XCSSET v40 Supply Chain Surge + SakDriver Kernel Rootkit + Teams Help Desk Intrusion: OTX Detection Pack

---
title: XCSSET v40 C2 Domain Resolution
description: Detects DNS resolution of XCSSET v40 command-and-control domains impersonating Apple/CDN infrastructure
status: experimental
logsource:
    category: dns
author: Security Arsenal Threat Intel
date: 2026/09/02
references:
    - https://unit42.paloaltonetworks.com/xcsset-v40-malware-analysis/
detection:
    selection:
        query:
            - bulksec.ru
            - figmacat.ru
            - windsecure.ru
            - applecdn.ru
            - cdnroute.ru
            - checkcdn.ru
            - accapple.ru
    condition: selection
level: high
tags:
    - attack.command_and_control
    - attack.t1071
    - xcsset
falsepositives:
    - Unlikely - typosquatted CDN/Apple-themed .ru domains
---
title: ETW Patching via Suspicious EtwEventWrite Modification
description: Detects in-memory patching of Event Tracing for Windows functions consistent with SakDriver kernel rootkit telemetry blinding
status: experimental
logsource:
    category: process_creation
    product: windows
author: Security Arsenal Threat Intel
date: 2026/09/02
references:
    - https://core-jmp.org/2026/07/sakdriver-reversing-kernel-driver-rootkit/
detection:
    selection_cmdline:
        CommandLine|contains:
            - 'EtwEventWrite'
            - 'NtTraceEvent'
            - 'patch etw'
            - 'etw patch'
    selection_driver:
        Image|endswith: '\\powershell.exe'
        CommandLine|contains:
            - 'EtwEventProvider'
            - '-etw'
    condition: 1 of selection_*
level: high
tags:
    - attack.defense_evasion
    - attack.t1562.001
    - kernel_rootkit
falsepositives:
    - Rare - legitimate tooling does not patch ETW
---
title: Suspicious Registry Run Key or Driver Service Creation by Scripting Host
description: Detects script-based registration of kernel driver services or registry callback persistence consistent with SakDriver registry-callback C2
status: experimental
logsource:
    category: registry_event
    product: windows
author: Security Arsenal Threat Intel
date: 2026/09/02
detection:
    selection_driver_service:
        TargetObject|contains: '\\Services\\'
        TargetObject|contains: '\\ImagePath'
        Details|contains:
            - '\\Temp\\'
            - '\\AppData\\'
            - '\\ProgramData\\'
    selection_suspicious_parent:
        Image|endswith:
            - '\\wscript.exe'
            - '\\cscript.exe'
            - '\\powershell.exe'
            - '\\mshta.exe'
    condition: all of selection_*
level: high
tags:
    - attack.persistence
    - attack.t1543.003
    - attack.t1014
falsepositives:
    - Legitimate software installs writing service entries from scripted installers

// Hunt: Teams help desk intrusion C2 + XCSSET domain beaconing + driver load anomalies
let TeamsC2 = dynamic(["5.181.3.106","178.130.47.46","80.66.72.215","185.155.99.161","45.8.157.185","2.56.172.214","185.234.67.53","136.0.20.6"]);
let XcsC2 = dynamic(["bulksec.ru","figmacat.ru","windsecure.ru","applecdn.ru","cdnroute.ru","checkcdn.ru","accapple.ru"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (TeamsC2)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType
| extend Hunt = "Teams Intrusion C2"),
(DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (XcsC2)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| extend Hunt = "XCSSET v40 C2"),
(DeviceEvents
| where TimeGenerated > ago(30d)
| where ActionType == "DriverLoad" or (ActionType == "ServiceInstalled" and FileName endswith ".sys")
| where SHA256 == "4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d"
    or SHA1 == "7440358c5041eba34e8673100989df756a6426da"
    or MD5 == "b5f122f3f07f618c0a7678fa40801faa"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName
| extend Hunt = "SakDriver Hash Match")
| order by TimeGenerated desc

# SakDriver + XCSSET Enterprise IOC Hunt
# Run elevated on Windows endpoints; section 2 is for macOS via bash below
Write-Host "=== [1] SakDriver kernel driver artifacts ===" -ForegroundColor Cyan
$targetHashes = @{
    'SHA256' = '4e95aba17c1a423cda5cc9f9f04f7cf8db17e294eb31ed1aa85063601b82fe8d'
    'SHA1'   = '7440358c5041eba34e8673100989df756a6426da'
    'MD5'    = 'b5f122f3f07f618c0a7678fa40801faa'
}
Get-ChildItem "$env:SystemRoot\System32\drivers","$env:ProgramData","$env:TEMP" -Recurse -Filter *.sys -ErrorAction SilentlyContinue | ForEach-Object {
    $h = Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
    if ($h.Hash -eq $targetHashes['SHA256']) { Write-Host "[HIT] SakDriver: $($_.FullName)" -ForegroundColor Red }
}

Write-Host "=== [2] Suspicious driver services with non-system paths ===" -ForegroundColor Cyan
Get-CimInstance Win32_SystemDriver | Where-Object {
    $_.PathName -match 'Temp|AppData|ProgramData|Users\\Public'
} | Select-Object Name, State, StartMode, PathName

Write-Host "=== [3] Registry callback persistence - service ImagePath anomalies ===" -ForegroundColor Cyan
Get-ChildItem 'HKLM:\SYSTEM\CurrentControlSet\Services' -ErrorAction SilentlyContinue | ForEach-Object {
    $ip = (Get-ItemProperty $_.PSPath -Name ImagePath -ErrorAction SilentlyContinue).ImagePath
    if ($ip -and $ip -notmatch 'system32|SysWow64|Program Files') {
        Write-Host "[SUSPICIOUS] $($_.PSChildName) -> $ip" -ForegroundColor Yellow
    }
}

Write-Host "=== [4] Active connections to Teams-intrusion C2 ===" -ForegroundColor Cyan
$c2 = @('5.181.3.106','178.130.47.46','80.66.72.215','185.155.99.161','45.8.157.185','2.56.172.214','185.234.67.53','136.0.20.6')
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $c2 -contains $_.RemoteAddress } |
    Select-Object LocalPort, RemoteAddress, RemotePort, State, OwningProcess

Write-Host "=== [5] ETW provider tamper check (Sysmon provider present?) ===" -ForegroundColor Cyan
$etw = logman query providers | Select-String -Pattern 'Microsoft-Windows-Sysmon'
if (-not $etw) { Write-Host "[WARN] Sysmon ETW provider missing or patched" -ForegroundColor Red }

Write-Host "=== [6] macOS fleet (run via MDM/bash): XCSSET artifacts ===" -ForegroundColor Cyan
# bash equivalent for macOS endpoints:
# for d in bulksec.ru figmacat.ru windsecure.ru applecdn.ru cdnroute.ru checkcdn.ru accapple.ru; do
#   log show --last 30d --predicate 'eventMessage CONTAINS "$d"' 2>/dev/null | head -5
done
# ls -la ~/Library/LaunchAgents/ | grep -iv apple
# shasum -a 1 /Applications/*.app/Contents/MacOS/* 2>/dev/null | grep 6e480d648fa1b70612f5d198a66875e28847547d