PATCHCORD — Afghan Telecom & South Asian Critical Infrastructure Backdoor

Looks for: execution of the known campaign installer filenames. Requires: Falcon sensor process telemetry.

// HUNT: PATCHCORD - T1204.002 / T1036.005 - Malicious Inno Setup installer masquerading as telecom software
// CONF: high  FP: low  COST: low | REQUIRES: Falcon process telemetry
// HYPOTHESIS: PATCHCORD delivery in the environment will show execution of an Inno Setup installer with
//   a telecom/VPN-themed filename, typically launched after a user opens Telecom_TMS.zip.
// FP NOTES: filenames are campaign-specific; not a shared naming convention with legitimate software.
// LOOKBACK: 30d (set via console time picker)
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(TMS_AfghanTelecom|AFTEL_VPN_Setup|NHPC_Fuel_Conservation_Setup)(\.exe)?$/i
| groupBy([ComputerName, UserName, aid], function=[count(as=Hits), collect([FileName, ImageFileName, CommandLine, ParentBaseFileName])], limit=500)
| sort(Hits, order=desc)

Looks for: the exact registry value name PATCHCORD writes after hijacking browser shortcuts. Requires: Falcon registry (Asep) telemetry.

// HUNT: PATCHCORD - T1547.009 / T1112 - BeaconBrowserHijack persistence registry value write
// CONF: high  FP: low  COST: low | REQUIRES: Falcon registry (Asep) telemetry
// HYPOTHESIS: PATCHCORD writes a value named "BeaconBrowserHijack" under HKCU Run to mark a host as
//   already hijacked and to persist across reboots.
// FP NOTES: "BeaconBrowserHijack" is not a standard Windows or third-party Run-key value name; no known
//   legitimate software uses it. Any hit warrants immediate escalation.
// LOOKBACK: 30d
#event_simpleName = /AsepValueUpdate|RegGenericValueUpdate/
| RegObjectName = /HKEY_(CURRENT_USER|USERS\\[^\\]+)\\Software\\Microsoft\\Windows\\CurrentVersion\\Run/i
| RegValueName = /^BeaconBrowserHijack$/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid])
| sort(@timestamp, order=desc)

Looks for: writes to .lnk files in browser-shortcut locations, as a proxy since Falcon has no dedicated shortcut-modification event. FP: browser auto-updaters and app installers/uninstallers legitimately rewrite their own shortcuts — correlate with Q2 and Q1 before escalating, do not action alone.

// HUNT: PATCHCORD - T1547.009 - Browser shortcut (.lnk) target file modification
// CONF: medium  FP: medium  COST: low | REQUIRES: Falcon generic file-write telemetry
// HYPOTHESIS: a .lnk write/modify event in Desktop/Start Menu/Taskbar/Quick Launch, near in time to a
//   suspected PATCHCORD installer/implant process, is consistent with shortcut hijacking.
// TUNING: Falcon has no purpose-built "shortcut modification" event; this uses the generic file-write
//   event family filtered to .lnk targets, which also fires for legitimate shortcut creation (browser
//   updates, pinning apps, install/uninstall routines). Exclude known updater/installer parents below and
//   always correlate with the BeaconBrowserHijack registry write (Q2) before escalating.
// LOOKBACK: 14d
#event_simpleName = /PeFileWritten|NewExecutableWritten|.*FileWritten/
| TargetFileName = /\.lnk$/i
| TargetFileName = /\\(Desktop|Start Menu|Taskbar|Quick Launch)\\/i
| ImageFileName != /\\(msedge_installer|msedgeupdate|GoogleUpdate|updater|firefox\\uninstall)\.exe$/i
| table([@timestamp, ComputerName, UserName, TargetFileName, ImageFileName, ContextProcessId_decimal, aid])
| sort(@timestamp, order=desc)

Looks for: any process spawned directly by the known campaign installer names. FP: legitimate Inno Setup install tasks (e.g. regsvr32 for COM registration) can also match — review CommandLine context per hit.

// HUNT: PATCHCORD - T1059 - Suspicious child process of Inno Setup installer
// CONF: high  FP: low  COST: low | REQUIRES: Falcon process telemetry
// TUNING: Inno Setup installers legitimately spawn helper processes for install tasks; review CommandLine
//   for each hit rather than auto-escalating on parent match alone.
// LOOKBACK: 30d
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName = /^(TMS_AfghanTelecom|AFTEL_VPN_Setup|NHPC_Fuel_Conservation_Setup)(\.exe)?$/i
| groupBy([ComputerName, UserName, FileName, aid], function=[count(as=Hits), collect([CommandLine, ParentBaseFileName])], limit=500)
| sort(Hits, order=desc)

Looks for: cmd.exe /c spawned specifically from the known campaign installer/implant name. FP: cmd.exe /c alone is extremely common; this query is scoped by parent to control noise — do not broaden the parent filter without expecting a large FP increase.

// HUNT: PATCHCORD - T1059.003 - cmd.exe /c command execution consistent with implant remote-command tasking
// CONF: medium  FP: medium  COST: low | REQUIRES: Falcon process telemetry
// TUNING: cmd.exe /c is an extremely common pattern used by installers, RMM tools, and admin scripts.
//   This query is narrowed to parents matching known campaign installer/implant names to control FP volume;
//   review ParentBaseFileName and CommandLine together before escalating.
// LOOKBACK: 14d
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^cmd\.exe$/i
| CommandLine = /\/c\s/i
| ParentBaseFileName = /^(TMS_AfghanTelecom|AFTEL_VPN_Setup|NHPC_Fuel_Conservation_Setup)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine, aid])
| sort(@timestamp, order=desc)

Looks for: cmd.exe /c from unsigned/uncommon parents launched out of Downloads/Temp/AppData, to catch renamed or future variants. FP: many legitimate portable apps and dev tooling behave this way — triage-only, not a standalone alert trigger.

// HUNT: PATCHCORD - T1059.003 - cmd.exe /c spawned from unsigned process in a user-writable directory
// CONF: low  FP: high  COST: medium | REQUIRES: Falcon process telemetry
// TUNING: broad heuristic; use as a secondary/triage query only. Cross-reference with Q6/Q7 (C2 network
//   activity) before escalating any result from this query.
// LOOKBACK: 7d
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^cmd\.exe$/i
| CommandLine = /\/c\s/i
| ParentBaseFileName != /^(explorer|services|svchost|powershell|wscript|cscript|python|node)\.exe$/i
| ImageFileName = /\\(Downloads|AppData\\Local\\Temp|Temp)\\/i
| groupBy([ComputerName, UserName, ParentBaseFileName, aid], function=[count(as=Hits), collect(CommandLine)], limit=500)
| sort(Hits, order=desc)

Looks for: the campaign process itself, for historical triage only — Falcon's documented event schema exposes no VirtualAlloc/CreateThread API-call telemetry. FP: "no file write observed" is not unique to malicious in-memory execution; this query cannot confirm the technique from CQL alone.

// HUNT: PATCHCORD - T1055 / T1620 - Fileless in-memory shellcode execution (best-effort proxy)
// CONF: low  FP: high  COST: low | REQUIRES: Falcon process telemetry (does NOT cover the API-call itself)
// TUNING: Falcon's CQL/LogScale event model does not expose a VirtualAlloc/CreateThread API-call event -
//   there is no purpose-built "reflective shellcode" event type in the documented Falcon schema. This query
//   is provided for historical/completeness triage only; it cannot reliably confirm the technique.
//   PRIMARY CONTROL: deploy the Custom IOA in Section 9 and rely on Falcon's ML-based in-memory
//   exploitation detection (Enterprise/Elite tiers) - this CQL query is a supplementary triage aid only.
// LOOKBACK: 14d
#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/
| FileName = /^(TMS_AfghanTelecom|AFTEL_VPN_Setup)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, TargetProcessId_decimal, aid])
| sort(@timestamp, order=desc)

Looks for: any outbound connection to the confirmed C2 IP, joined to the initiating process. Requires: Falcon network telemetry.

// HUNT: PATCHCORD - T1071.001 / T1571 - Network connection to known C2 IP 46.30.188.13 on port 8080
// CONF: high  FP: low  COST: medium | REQUIRES: Falcon network telemetry
// FP NOTES: none expected; specific IOC IP with no legitimate business use. Revisit IOC expiry (30d) if
//   this address is ever reassigned by the hosting provider after infrastructure takedown.
// LOOKBACK: 30d
#event_simpleName = NetworkConnectIP4
| RemoteAddressIP4 = "46.30.188.13"
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName = /ProcessRollup2|SyntheticProcessRollup2/}, field=TargetProcessId_decimal)
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, RemoteAddressIP4, RemotePort, aid])
| sort(@timestamp, order=desc)

Looks for: DNS resolution of PATCHCORD's own C2 domain or the related-cluster lure domain. Requires: Falcon DNS telemetry.

// HUNT: PATCHCORD - T1071.001 - DNS resolution of known cluster C2/lure domains
// CONF: high  FP: low  COST: low | REQUIRES: Falcon DNS telemetry
// FP NOTES: none expected; both domains are typosquat/fake domains with no legitimate purpose.
//   nic-support.site is shipped as related-cluster (SHEETCORD) infrastructure, not a confirmed
//   PATCHCORD-specific C2 channel - see Section 2 cross-reference note.
// LOOKBACK: 30d
#event_simpleName = DnsRequest
| DomainName = /^(appstoore\.solutions|nic-support\.site)$/i
| table([@timestamp, ComputerName, UserName, DomainName, aid])
| sort(@timestamp, order=desc)

Looks for: the delivery archive appearing on disk, prior to installer execution. Requires: Falcon file-write telemetry.

// HUNT: PATCHCORD - T1204.002 - Delivery archive "Telecom_TMS.zip" written to disk
// CONF: high  FP: low  COST: low | REQUIRES: Falcon file-write telemetry
// FP NOTES: none expected; a generically-named archive collision is possible but low probability given
//   the specificity of "Telecom_TMS.zip".
// LOOKBACK: 30d
#event_simpleName = /ZipFileWritten|.*FileWritten/
| TargetFileName = /Telecom_TMS\.zip$/i
| table([@timestamp, ComputerName, UserName, TargetFileName, ImageFileName, aid])
| sort(@timestamp, order=desc)