PivotC2 — FortiGate CAPWAP RCE (CVE-2025-25249) Node.js RAT

// HUNT: Outbound Connection to Named PivotC2 C2 Infrastructure
// MITRE: T1071.001 (Application Layer Protocol: Web Protocols)
// CONF: high
// FP: low
// COST: low
// REQUIRES: NetworkConnectIP4 (Falcon sensor on any endpoint/server reachable to the internet)
// FALSE POSITIVES: none expected -- these are attacker-controlled IPs cited by CyberSecurityNews/GBHackers reporting on this campaign; any hit is a true positive requiring immediate triage.
// TUNING: if either IP is later reused by a shared hosting provider for unrelated traffic, pin the match to RemotePort=8443 for 146.103.99.177 only, or expire this row per the IOC table review date.

#event_simpleName=/^NetworkConnectIP4$/
| RemoteAddressIP4=in(["146.103.99.177", "46.151.29.58"])
| table([@timestamp, aid, ComputerName, LocalAddressIP4, RemoteAddressIP4, RemotePort, ContextProcessId])
| sort(@timestamp, order=desc)

// HUNT: Admin / Service / LDAP-Bind Account Logons, Grouped by Distinct Source IP for Analyst Review
// MITRE: T1078.002 (Valid Accounts: Domain Accounts), T1133 (External Remote Services)
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: UserLogon (Falcon Identity Protection / AD-integrated telemetry) for accounts matching admin/svc/ldap naming
// FALSE POSITIVES: legitimate travel, new VPN/NAT egress IP, freshly onboarded admin, PAM credential rotation immediately followed by first login.
// TUNING: narrow UserName to your actual FortiGate LDAP-bind and local-admin account names once identified from the compromised device's config; exclude known corporate VPN/NAT/PAM egress CIDRs.
// WARNING Field unverified -- UserLogon field coverage and RemoteAddressIP4 population for domain logons varies by Falcon Identity Protection deployment; validate in tenant before promoting to IOA.

#event_simpleName=/^UserLogon$/
| UserName=/(adm|admin|svc|ldap|bind)/i
| groupBy([UserName], function=([collect([RemoteAddressIP4], limit=50), collect([@timestamp], limit=50), count(as=LogonCount)]))
| sort(LogonCount, order=desc)

// HUNT: Same Privileged Account Authenticating From Multiple Distinct Source IPs Within a Short Window
// MITRE: T1078.002 (Valid Accounts: Domain Accounts)
// CONF: medium
// FP: medium
// COST: medium
// REQUIRES: UserLogon (AD/Identity Protection telemetry) for privileged/admin/LDAP-bind accounts
// FALSE POSITIVES: split-tunnel VPN clients hopping egress IPs, mobile carrier IP rotation, load-balanced SSO front-ends.
// TUNING: pair with geo-IP or Falcon Identity Protection risk-score enrichment to turn "distinct IP count" into true impossible-travel (incompatible geolocations, sub-hour delta); this query surfaces the raw candidate set for that enrichment step.
// WARNING Field unverified -- validate UserLogon field coverage for your identity sources in tenant.

#event_simpleName=/^UserLogon$/
| UserName=/(adm|admin|svc|ldap|bind)/i
| bucket(span=1h, field=@timestamp, as=hour)
| groupBy([UserName, hour], function=([collect([RemoteAddressIP4], limit=20), countDistinct(RemoteAddressIP4, as=DistinctIPs)]))
| DistinctIPs>=2
| sort(DistinctIPs, order=desc)

// HUNT: Single Internal Source IP Authenticating to an Unusually High Number of Distinct Falcon-Covered Hosts
// MITRE: T1078 (Valid Accounts), T1021 (Remote Services), T1046 (Network Service Scanning -- adjacent)
// CONF: medium-high
// FP: medium
// COST: medium
// REQUIRES: UserLogon (network/interactive logon telemetry) on Falcon-covered endpoints/servers
// FALSE POSITIVES: patch/deployment tooling (SCCM, Ansible, Intune), IT admin mass maintenance, jump-box/bastion hosts by design.
// TUNING: exclude known management/deployment/bastion source IPs; if a specific FortiGate's internal interface IP is confirmed compromised (via the appliance-side checks in Section 7), pin this query to that exact source IP for high-confidence lateral-movement confirmation.
// NOTE: this is the practical stand-in for detecting PivotC2's internal "auto-mode" CIDR scan. Raw port-scan telemetry from EDR alone is a known blind spot for inbound connection attempts (see Section 15); authenticated-access fan-out is the more reliably instrumented downstream signal.

#event_simpleName=/^UserLogon$/
| LogonType=in(["3","10"])
| groupBy([RemoteAddressIP4], function=([countDistinct(aid, as=DistinctHostsTargeted), collect([ComputerName, UserName], limit=50)]))
| DistinctHostsTargeted>=8
| sort(DistinctHostsTargeted, order=desc)

// HUNT: Terminal Services (RDP) Enabled or Used Shortly After Suspected Credential-Reuse Logon
// MITRE: T1021.001 (Remote Desktop Protocol), T1112 (Modify Registry)
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: RegGenericValueUpdate (registry writes) on Falcon-covered endpoints/servers
// FALSE POSITIVES: legitimate IT enabling RDP for support, RMM tooling, approved change requests.
// TUNING: correlate hits against Q2/Q4 output (same source IP / same recently-first-seen account) before triage; exclude your RMM/helpdesk service accounts.

#event_simpleName=/^RegGenericValueUpdate$/
| RegObjectName=/Terminal Server.*fDenyTSConnections/i
| RegValueName=/fDenyTSConnections/i
| table([@timestamp, aid, ComputerName, RegObjectName, RegValueName, UserName])
| sort(@timestamp, order=desc)

// HUNT: Outbound DNS Resolution of Wasabi Cloud Object Storage From Falcon-Covered Hosts
// MITRE: T1567.002 (Exfiltration to Cloud Storage)
// CONF: medium
// FP: high
// COST: low
// REQUIRES: DnsRequest on Falcon-covered endpoints/servers
// FALSE POSITIVES: organizations that legitimately use Wasabi for backup/archival -- if Wasabi is an approved vendor, scope this query to hosts/accounts NOT on the approved backup-server allowlist.
// TUNING: exclude your sanctioned backup/archival server(s). This is a GENERIC cloud-storage-abuse detector, not a PivotC2-specific IOC -- no PivotC2-attributed Wasabi bucket/endpoint was published in the sourced reporting (see Section 4), so treat any hit as "investigate for data staging/exfil," not a confirmed PivotC2 hit.

#event_simpleName=/^DnsRequest$/
| DomainName=/\.wasabisys\.com$/i
| table([@timestamp, aid, ComputerName, DomainName, ContextProcessId])
| sort(@timestamp, order=desc)

// HUNT: High-Volume AD Authentication / Bind Activity From a Non-Standard Source Following Suspected FortiGate Compromise
// MITRE: T1087.002 (Account Discovery: Domain Account), T1069.002 (Permission Groups Discovery: Domain Groups)
// CONF: low-medium
// FP: high
// COST: medium
// REQUIRES: ActiveDirectoryAuthentication (Falcon Identity Protection AD authentication/bind telemetry; module-dependent -- not all tenants ingest this)
// FALSE POSITIVES: legitimate directory-aware applications (SSO, MDM, PAM, monitoring) performing normal AD authentication/bind activity -- this event type is naturally high-volume/noisy.
// TUNING: scope to accounts matching the LDAP-bind naming pattern harvested by PivotC2, or to source IPs already flagged by Q2/Q4; do not run unscoped in production without an allowlist of known directory-consuming applications.
// NOTE: corrected from an earlier draft that referenced non-existent event names (AuthActivityAuditData, LdapSearch) -- ActiveDirectoryAuthentication is a real Falcon Identity Protection event; confirm it is licensed/ingested in your tenant before relying on this query.

#event_simpleName=/^ActiveDirectoryAuthentication$/
| SamAccountName=/(ldap|bind|svc)/i
| groupBy([SamAccountName, SourceEndpointHostName], function=([count(as=QueryCount)]))
| QueryCount>=50
| sort(QueryCount, order=desc)

// HUNT: Process Access to Browser Credential Stores (Chrome/Edge Login Data, Firefox logins.json)
// MITRE: T1555.003 (Credentials from Web Browsers)
// CONF: low
// FP: high
// COST: low
// REQUIRES: FileOpenInfo / ProcessRollup2 on Falcon-covered endpoints
// FALSE POSITIVES: password managers, browser sync/backup tools, forensic/IT tooling, the browser itself operating normally.
// TUNING: this is a GENERIC credential-theft behavioral hunt, not unique to PivotC2 -- CyberSecurityNews/GBHackers describe "browser credential theft" as part of the confirmed full-network-intrusion cases but do not name a specific stealer tool or technique. Use as a low-priority investigate-only supplement, not a promoted detection.

#event_simpleName=/^FileOpenInfo$/
| TargetFileName=/(Login Data|logins\.json|Cookies)$/i
| ImageFileName!=/\\(chrome|msedge|firefox|brave|opera)\.exe$/i
| table([@timestamp, aid, ComputerName, ImageFileName, TargetFileName, UserName])
| sort(@timestamp, order=desc)

// HUNT: PivotC2 Implant Filename Observed on Any Falcon-Covered Host (Forensic Copy / Analyst Workstation / Jump Box)
// MITRE: T1105 (Ingress Tool Transfer) -- adjacent, opportunistic
// CONF: low
// FP: low
// COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten on Falcon-covered endpoints
// FALSE POSITIVES: none expected under normal operation -- but very low true-positive probability too, since PivotC2 runs entirely on the FortiGate appliance (no Falcon sensor there) and only reaches a Falcon-covered host if an analyst manually copies the implant off-box for forensic review, or an internal jump box was used as a mount/staging point.
// TUNING: none needed; this is a narrow, opportunistic net-catch, not a primary detection. Do not rely on this as your main PivotC2 hunt -- see Section 15 for why on-appliance artifacts are not natively visible to Falcon.
// NOTE: corrected from an earlier draft that referenced non-existent event names (FileCreateInfo, FileWritten) -- PeFileWritten / NewExecutableWritten are real Falcon file-write events.

#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| FileName=/^\.i\.js$/i
| table([@timestamp, aid, ComputerName, FileName, FilePath, ImageFileName])
| sort(@timestamp, order=desc)