript files in Temp/Cache directories
Write-Host "`n[*] Scanning for suspicious JavaScript artifacts in temporary directories..." -ForegroundColor Cyan

foreach ($path in $tempPaths) {
    if (Test-Path $path) {
        try {
            # Look for JS files modified in the last 7 days
            $jsFiles = Get-ChildItem -Path $path -Filter "*.js" -Recurse -ErrorAction SilentlyContinue | 
                       Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }

            foreach ($file in $jsFiles) {
                # Read file content to check for ScanBox fingerprinting logic
                $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
                
                if ($content) {
                    $matchesFound = 0
                    foreach ($keyword in $suspiciousJsKeywords) {
                        if ($content -match $keyword) {
                            $matchesFound++
                        }
                    }

                    # Threshold: If multiple fingerprinting calls exist, flag as potential ScanBox
                    if ($matchesFound -ge 3) {
                        Write-Host "[!] POTENTIAL THREAT DETECTED: $($file.FullName)" -ForegroundColor Red
                        Write-Host "    - Reason: Contains $($matchesFound) reconnaissance keywords." -ForegroundColor DarkYellow
                        Write-Host "    - Created: $($file.CreationTime)"
                    }
                }
            }
        }
        catch {
            # Ignore access errors for system folders
        }
    }
}

# 2. Check for Persistence Mechanisms
# While ScanBox is often transient in memory, some variants drop loaders.
Write-Host "`n[*] Checking Registry Run Keys for suspicious JS/Script loaders..." -ForegroundColor Cyan

$runKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty -Path $key -ErrorAction SilentlyContinue | ForEach-Object {
            $properties = $_.PSObject.Properties | Where-Object { $_.Name -notlike "PS*" }
            foreach ($prop in $properties) {
                $val = $prop.Value
                # Check for .js, .jse, or wscript executing web content
                if ($val -match "\.js" -or $val -match "wscript\.exe" -or $val -match "mshta\.exe") {
                    Write-Host "[!] Suspicious persistence entry found in $key" -ForegroundColor Yellow
                    Write-Host "    - Name: $($prop.Name)" -ForegroundColor Yellow
                    Write-Host "    - Value: $val" -ForegroundColor Yellow
                }
            }
        }
    }
}

# 3. Verify Patch Status for Common Watering Hole Vectors
# TA423 frequently exploits browser vulnerabilities (e.g., CVE-2021-40444, MSHTML) to deliver ScanBox.
Write-Host "`n[*] Verifying patch status for critical watering hole vulnerabilities..." -ForegroundColor Cyan

# Example: Check for MSHTML patches (CVE-2021-40444 / Sept 2021 patches and later)
# This is a simplified check; in production, compare against a specific KB list.
$osInfo = Get-CimInstance -ClassName Win32_OperatingSystem
$lastBootUpTime = $osInfo.LastBootUpTime
$hotfixes = Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date "2021-09-14") } | 
             Sort-Object InstalledOn -Descending | Select-Object -First 5

if ($hotfixes) {
    Write-Host "[+] System has recent security updates installed." -ForegroundColor Green
    $hotfixes | Format-Table HotFixID, InstalledOn -AutoSize
} else {
    Write-Host "[!] WARNING: System may lack critical patches for browser-based exploits (MSHTML/Edge)." -ForegroundColor Red
    Write-Host "    - TA423 watering holes rely on unpatched browser engines." -ForegroundColor Red
}

# 4. Hardening: Mitigate Watering Hole Attack Vectors
# Reduce attack surface by restricting Internet Zone scripting and ActiveX
Write-Host "`n[*] Hardening Internet Zone Settings to block script-based exploits..." -ForegroundColor Cyan

# Zone 3 = Internet Zone
$zonePath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"
$settingsToHarden = @{
    # 1400 = Active Scripting (3 = Disable)
    "1400" = 3; 
    # 1207 = Run ActiveX controls and plug-ins (3 = Disable)
    "1207" = 3; 
    # 1209 = Initialize and script ActiveX controls not marked as safe (3 = Disable)
    "1209" = 3
}

if (Test-Path $zonePath) {
    foreach ($setting in $settingsToHarden.GetEnumerator()) {
        try {
            $currentVal = (Get-ItemProperty -Path $zonePath -ErrorAction SilentlyContinue).$($setting.Name)
            if ($currentVal -ne $setting.Value) {
                Set-ItemProperty -Path $zonePath -Name $setting.Name -Value $setting.Value -Type DWord
                Write-Host "[+] Hardened setting $($setting.Name) to $($setting.Value) (Disabled)." -ForegroundColor Green
            } else {
                Write-Host "[-] Setting $($setting.Name) already hardened." -ForegroundColor Gray
            }
        }
        catch {
            Write-Host "[!] Failed to modify setting $($setting.Name)." -ForegroundColor Red
        }
    }
} else {
    Write-Host "[!] Internet Zone registry path not found." -ForegroundColor Red
}

Write-Host "`n[+] ScanBox IOC Hunt and Hardening Complete." -ForegroundColor Green