JadeProx — TriBack Loader, AdaptixC2 and the Beagle Backdoor

Confidence high = named in two independent primary vendor reports. medium = one primary vendor. Action follows the confidence, not the drama: shared-hosting addresses never get a block action regardless of how good the intel is.

Do not block the host binaries. The Microsoft Service Hub CLR host, the G DATA updater and the Microsoft Malware Protection copy-accelerator utility are genuine signed vendor files. They are the sideloading vehicle, not the malware. Blocking their hashes breaks working products and does nothing to the loader, which will simply pick a fourth signed binary.

Proxy / web gateway

• Search request logs for the AdaptixC2 beacon URI set — POST /api/v1/status, /updates/check.php, /content.html — to any external host. Individually these are unremarkable; the same client hitting all three on a fixed interval is not.
• Filter on the beacon user-agent Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0. A 2012 Firefox build string in 2026 is a configuration artefact, not a browser.
• Look for an X-Beacon-Id request header. It is not a standard header and appears in the recovered AdaptixC2 HTTP profile.
• Alert on any newly registered domain matching update-*, download-*, patch-* or license-* concatenated with a security-vendor brand. Feed the pattern to your brand-monitoring and certificate-transparency watch.

DNS resolver

• Query resolver logs for the full campaign domain set in section 4 over the longest retention you hold. The staging infrastructure was live from roughly February to April 2026, so a 30-day window will miss it.
• Flag NXDOMAIN storms against .top and freshly registered .com names from a single client — the fallback pattern once C2 is sinkholed.

Email gateway

• Search archived mail for ZIP attachments whose listing contains a folder named _CL_ followed by five to eight digits, or a LNK plus PDF plus DLL in the same archive.
• Pull messages carrying an account-statement or software-technical-overview decoy PDF alongside an executable-bearing archive.
• Check whether your gateway inspects inside ZIP archives at all. If archive inspection is off, every query in this pack is a compensating control for a delivery gap you can close in an afternoon.

Windows endpoint (Sysmon / native)

• Sysmon Event ID 7 (Image Loaded): a signed vendor EXE loading an unsigned or differently-signed DLL from its own directory. This is the single cleanest sideloading signal and Falcon does not expose a direct equivalent.
• Sysmon Event ID 11 (File Create): files matching *.exe.dat, *.exe.log or Windows.log created in the same directory as an executable.
• Enumerate every per-user and all-users Startup folder for an executable with a same-stem companion file. The playbook in section 13 does this estate-wide.
• Event ID 4688 with a parent of msiexec.exe and a child of wscript.exe, cscript.exe or ftp.exe.

Linux / Java application servers

• File-integrity monitoring across all webroots and servlet deployment directories. suo5 and Neo-reGeorg both require a planted webshell to function.
• Confirm no Java management or monitoring interface is reachable from the internet. That was the confirmed entry route for the healthcare intrusion.
• Grep application access logs for long-lived POST sessions with large symmetric byte counts to a single URI — the SOCKS-over-HTTP tunnel signature.
• Audit for unexpected listeners and for binaries renamed to log-file names (a scanner renamed sys.log, a tunnel binary renamed mail.log). Check the file type, not the extension.
• Verify your cloud host-monitoring agents are actually reporting. The operators shipped a script specifically to silence one.

None of these queries carry an in-query time filter. Set the window with the console time picker — the intended lookback is recorded in each card as a // LOOKBACK: comment. For this campaign use 90 days minimum; the staging infrastructure was live from February 2026.

// HUNT: JadeProx security-vendor impersonation C2 resolution
// MITRE: T1071.001, T1583.001 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest telemetry
// FALSE POSITIVES: none expected; no legitimate resolver path exists for these hostnames
// LOOKBACK: 90d (set in the console time picker)
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^([a-z0-9_-]+\.)*update-(crowdstrike|trellix|sentinelone)\.com$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, DomainName])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Security-vendor brand lookalike domain resolution (generalised)
// MITRE: T1583.001 | CONF: medium  FP: medium  COST: medium
// REQUIRES: DnsRequest telemetry
// FALSE POSITIVES: the vendors' own update and CDN hostnames match this shape
// TUNING: append the exclusion stage below to drop every genuine vendor apex, then baseline
// TUNING: the survivors for a week before promoting to an alert
// LOOKBACK: 90d
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/(update|download|patch|licen[cs]e|portal|support)[-.](crowdstrike|sentinelone|trellix|mcafee|sophos|fortinet|paloalto|trendmicro|kaspersky|bitdefender|eset|carbonblack|cylance|defender)[a-z0-9-]*\.[a-z]{2,12}$/i
| DomainName!=/\.(crowdstrike|sentinelone|trellix|mcafee|sophos|fortinet|paloaltonetworks|trendmicro|kaspersky|bitdefender|eset)\.com$/i
| groupBy([DomainName, ComputerName, aid], function=[count(as=Hits), max(@timestamp, as=LastSeen)], limit=1000)
| sort(Hits, order=desc, limit=200)

// HUNT: JadeProx named C2 and distribution domain resolution
// MITRE: T1071.001 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest telemetry
// FALSE POSITIVES: a security research or sandbox host detonating the sample
// LOOKBACK: 90d
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^([a-z0-9_-]+\.)*(claude-pro\.com|sylverixstrategy\.com|gouvvbo\.top|vertextrust-advisors\.com)$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, DomainName])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Abused signed vendor binary executing outside its install path (TriBack host)
// MITRE: T1574.001, T1218, T1036.005 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: a genuine vendor installer staging its own updater into %TEMP% mid-upgrade
// LOOKBACK: 90d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(NOVUpdate|NOVupdate|avk|ServiceHub\.DataWarehouseHost|MpCopyAccelerator|MpCmdRun)(\.exe)?$/i
| ImageFileName=/(Programs.{0,4}Startup|AppData|ProgramData|Temp|Downloads|Users.{0,40}Public)/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, SHA256HashData, CommandLine])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Rare executable persisting from a Startup folder (TriBack-agnostic)
// MITRE: T1547.001 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: conferencing clients, vendor updaters and consumer utilities legitimately autostart
// TUNING: exclude your approved autostart estate by name, e.g. append
// TUNING: | FileName!=/^(teams|onedrive|slack|zoom|steam|discord|dropbox|greenshot)\.exe$/i
// TUNING: then investigate any FileName seen on fewer than 3 distinct hosts
// LOOKBACK: 90d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/Programs.{0,4}Startup/i
| FileName=/\.(exe|scr|com|pif)$/i
| groupBy([FileName], function=[count(aid, distinct=true, as=HostCount), count(as=Execs), selectFromMax(field=@timestamp, include=[ComputerName, UserName, ImageFileName, SHA256HashData])], limit=2000)
| sort(HostCount, order=asc, limit=200)

// HUNT: ftp.exe -s: script-file execution (LOLBIN proxy execution)
// MITRE: T1218 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legacy scripted FTP jobs on file-transfer servers; scope these out by host role
// LOOKBACK: 90d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^ftp(\.exe)?$/i
| CommandLine=/\s-s\s*:/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

// HUNT: JadeProx _CL_###### nested staging directory
// MITRE: T1027.013, T1566.001 | CONF: high  FP: low  COST: medium
// REQUIRES: ProcessRollup2 plus file-write telemetry
// FALSE POSITIVES: none observed; the token is campaign-specific
// LOOKBACK: 90d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten|ZipFileWritten)$/
| TargetFileName := coalesce([TargetFileName, CommandLine, ImageFileName])
| TargetFileName=/_CL_\d{5,8}/i
| table([@timestamp, aid, ComputerName, UserName, #event_simpleName, TargetFileName])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Tilde-prefixed double-extension self-delete script
// MITRE: T1070.004 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 plus file-write telemetry
// FALSE POSITIVES: rare; a few installers use tilde-prefixed temp scripts during cleanup
// LOOKBACK: 90d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| TargetFileName := coalesce([TargetFileName, CommandLine, ImageFileName])
| TargetFileName=/(~del[\w.-]*\.(bat|cmd)|\.(vbs|js|pdf|doc|docx|xls)\.(bat|cmd|exe|scr))/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, #event_simpleName, TargetFileName])
| sort(@timestamp, order=desc, limit=500)

// HUNT: Script host executing from a user-writable staging path (VBS orchestrator)
// MITRE: T1059.005, T1204.002 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: logon scripts, packaging tooling, legacy VBS line-of-business apps
// TUNING: exclude your logon-script share and packaging hosts, e.g. append
// TUNING: | CommandLine!=/(netlogon|sysvol|sccmcache|ccmcache)/i and scope to non-IT user groups
// LOOKBACK: 90d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(wscript|cscript|mshta)(\.exe)?$/i
| CommandLine=/(Programs.{0,4}Startup|AppData.{0,4}Local.{0,4}Temp|Downloads|Desktop|_CL_\d{5,8})/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

// HUNT: MSI custom action launching a script host or LOLBIN child
// MITRE: T1218.007, T1547.001 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legitimate packaged software with VBScript or PowerShell custom actions
// TUNING: keep only children whose command line touches an autostart path, e.g. append
// TUNING: | CommandLine=/(Programs.{0,4}Startup|CurrentVersion.{0,4}Run)/i
// LOOKBACK: 90d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^msiexec\.exe$/i
| FileName=/^(wscript|cscript|mshta|ftp|regsvr32|rundll32|powershell|pwsh)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

// HUNT: TriBack masquerading DLL written outside a legitimate vendor path
// MITRE: T1036.005, T1574.001 | CONF: high  FP: medium  COST: low
// REQUIRES: PeFileWritten or NewExecutableWritten
// FALSE POSITIVES: .NET build output on developer workstations emits hostfxr.dll legitimately
// TUNING: exclude vendor and build directories, e.g. append
// TUNING: | TargetFileName!=/(Program Files|Windows.{0,4}(System32|SysWOW64|WinSxS|assembly)|dotnet|\\bin\\(Debug|Release))/i
// LOOKBACK: 90d
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/(hostfxr|avk|MpClient|MpCopyAccelerator)\.dll$/i
| TargetFileName=/(Programs.{0,4}Startup|AppData|ProgramData|Temp|Downloads|Users.{0,40}Public)/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=500)

// HUNT: External beacon egress from a TriBack loader host process
// MITRE: T1071.001, T1573.001, T1105 | CONF: medium  FP: medium  COST: high
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: legitimate updaters and script-driven integrations reaching 443
// TUNING: drop your known-good egress destinations first, e.g. append
// TUNING: add a second !cidr() stage covering your CDN and vendor egress ranges,
// TUNING: then keep groups where Conns is large and FirstSeen to LastSeen spans multiple days
// LOOKBACK: 30d (this one is expensive; widen only after tuning)
#event_simpleName=/^NetworkConnectIP4$/
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8","169.254.0.0/16"])
| in(RemotePort, values=[443, 8080])
| ContextBaseFileName=/^(NOVUpdate|NOVupdate|avk|ServiceHub\.DataWarehouseHost|MpCopyAccelerator|ftp|wscript|cscript|mshta)\.exe$/i
| groupBy([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=[count(as=Conns), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)], limit=2000)
| sort(Conns, order=desc, limit=200)

// HUNT: JadeProx / TriBack / Beagle known-bad SHA-256 set
// MITRE: T1204.002, T1574.001 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2, PeFileWritten or ImageHash
// FALSE POSITIVES: malware-analysis workstations and detonation sandboxes
// NOTE: the legitimate signed host binaries are deliberately NOT in this list; see section 10
// LOOKBACK: 180d
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten|ImageHash)$/
| in(SHA256HashData, values=[
    "d5590802bf0926ac30d8e31c0911439c35aead82bf17771cfd1f9a785a7bf143",
    "0a19870ba24aeb9d4b5dde091ef8071d76f8a5e43ac8c6f5b9f283020580a60a",
    "a3c5c7253c0b3ed92e86dc5661d8530a0e8acdf8768e80362e5fe897ccb6cd84",
    "99cb90a3cd46650b8b766c658b7af1b8bbe54a2ac7dcf61429686fd1c548395b",
    "7f50afef2d6e52a160cceb5f2c9945ce89b8e923836e0e550245a46509a98851",
    "2c30c20854e1f6a493aef344cea2d114c566ebae096c3c75508f4e03d5492288",
    "86a6ffa23e924d1afbfb31b55fe780916cf3c9a4f8c3165542fdd726783fc796",
    "586f27257d3eaee7d4bec9e9207c317a9caeded95eca3969739d7e8181d24620",
    "35feef0e6806c14f4ccdb4fceff8a5757956c50fb5ec9644dedae665304f9f96",
    "4457ed2e5ef770f70596735a6bac03f78e426a548335742ac761fba60f987a26",
    "46dea8c1af85134a7b15fc7168386eadd15474b1a6159567b24e83d8a30fc6ef",
    "e6d66d192a779f195426db94d2568c03a9bd0d2e8f1972aa32a0317940ae19c2",
    "8ac88aeecd19d842729f000c6ab732261cb11dd15cdcbb2dd137dc768b2f12bc",
    "33f0caec6f03727fc77ca656ab92cbf20fed53f0fe85a06ec9620aab5e8c9e27"])
| table([@timestamp, aid, ComputerName, UserName, #event_simpleName, FileName, ImageFileName, TargetFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=500)

Three of the thirteen queries are clean enough to promote to Custom IOAs. The rest stay investigate-only. Build these under Endpoint security > Custom IOA rule groups, start every rule at Detect, and only move to Prevent after a two-week clean baseline.

IOA-1 · Sideload host binary outside its install path

IOA-2 · ftp.exe used as a script interpreter

IOA-3 · Tilde double-extension self-delete script

Not promoted, and why

• Q1 / Q3 (domain resolution) — better served by Falcon IOC Management domain entries and a DNS/proxy block than by a Custom IOA. Import the CSV in section 10 instead.
• Q5, Q9, Q10, Q11, Q12 — FP medium. These need per-environment tuning before an IOA is safe; run them as scheduled searches for two weeks first.
• Q2 — deliberately broad, intended for periodic hunting rather than continuous alerting.
• The XOR decrypt and callback-primitive stages — no Custom IOA rule type reaches them. They are memory-behavioral and belong to the sensor's own on-sensor ML and memory scanning, not to a rule you can write. Treat this as a known ceiling, not a gap you can close with more queries.

Read before importing. Every value below traces to a saved snapshot of a primary vendor report. Nothing here is inferred, and nothing here is a shared-hosting address. Two-vendor-corroborated infrastructure carries severity=critical; single-vendor infrastructure is downgraded to high. Set the action column to prevent only after you have confirmed your own resolvers do not legitimately touch these names.

type,value,action,severity,expiration,description,tags
domain,claude-pro.com,prevent,critical,2027-01-24,JadeProx cloned Claude distribution site,campaign:JadeProx
domain,license.claude-pro.com,prevent,critical,2027-01-24,Beagle backdoor C2,campaign:JadeProx
domain,update-crowdstrike.com,prevent,critical,2027-01-24,Security vendor impersonation C2,campaign:JadeProx
domain,update-trellix.com,prevent,critical,2027-01-24,Security vendor impersonation C2,campaign:JadeProx
domain,update-sentinelone.com,prevent,critical,2027-01-24,Security vendor impersonation C2,campaign:JadeProx
domain,gouvvbo.top,prevent,critical,2027-01-24,AdaptixC2 C2 and fake municipal tax portal,campaign:JadeProx
domain,sylverixstrategy.com,detect,high,2027-01-24,AdaptixC2 C2 single primary source,campaign:JadeProx
domain,vertextrust-advisors.com,detect,high,2027-01-24,Reputation cover site on campaign infrastructure,campaign:JadeProx
ipv4,8.217.190.58,detect,high,2027-01-24,Resolves the Beagle C2 hostname,campaign:JadeProx
ipv4,192.252.186.62,detect,high,2026-10-24,Hosts all three security vendor lookalike domains,campaign:JadeProx
ipv4,43.106.71.28,detect,high,2026-10-24,Staging server open directory on port 8000 now offline,campaign:JadeProx
sha256,d5590802bf0926ac30d8e31c0911439c35aead82bf17771cfd1f9a785a7bf143,prevent,critical,2027-01-24,TriBack Loader sideloaded DLL avk.dll,campaign:JadeProx
sha256,0a19870ba24aeb9d4b5dde091ef8071d76f8a5e43ac8c6f5b9f283020580a60a,prevent,critical,2027-01-24,TriBack Loader sideloaded DLL hostfxr.dll,campaign:JadeProx
sha256,a3c5c7253c0b3ed92e86dc5661d8530a0e8acdf8768e80362e5fe897ccb6cd84,prevent,critical,2027-01-24,TriBack Loader sideloaded DLL MpClient.dll,campaign:JadeProx
sha256,99cb90a3cd46650b8b766c658b7af1b8bbe54a2ac7dcf61429686fd1c548395b,prevent,critical,2027-01-24,Beagle backdoor payload,campaign:JadeProx
sha256,7f50afef2d6e52a160cceb5f2c9945ce89b8e923836e0e550245a46509a98851,prevent,critical,2027-01-24,TriBack first stage shellcode,campaign:JadeProx
sha256,2c30c20854e1f6a493aef344cea2d114c566ebae096c3c75508f4e03d5492288,prevent,critical,2027-01-24,AdaptixC2 shellcode,campaign:JadeProx
sha256,86a6ffa23e924d1afbfb31b55fe780916cf3c9a4f8c3165542fdd726783fc796,detect,high,2027-01-24,Claude.msi dropper,campaign:JadeProx
sha256,586f27257d3eaee7d4bec9e9207c317a9caeded95eca3969739d7e8181d24620,detect,high,2027-01-24,GolddTV.msi dropper,campaign:JadeProx
sha256,35feef0e6806c14f4ccdb4fceff8a5757956c50fb5ec9644dedae665304f9f96,detect,high,2027-01-24,Claude-Pro-windows-x64.zip delivery archive,campaign:JadeProx
sha256,4457ed2e5ef770f70596735a6bac03f78e426a548335742ac761fba60f987a26,detect,high,2027-01-24,Claude-Pro-Relay-Technical-Overview.zip archive,campaign:JadeProx
sha256,46dea8c1af85134a7b15fc7168386eadd15474b1a6159567b24e83d8a30fc6ef,detect,high,2027-01-24,Spearphishing archive with account statement decoy,campaign:JadeProx
sha256,e6d66d192a779f195426db94d2568c03a9bd0d2e8f1972aa32a0317940ae19c2,detect,high,2027-01-24,DeviceSync.zip archive,campaign:JadeProx
sha256,8ac88aeecd19d842729f000c6ab732261cb11dd15cdcbb2dd137dc768b2f12bc,detect,high,2027-01-24,Encrypted TriBack companion payload,campaign:JadeProx
sha256,33f0caec6f03727fc77ca656ab92cbf20fed53f0fe85a06ec9620aab5e8c9e27,detect,high,2027-01-24,Encrypted TriBack companion payload variant,campaign:JadeProx
# DO NOT BLOCK be153ac4db95db7520049a4c1e5182be07d27d2c11088a2d768e931b9a981c7f
# That SHA-256 is the LEGITIMATE signed vendor updater the loader sideloads into.
# It is a hunt anchor only. Blocking it breaks a real product and stops nothing.
# Shared hosting deliberately omitted: 104.21.60.96 Cloudflare, 161.35.236.255 and
# 178.128.108.89 DigitalOcean. Alert on them if you must; never block them.

# Published as MD5 by the primary report. Use for VirusTotal pivots and
# retro-hunting where only MD5 is retained. Falcon IOC Management prefers SHA-256.
d99392248bdd7e351e63ead6733638ba  hostfxr.dll
df1f03a2534480a4838f62339bcb90d8  hostfxr.dll (second build)
88ac1c5fc9ee89491c70ea16131e264a  avk.dll
3b3dd8f3a5e1ff85c63f2453ad270415  MpClient.dll
5222a31cf24f9f57ae3d1831f264a983  encrypted .dat companion payload
9e01bf0e28c86435cfb1afaef44238e9  encrypted .log companion payload
3fe9c84025f4401f8cd661675642c526  NOVUpdate.exe.dat
0e6d22c2a81d29b1f9d8395d44e19e53  script.vbs orchestrator
bef0b8599d18acf1c74192ae9f198f85  pdf.vbs orchestrator
c512adfa8743c3b3c776d4452f00c6c0  Claude.vbs orchestrator
a4cdecc57a215243d279cdb065863308  script.dat (ftp.exe script stage)
35cdbf8a16da1245d574a0365cb87287  spearphishing LNK
c1f45a0609c5c1bd2c21cad20703f126  Claude-Pro-Relay LNK
bb5c88de9e04e6306260b9f3a4498933  spearphishing archive
7840f30b395fac347f85b38633c2d08d  operator-staged sideload package
c64eda499e2a21ad158841b9dbc7adc9  Claude-Pro-windows-x64.zip
efac43473d7e87ede5176fe01a114abb  Claude.msi
796f82a4833be330b1e35af63e55b597  GolddTV.msi
4faf4fd91d28e014b4f2362d6a7bb8ac  DeviceSync.zip
# Operator Linux toolkit staged on the exposed server
7c84e75817349adcdea9925b86f67670  iox port-forwarding tool
38e317af0fc0efcc88265f243a264542  suo5 SOCKS5-over-HTTP tunnel
f360afe51b499a036c7be8c0ecc4dc89  Neo-reGeorg neoreg.py
b8053bcd04ce9d7d19c7f36830a9f26b  fscan renamed to a log filename
ee5a2cdd4ce6ccb2e9279c9e13e8bd15  nuclei scanner
aedd185b76ccda8d65dbd26204cc0e9a  cloud agent disable script
0482d6053f96e6bde0a92af25497f3c0  socks5 proxy server
5b75b00a4b4c32b6e213514e80500a65  garbled NPS proxy build
8002ab4d0cf7e1888ee72de0b9f4282c  garbled NPS proxy build (second)
39d4012e49f58092ec5cefed13dbbcfd  XXE payload dtd

# These survive a rebuild. The atomic indicators above will not.
TRIAD_LAYOUT      signed vendor EXE + same-named-as-real DLL + encrypted .dat/.log
                  companion, all three in one user-writable directory
PERSISTENCE       whole triad copied into a per-user Startup folder by a VBS
                  or an MSI custom action
STAGING_PATH      nested folder matching _CL_ followed by 5-8 digits
SELF_DELETE       tilde-prefixed double-extension script, e.g. ~del.vbs.bat
LOLBIN_SCRIPT     ftp.exe -s: pointed at a file with a non-script extension
DECRYPT_ROUTINE   payload bytes reversed, then rolling XOR with offset
EXEC_PRIMITIVE    InitOnceExecuteOnce / TimerQueue callback / EtwpCreateEtwThread
                  resolved from ntdll via GetModuleHandleA + GetProcAddress
BEACON_HTTP       POST /api/v1/status, /updates/check.php, /content.html
BEACON_UA         Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0
BEACON_HEADER     non-standard X-Beacon-Id request header
BEAGLE_TRANSPORT  TCP/443 or UDP/8080, AES with a hardcoded key
TUNNELLING        SOCKS5-over-HTTP through a planted webshell; long-lived POST
                  sessions with symmetric byte counts
RENAMED_TOOLS     ELF binaries renamed to log filenames; check type not extension

cluster            JadeProx (China-nexus, tracked separately to avoid misattribution)
loader             TriBack Loader (4 variants, one custom builder)
post-exploitation  AdaptixC2 (open-source framework, HTTP beacon)
shellcode loader   DonutLoader
backdoor           Beagle (8 commands: shell, file transfer, dir list, self-remove)
tunnelling         iox, suo5, Neo-reGeorg, garbled NPS
scanning           nuclei (critical templates only), fscan
credential access  Chromium App-Bound-Encryption stealer (download attempt only)
misc               XMRig proxy, Go socks5-server, cloud-agent disable script
overlaps           tradecraft shared with several documented China-nexus clusters;
                   no single group accounts for the whole picture

# Exploited by this cluster against internet-facing hosts. All CVSS 9.8.
CVE-2018-11511   SQL injection in a NAS photo-gallery application
CVE-2021-24139   SQL injection in a WordPress photo-gallery plugin
CVE-2021-31755   stack buffer overflow in a consumer router (on CISA KEV since 2021-11-03)
CVE-2021-32305   arbitrary command execution in a web SVN interface

# Defender ASR rules to enable in Block mode
BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550  Block executable content from email and webmail
D3E037E1-3EB8-44C8-A917-57927947596D  Block JS/VBS launching downloaded executable content
5BEB7EFE-FD9A-4556-801D-275E5FFC04CC  Block execution of potentially obfuscated scripts
3B576869-A4EC-4529-8536-B80A7769E899  Block Office apps creating executable content
D4F940AB-401B-4EFC-AADC-AD5F3C50688A  Block Office apps creating child processes

# Policy values to verify
HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings\Enabled          = 0
HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated = 0
HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated = 0
HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableMSI         = 2
Mail gateway: archive inspection ON, LNK inside archives BLOCKED
DNS: newly-registered-domain category BLOCKED for all user subnets

Gate 1 — Telemetry ready

• Confirm DnsRequest events are present estate-wide: #event_simpleName=/^DnsRequest$/ | groupBy([ComputerName], function=count(as=n), limit=5000). Any host group returning zero is invisible to Q1, Q2 and Q3.
• Confirm PeFileWritten is flowing before trusting Q11's silence.
• Confirm your DNS resolver and proxy retention actually covers 90 days. If it covers 30, say so in the ticket rather than reporting a clean hunt.

Gate 2 — Benign baseline

• Run Q5, Q9, Q10, Q11 and Q12 in report-only mode for one full business week. Record the top twenty benign hits per query and turn them into the exclusion stage in each card's // TUNING: line.
• Q2 will hit your own security vendors' genuine domains before tuning. That is expected and is the point of the exclusion stage.

Gate 3 — Positive test (safe, non-offensive)

• Q1/Q3: add one campaign domain to an internal test resolver zone and resolve it from a lab host. No malware needed; you are testing the query and the pipeline, not the payload.
• Q4: copy any benign signed vendor executable into a lab user's Startup folder and run it. The query should fire on path alone.
• Q6: run ftp.exe -s:C:\lab\commands.txt on a lab host with a harmless command file.
• Q7: create a folder named _CL_123456 on a lab host and execute a benign binary from inside it.
• Q13: cannot be positively tested without the samples. Validate the query shape by substituting the SHA-256 of a known-good local file and confirming it returns.

Gate 4 — Promotion

• Promote to a scheduled search only after Gate 2 produces a stable, explainable hit rate.
• Promote to a Custom IOA only for IOA-1, IOA-2 and IOA-3, and only at Detect severity first.
• Move an IOC row from detect to prevent only after two clean weeks and a documented owner for the false-positive rollback.

Each control names the MITRE mitigation it satisfies (the why) and the platform authority that defines it (the what). Controls are ordered by leverage against this specific chain, not by comprehensiveness.

Playbook 1 — Sweep every Startup folder for a TriBack triad (PowerShell)

Finds executables in per-user and all-users Startup folders that have a same-stem companion file, which is the TriBack layout. Read-only; run it estate-wide before you change anything.

# Run as SYSTEM or an admin. Read-only enumeration.
$roots = @()
$roots += Join-Path $env:ProgramData 'Microsoft\Windows\Start Menu\Programs\StartUp'
Get-ChildItem 'C:\Users' -Directory -ErrorAction SilentlyContinue | ForEach-Object {
    $roots += Join-Path $_.FullName 'AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'
}

foreach ($root in $roots) {
    if (-not (Test-Path $root)) { continue }
    $items = Get-ChildItem -Path $root -File -ErrorAction SilentlyContinue
    foreach ($exe in ($items | Where-Object { $_.Extension -match '^\.(exe|scr|com|pif)$' })) {
        $stem      = $exe.BaseName
        $companion = $items | Where-Object {
            $_.Name -ne $exe.Name -and
            ($_.Name -like "$stem*" -or $_.Extension -match '^\.(dat|log|bin|tmp)$')
        }
        $dll = $items | Where-Object { $_.Extension -eq '.dll' }
        $sig = Get-AuthenticodeSignature -FilePath $exe.FullName -ErrorAction SilentlyContinue

        if ($companion -or $dll) {
            [pscustomobject]@{
                Host       = $env:COMPUTERNAME
                Startup    = $root
                Executable = $exe.Name
                Signer     = $(if ($sig) { $sig.SignerCertificate.Subject } else { 'unsigned' })
                SigStatus  = $(if ($sig) { $sig.Status } else { 'none' })
                SideloadDll= ($dll.Name -join ';')
                Companion  = ($companion.Name -join ';')
                Sha256     = (Get-FileHash $exe.FullName -Algorithm SHA256).Hash
            }
        }
    }
}
# A SIGNED executable with an unsigned DLL and a .dat/.log companion beside it
# in a Startup folder is the TriBack triad. Collect the folder before isolating.

Playbook 2 — Block execution from the Startup folder (AppLocker, GPO)

Deny rule applied to Everyone. Deploy in Audit mode for 48 hours first; the report tells you which legitimate applications you are about to break.

# 1. Create or edit a GPO linked to your workstation OU.
# 2. Computer Configuration
#      -> Policies
#      -> Windows Settings
#      -> Security Settings
#      -> Application Control Policies
#      -> AppLocker
#      -> Executable Rules
# 3. New Rule: Action = Deny, User = Everyone, Condition = Path
#      %OSDRIVE%\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*
#      %OSDRIVE%\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\*
# 4. Repeat under "DLL Rules" with the same two paths. DLL rules are what
#    actually stop the sideload; the executable rule alone leaves the DLL loadable.
# 5. Set enforcement to "Audit only", collect for 48h, then switch to "Enforce rules".
# 6. Application Identity service must be running and set to Automatic:
Set-Service -Name AppIDSvc -StartupType Automatic
Start-Service -Name AppIDSvc

# Verification
Get-AppLockerPolicy -Effective -Xml | Out-String -Width 4096
# Functional test: copy a benign signed EXE into the Startup folder and run it.
# Expected result: execution blocked, Event ID 8004 in
# Microsoft-Windows-AppLocker/EXE and DLL.

Playbook 3 — Disable Windows Script Host and lock down MSI (registry / GPO)

# Disable Windows Script Host machine-wide (both hives on 64-bit).
$wsh   = 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings'
$wsh32 = 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows Script Host\Settings'
foreach ($k in @($wsh, $wsh32)) {
    if (-not (Test-Path $k)) { New-Item -Path $k -Force | Out-Null }
    New-ItemProperty -Path $k -Name 'Enabled' -Value 0 -PropertyType DWord -Force | Out-Null
}

# Remove non-admin MSI elevation and disable user-initiated installs.
$inst = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Installer'
if (-not (Test-Path $inst)) { New-Item -Path $inst -Force | Out-Null }
New-ItemProperty -Path $inst -Name 'AlwaysInstallElevated' -Value 0 -PropertyType DWord -Force | Out-Null
New-ItemProperty -Path $inst -Name 'DisableMSI'            -Value 2 -PropertyType DWord -Force | Out-Null

# Verification
Get-ItemProperty -Path $wsh  -Name Enabled
Get-ItemProperty -Path $inst -Name AlwaysInstallElevated, DisableMSI
# Expected: Enabled = 0, AlwaysInstallElevated = 0, DisableMSI = 2.
# NOTE: pilot the WSH change. If you still run VBS logon scripts, exempt those
# hosts by scoping the GPO rather than skipping the control estate-wide.

Playbook 4 — Enable the Defender ASR rules (PowerShell)

$rules = @(
    'BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550',  # executable content from email/webmail
    'D3E037E1-3EB8-44C8-A917-57927947596D',  # JS/VBS launching downloaded executables
    '5BEB7EFE-FD9A-4556-801D-275E5FFC04CC',  # obfuscated script execution
    '3B576869-A4EC-4529-8536-B80A7769E899',  # Office creating executable content
    'D4F940AB-401B-4EFC-AADC-AD5F3C50688A'   # Office creating child processes
)
# Start in Audit (2). Switch the value to 1 for Block once the audit is clean.
foreach ($id in $rules) {
    Add-MpPreference -AttackSurfaceReductionRules_Ids $id -AttackSurfaceReductionRules_Actions 2
}

# Verification
$p = Get-MpPreference
for ($i = 0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) {
    [pscustomobject]@{
        Rule   = $p.AttackSurfaceReductionRules_Ids[$i]
        Action = $p.AttackSurfaceReductionRules_Actions[$i]   # 0 off, 1 block, 2 audit
    }
}

Playbook 5 — Linux / Java application server exposure check (shell)

#!/usr/bin/env bash
# Read-only triage for the exploitation half of this campaign.
set -u

echo '== Listening services reachable off-box =='
ss -lntup 2>/dev/null | grep -v '127.0.0.1' | grep -v '::1'

echo
echo '== Java management / monitoring interfaces =='
ps -ef | grep -i java | grep -Ei 'jmxremote|com.sun.management|jolokia|hawtio' | grep -v grep

echo
echo '== Recently modified files under common webroots =='
for d in /var/www /opt/tomcat/webapps /usr/share/tomcat/webapps /srv/http; do
    [ -d "$d" ] || continue
    find "$d" -type f -mtime -90 \
        \( -name '*.jsp' -o -name '*.jspx' -o -name '*.php' -o -name '*.war' \) \
        -printf '%TY-%Tm-%Td  %p\n' 2>/dev/null
done | sort

echo
echo '== Binaries masquerading as log files =='
find /tmp /var/tmp /dev/shm /root /home -maxdepth 3 -type f -name '*.log' 2>/dev/null \
  | while read -r f; do
        t=$(file -b "$f" 2>/dev/null)
        case "$t" in *ELF*) echo "ELF BINARY NAMED AS LOG: $f  [$t]";; esac
    done

echo
echo '== Cloud host-security agent status =='
systemctl list-units --type=service --state=running 2>/dev/null \
  | grep -Ei 'aegis|assist|cloudmonitor|guard|hids|falcon-sensor' || echo 'none running - investigate'
# A silenced host-security agent is itself an indicator; the operators shipped a
# script whose only job was disabling one.

Thirteen queries cover fifteen of eighteen mapped techniques at Good or Partial. The three hard gaps are all in the same place and for the same reason: the loader's in-memory stages were engineered specifically to avoid the primitives EDR instruments, so no additional query closes them. The counters are application control (H-Strat-13), which stops the chain before the loader runs at all, and the sensor's own memory scanning. The exploitation and tunnelling gaps are not detection failures either — they sit on infrastructure that usually has no endpoint agent, which is why sections 7 and 13 carry log-based and shell-based coverage instead. Before reporting a clean hunt, complete Gate 1 in section 11: a query that returns nothing because the telemetry never arrived is not a negative result.

Source snapshots for every cited primary source are stored alongside this file in JadeProx-TriBack-Loader-Hunt-sources/. Every atomic indicator shipped in section 10 traces to one of them.