STAC4749 — Microsoft Teams Vishing to Chaos Ransomware

The attacker objective is a fast, hands-on-keyboard ransomware payday that never touches your perimeter. STAC4749 is a financially motivated cluster tracked by Sophos X-Ops that compromised dozens of North American organisations between February and June 2026. Roughly 95 percent of victims were in Canada (about 50 percent) and the United States (about 44 to 45 percent), concentrated in professional services, manufacturing, energy, construction and engineering, and intellectual-property law firms.

The operators never exploit a vulnerability. They register IT-themed .top domains, stand up external Microsoft Teams tenants with fake helpdesk personas, and call employees directly. A two to two-and-a-half minute conversation is usually enough to talk the user into starting a Microsoft Quick Assist session, or installing the cloud RMM tool RemSupp when Quick Assist is blocked. From April onward RemSupp became the preferred tool, most likely because it is less commonly present on application blocklists.

Once inside the remote-support session the operator uses PowerShell to stage a loader into %AppData%, profiles the host and its security products, and installs persistence through HKCU Run keys and Startup-folder VBScript shortcuts disguised as Realtek and Windows audio components. A PyInstaller Python backdoor obfuscated with PyArmour hands off to Golang implants, a reverse SOCKS proxy (sc5.exe) provides tunnelled access, and DWAgent, AnyDesk and enabled RDP provide redundant footholds. In at least three intrusions this ended in Chaos ransomware, once in under 17 hours from first Teams contact to encryption, with data theft in at least one case.

The highest-value defensive angle is the join between the identity plane and the endpoint. Every one of these intrusions requires an external Teams tenant to reach an employee, and a remote-support binary to launch shortly afterwards. Neither half is malicious alone. Together, inside a short time window, the pair is close to unambiguous. That correlation is what this pack is built around, because the malware filenames, the hosting domains and the persistence value names all changed continuously between February and May while the shape of the intrusion did not.

Defender priority: restrict Microsoft Teams external access to an allowlist of federated domains today, and alert on any remote-support tool (Quick Assist, RemSupp, DWAgent, AnyDesk) launching on a host that has had an external federated Teams conversation in the preceding hour. Blocking the indicator list alone will not stop this actor. The infrastructure rotated roughly weekly across a 40-domain payload cluster while the social-engineering play stayed identical.

Five sources were fetched and snapshotted verbatim into the pack's source directory. Every atomic indicator shipped in this pack traces mechanically back to one of those snapshots.

Decisions taken during research

• No indicator ships at prevent/critical. The two-independent-source bar is not met by anything in this campaign. The Sophos blog and the SophosLabs CSV are the same organisation and count as one source. BleepingComputer, CyberPress and SOCFortress are all derivative reporting on that single vendor investigation, not independent telemetry. Everything therefore ships at detect or lower, and the pack says so rather than quietly inflating severity.
• The vendor CSV contains one malformed hash. The SHA-256 row for msupdate.exe is 63 hex characters, not 64. It was dropped rather than repaired by guesswork. The well-formed MD5 for the same sample ships in its place.
• Cloudflare edge addresses were not shipped. The vendor CSV annotates most payload domains with the Cloudflare IPs they resolved to (104.21.x, 172.67.x, 172.64.x). Those are shared CDN front-ends, not actor infrastructure. Blocking them would break a large fraction of the public internet.
• Bare workers.dev was not shipped. It is a shared Cloudflare Workers domain used by millions of legitimate deployments. The three specific attacker subdomains ship at medium severity instead, with the caveat that Workers subdomains are cheap and disposable.
• Generic implant filenames were not shipped as indicators. The Golang implants use single-word English nouns (graph.exe, confirm.exe, midnight.exe, shield.exe, tube.exe, dizzy.exe, agree.exe, autumn.exe). Alerting on those names would generate constant noise. Their hashes ship, and Q12 hunts the --token-raw command-line argument that the whole family shares, which is the durable signal.
• Legitimate tooling is hunted contextually, never blocklisted. Quick Assist, RemSupp, DWAgent, AnyDesk, RDP, msconfig and CopyQ are all real software with real business use. Every query touching them is scoped by parent process, first-appearance rarity, execution path, or correlation with an external Teams conversation.
• No prompt-injection attempt was found in any fetched page. One fetch of the Sophos article returned a partial refusal from the retrieval tooling rather than the full technique narrative. That is a tool-side limitation, not adversarial page content, and the missing detail was recovered from the corroborating sources.

Attack chain

Hunt hypotheses, ordered by fidelity

70 atomic indicators ship in this pack: 12 IP addresses, 40 domains and 18 file hashes. The full importable list is in section 10. Representative entries and the reasoning behind each severity choice are below.

Nothing in this pack ships at prevent or critical. All public reporting on STAC4749 traces back to a single vendor investigation, so the two-independent-source bar for a blocking indicator is not met. Promote to prevent once your own telemetry or a second vendor confirms a hit in your estate.

This intrusion spans three planes. Endpoint telemetry alone will catch the malware but not the entry, and identity telemetry alone will catch the entry but not the ransomware. Both are required for the correlation that makes this campaign cheap to detect.

Falcon cannot see step 1 of this chain. The queries below run outside the EDR and supply the identity half of the correlation that makes every endpoint query in section 8 dramatically more decisive.

Microsoft Purview / Teams unified audit log

• Search MessageSent, MessagesListed and ChatCreated operations where the initiating user's domain is external to your tenant. Rank external domains by how many distinct internal recipients they contacted in a day. A first-seen external domain fanning out to several employees within an hour is the signature of this campaign, regardless of what the domain is called.
• Filter specifically for external participants whose domain ends in .top, or whose display name contains helpdesk vocabulary such as IT, support, helpdesk, security, service or update. The observed personas used ordinary first-and-last-name pairs, so hunt the domain and the fan-out pattern rather than the name.
• Pull Teams call detail records for external inbound calls of 60 seconds or longer. The observed calls ran from roughly 90 seconds to over 20 minutes, clustering around two to two and a half minutes.
• Cross-reference the timestamp of any such call with the endpoint's first Quick Assist or RemSupp execution. That pairing is the single highest-value alert in this pack.

Entra ID

• Review Get-CsTenantFederationConfiguration for AllowFederatedUsers and the allowed and blocked domain lists. An empty allowlist with federation enabled means any tenant on the internet can chat your staff.
• Review Get-CsExternalAccessPolicy assignments. Look for a permissive global policy that was never overridden per-user.
• Check cross-tenant access settings for inbound B2B collaboration and B2B direct connect defaults.

Windows event logs (where Falcon coverage is thin or the host is unmanaged)

• Security 4688 process creation with command line, filtered to parent quickassist.exe, remsupp*.exe, dwagent*.exe or anydesk.exe.
• Security 4624 with LogonType 10 (RemoteInteractive) on hosts that had no RDP history, following an RDP enablement in the registry.
• Security 4657 registry value modification on the Run keys and on HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections. Requires SACL configuration to be useful.
• Microsoft-Windows-PowerShell/Operational 4104 script block logging for download cradles and for Unblock-File against a path in %AppData%.
• Sysmon 11 and 13, if deployed, for the Startup-folder .vbs drop and the Run-key write.

Network and DNS

• Query proxy and resolver logs for the payload cluster families listed in section 10, and for any newly registered .top domain resolved by a workstation.
• Alert on outbound tcp/443 to the C2 addresses in section 10 from any process that is not a browser or a known updater.
• Hunt for direct-to-IP HTTPS on 443 with no preceding DNS resolution, which is how the hard-coded gRPC loader C2 behaves.

File integrity and backup

• Alert on creation of any file named readme.chaos.txt on a file server or in a user share. This is a late signal but a cheap one.
• Alert on backup job failures or on deletion of backup catalogues that were not initiated by the backup service account.

Time windows are set in the console, not in the query. None of these queries carry an in-query timeframe filter. Set the range in the Falcon search bar. Suggested starting windows are noted per card.

// HUNT: Microsoft Quick Assist execution, ranked by fleet rarity
// MITRE: T1219 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: legitimate IT helpdesk sessions; Windows built-in support flows
// TUNING: exclude your helpdesk operator accounts and the support OU, e.g. add
// TUNING: | UserName!=/^(svc-helpdesk|it-support)/i  -- and drop hosts in the IT asset group
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^quickassist(\.exe)?$/i
| groupBy([ComputerName, UserName],
    function=[
      count(as=Launches),
      min(@timestamp, as=FirstSeen),
      max(@timestamp, as=LastSeen),
      collect([ParentBaseFileName, CommandLine], limit=5)
    ], limit=20000)
| sort(FirstSeen, order=desc, limit=500)

// HUNT: rare / first-seen remote-support and RMM tooling across the fleet
// MITRE: T1219 | CONF: medium  FP: medium  COST: medium
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: sanctioned RMM rollouts, MSP tooling, contractor laptops, IT pilots
// TUNING: raise the DistinctHosts ceiling above your sanctioned RMM's install count,
// TUNING: then drop your approved product from the FileName regex entirely so it
// TUNING: never competes with the rare tools you actually want to see
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(remsupp|dwagent|dwagsvc|dwrcs|anydesk|quickassist|teamviewer|screenconnect|connectwisecontrol|atera|splashtop|gotoassist|logmein|ultraviewer|rustdesk)[a-z0-9_\-]{0,12}(\.exe)?$/i
| groupBy([FileName],
    function=[
      count(aid, distinct=true, as=DistinctHosts),
      count(as=Executions),
      collect([ComputerName, UserName], limit=25),
      min(@timestamp, as=FirstSeen)
    ], limit=20000)
| DistinctHosts < 6
| sort(FirstSeen, order=desc, limit=200)

// HUNT: remote-support binary spawning a shell / script host / download utility
// MITRE: T1219, T1059.001 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: helpdesk staff running genuine remediation scripts in-session
// TUNING: if your helpdesk legitimately scripts in-session, keep the query and
// TUNING: exclude only their signed script paths via CommandLine, never the parent
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(quickassist|remsupp|dwagent|dwagsvc|dwrcs|anydesk|msra|teamviewer|screenconnect)[a-z0-9_\-]{0,12}(\.exe)?$/i
| FileName=/^(powershell|pwsh|cmd|mshta|wscript|cscript|curl|certutil|bitsadmin|rundll32|regsvr32|msiexec)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc, limit=500)

// HUNT: PowerShell download cradle writing an EXE into AppData / ProgramData / Temp
// MITRE: T1059.001, T1105 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// FALSE POSITIVES: software deployment scripts, dev tooling, package managers
// TUNING: exclude your deployment service account and the signed script directory,
// TUNING: e.g. | UserName!=/^svc-deploy$/i  and  | CommandLine!=/ProgramData\\PackageCache/i
// TUNING: keep Unblock-File in the OR list -- it is the strongest single token here
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(powershell|pwsh)(\.exe)?$/i
| CommandLine=/(Invoke-WebRequest|iwr\s|Start-BitsTransfer|DownloadFile|DownloadString|WebClient|Unblock-File)/i
| CommandLine=/(AppData|ProgramData|\\Temp\\|\$env:APPDATA|\$env:TEMP)/i
| CommandLine=/\.exe/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

// HUNT: STAC4749 randomised loader filename pattern at execution time
// MITRE: T1036, T1204.004 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: none observed for these specific prefixes
// TUNING: the ms prefix is the loosest of the set; if it produces noise from a
// TUNING: vendor updater, drop ms from the alternation and rely on Q6 for that shape
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(sekv|helper|74fs|7414fs|ms)[_\-]?[0-9]{6,12}[_\-]?(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, SHA256HashData, CommandLine])
| sort(@timestamp, order=desc, limit=500)

// HUNT: EXE with a randomised long numeric suffix written to a user-writable path
// MITRE: T1036, T1105 | CONF: medium  FP: medium  COST: medium
// REQUIRES: PeFileWritten / NewExecutableWritten
// FALSE POSITIVES: installer and updater caches (package managers, browser updaters,
// FALSE POSITIVES: EDR and RMM agents staging versioned payloads into ProgramData)
// TUNING: exclude the writing process first, not the path, e.g.
// TUNING: | ContextBaseFileName!=/^(msiexec|setup|teamsupdate|googleupdate|update)/i
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\(AppData|ProgramData)\\/i
| TargetFileName=/[a-z]{2,10}[_\-]?[0-9]{8,12}[_\-]?\.exe$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData])
| sort(@timestamp, order=desc, limit=500)

// HUNT: autostart value impersonating an audio driver but pointing at a user-writable path
// MITRE: T1547.001, T1036.005 | CONF: high  FP: low  COST: low
// REQUIRES: AsepValueUpdate / RegGenericValueUpdate
// FALSE POSITIVES: per-user portable audio utilities that self-install into AppData
// TUNING: keep the RegStringValue path condition -- it is the whole detection. If a
// TUNING: legitimate per-user audio tool fires, exclude it by its exact SHA256 via a
// TUNING: follow-up ProcessRollup2 pivot, never by widening the path filter
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName=/\\CurrentVersion\\Run/i
| RegValueName=/(Realtek|WinAudio|Audio\s?UHD|Universal\s?Service|SecurityHealth|OneDriveUpdate)/i
| RegStringValue=/\\(AppData|ProgramData|Users\\Public|Temp)\\/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc, limit=500)

// HUNT: wscript / cscript touching the Startup folder or a mklink-style VBS dropper
// MITRE: T1547.001, T1059.005 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// FALSE POSITIVES: legacy VBScript logon scripts placed in the Startup folder by GPO
// TUNING: enumerate your legitimate Startup .vbs set once, then exclude by exact path,
// TUNING: e.g. | CommandLine!=/legacy-mapdrives\.vbs/i -- do not exclude the folder
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^(wscript|cscript)(\.exe)?$/i
| CommandLine=/(\\Start Menu\\Programs\\Startup\\|mklink|\\AppData\\Roaming\\.{0,60}\.vbs)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

// HUNT: security software and system discovery command lines
// MITRE: T1518.001, T1082 | CONF: medium  FP: high  COST: medium
// REQUIRES: ProcessRollup2 with CommandLine
// FALSE POSITIVES: asset inventory agents, compliance scanners, vulnerability scanners,
// FALSE POSITIVES: helpdesk triage scripts, Defender health checks run by IT
// TUNING: run this host-scoped against a host already flagged by Q1-Q6 rather than
// TUNING: fleet-wide. Fleet-wide, first exclude your inventory agent by parent, e.g.
// TUNING: | ParentBaseFileName!=/^(ccmexec|amagent|nessusd|qualys-cloud-agent)/i
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(SecurityCenter2|AntiVirusProduct|AntiSpywareProduct|Get-MpComputerStatus|Get-MpPreference|wmic.{0,40}antivirus|reg\s+query.{0,60}CurrentVersion\\Uninstall)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

// HUNT: CopyQ executing from a user-writable path (trojanised archive / DLL side-load)
// MITRE: T1574.002 | CONF: medium  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// FALSE POSITIVES: users who legitimately run the portable CopyQ build from Downloads
// TUNING: confirm any hit against the vcruntime140_1.dll and copyq-13.0.0.zip hashes
// TUNING: in section 10 before escalating; a clean portable install is benign
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^copyq(\.exe)?$/i
| ImageFileName=/\\(AppData|ProgramData|Temp|Downloads|Users\\Public)\\/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData])
| sort(@timestamp, order=desc, limit=500)

// HUNT: RDP enablement via the Terminal Server registry key
// MITRE: T1021.001, T1112 | CONF: medium  FP: medium  COST: low
// REQUIRES: RegSystemConfigValueUpdate / RegGenericValueUpdate
// NOTE: RegStringValue is projected for context. On some sensor versions a DWORD
// NOTE: lands in a numeric field instead and this column reads empty.
// NOTE: field presence is tenant-specific -- validate in tenant before filtering on it.
// FALSE POSITIVES: sanctioned RDP enablement by GPO, SCCM, Intune or a build task
// TUNING: correlate each hit with a Q1/Q2/Q3 hit on the same ComputerName within the
// TUNING: preceding 24h. Standalone, exclude your management platform's service account
#event_simpleName=/^(RegSystemConfigValueUpdate|RegGenericValueUpdate|AsepValueUpdate)$/
| RegObjectName=/\\Terminal Server/i
| RegValueName=/^(fDenyTSConnections|UserAuthentication|fSingleSessionPerUser)$/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])
| sort(@timestamp, order=desc, limit=500)

// HUNT: STAC4749 Golang implant launched with its --token-raw authentication flag
// MITRE: T1105, T1036.005 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// FALSE POSITIVES: none observed. The flag is not used by common legitimate tooling.
// TUNING: if a bespoke internal tool uses this flag, exclude it by SHA256HashData,
// TUNING: never by FileName -- the implant names rotate and are generic by design
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/--token-raw/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, SHA256HashData, CommandLine])
| sort(@timestamp, order=desc, limit=500)

// HUNT: outbound connection to a published STAC4749 C2 address
// MITRE: T1071.001, T1090 | CONF: high  FP: low  COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: address reuse after the actor abandons the host; security tooling
// FALSE POSITIVES: detonating samples from a sandbox VM inside your address space
// TUNING: exclude your malware-analysis subnet by ComputerName before alerting
#event_simpleName=/^NetworkConnectIP4$/
| in(RemoteAddressIP4, values=[
    "94.140.114.192", "94.140.115.18", "94.140.115.129",
    "208.91.112.55", "193.29.57.37", "195.133.38.33",
    "95.81.118.189", "130.49.214.20", "2.58.15.231"
  ])
| table([@timestamp, ComputerName, aid, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: DNS for the STAC4749 payload-hosting cluster and named C2 domains
// MITRE: T1071.001, T1105 | CONF: high  FP: low  COST: medium
// REQUIRES: DnsRequest
// FALSE POSITIVES: threat-intel enrichment tooling and sandboxes resolving IOCs
// TUNING: exclude your TI platform and sandbox hosts by ComputerName. The family
// TUNING: fragments are typo-squats of "files download" and do not collide with
// TUNING: legitimate domains, so widen rather than narrow if the cluster rotates
#event_simpleName=/^DnsRequest$/
| DomainName=/(filesdwnld|filesdwnl|filesdwnload|filesdownld|filedwnld|fldwnld|flsdwnld|filldowl|dowlfles|downlfl|downlf|dwlfils|aohoodie|artcnb|legio\.name|jrown\.fun|imarketads)/i
| table([@timestamp, ComputerName, aid, UserName, ContextProcessId, DomainName])
| sort(@timestamp, order=desc, limit=1000)

// HUNT: shadow copy / backup catalogue / recovery destruction (Chaos pre-encryption)
// MITRE: T1490, T1489 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 with CommandLine
// FALSE POSITIVES: backup and imaging software pruning shadow copies on schedule;
// FALSE POSITIVES: SCCM / imaging task sequences calling bcdedit during a rebuild
// TUNING: exclude your backup agent by parent, e.g.
// TUNING: | ParentBaseFileName!=/^(veeam|beremote|backupexec|acronis|sqlservr)/i
// TUNING: keep vssadmin delete shadows unexcluded on workstations regardless
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(vssadmin.{0,40}delete.{0,20}shadow|wmic.{0,30}shadowcopy.{0,20}delete|wbadmin.{0,30}delete.{0,20}catalog|bcdedit.{0,40}(recoveryenabled|bootstatuspolicy)|Disable-ComputerRestore|Win32_ShadowCopy.{0,40}Delete)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine])
| sort(@timestamp, order=desc, limit=500)

// HUNT: single process touching a large number of files (encryption burst)
// MITRE: T1486 | CONF: medium  FP: medium  COST: medium
// REQUIRES: RansomwareOpenFile
// FALSE POSITIVES: backup agents, search indexers, AV full scans, bulk file migrations
// TUNING: exclude the known bulk readers by process before alerting, e.g.
// TUNING: | ContextBaseFileName!=/^(searchindexer|veeamagent|robocopy|mssense)/i
// TUNING: then tune FilesTouched to just above your noisiest surviving process
#event_simpleName=/^RansomwareOpenFile$/
| groupBy([ComputerName, ContextBaseFileName],
    function=[
      count(as=FilesTouched),
      min(@timestamp, as=FirstSeen),
      max(@timestamp, as=LastSeen)
    ], limit=20000)
| FilesTouched > 200
| sort(FilesTouched, order=desc, limit=200)

Four of the sixteen queries are strong enough to promote from Investigate-only to a Custom IOA. The rest stay as scheduled hunts because their false-positive profile depends on how your helpdesk works.

Deployment path

1. Falcon console, Endpoint security, Custom IOA rule groups. Create a Windows rule group named for this campaign.
2. Build each rule in Monitor action first. Leave it there for a full business week including a patch cycle.
3. Review every hit. Add exclusions in the rule, not in the prevention policy.
4. Promote to Detect once the rule has produced zero unexplained hits for five consecutive business days. Q12 is the only rule that should reach Critical severity.
5. Assign the rule group to a pilot host group before the full estate.

Do not promote Q9, Q15 or Q16 to a blocking IOA. Q9 is high-FP discovery telemetry. Q15 and Q16 fire on behaviour that legitimate backup and indexing software also performs, and a blocking rule there risks breaking your recovery path at exactly the moment you need it.

70 atomic indicators, each traced back to a saved source snapshot. Nothing here is at prevent or critical severity, see section 2 for why. Copy each block straight into the tool it names.

type,value,action,severity,expiration,description,tags
# STAC4749 / Chaos ransomware. Source: SophosLabs IoCs STAC4749-Chaos_IOCs_July2026.csv + Sophos X-Ops blog.
# No row ships at prevent/critical: all public reporting traces to one vendor investigation.
# --- C2 and payload staging addresses (endpoint-observable) ---
ipv4,94.140.114.192,detect,high,2027-02-04,STAC4749 hard-coded loader gRPC C2 on tcp 443,campaign:STAC4749
ipv4,94.140.115.18,detect,high,2027-02-04,STAC4749 hard-coded loader gRPC C2 on tcp 443,campaign:STAC4749
ipv4,94.140.115.129,detect,high,2027-02-04,STAC4749 hard-coded loader gRPC C2 on tcp 443,campaign:STAC4749
ipv4,208.91.112.55,detect,high,2027-02-04,STAC4749 payload staging server,campaign:STAC4749
ipv4,193.29.57.37,detect,high,2027-02-04,STAC4749 payload staging server,campaign:STAC4749
ipv4,195.133.38.33,detect,high,2027-02-04,STAC4749 Python backdoor C2,campaign:STAC4749
ipv4,95.81.118.189,detect,high,2027-02-04,STAC4749 Golang implant C2,campaign:STAC4749
ipv4,130.49.214.20,detect,high,2027-02-04,STAC4749 Golang implant C2,campaign:STAC4749
ipv4,2.58.15.231,detect,high,2027-02-04,STAC4749 Golang implant C2,campaign:STAC4749
# --- Teams vishing call sources. Identity plane. Monitor only. ---
ipv4,93.88.205.136,no_action,informational,2026-09-04,Source of STAC4749 Teams vishing calls,campaign:STAC4749
ipv4,5.8.18.80,no_action,informational,2026-09-04,Source of STAC4749 Teams vishing calls,campaign:STAC4749
ipv4,2.58.14.254,no_action,informational,2026-09-04,Source of STAC4749 Teams vishing calls,campaign:STAC4749
# --- Payload-hosting cluster (Cloudflare-fronted; rotates weekly) ---
domain,stats09.filldowl.online,detect,high,2027-02-04,STAC4749 payload staging,campaign:STAC4749
domain,de3.filedwnld.top,detect,high,2027-02-04,STAC4749 payload staging (CopyQ archive),campaign:STAC4749
domain,dl2.filesdwnl.top,detect,high,2027-02-04,STAC4749 loader staging,campaign:STAC4749
domain,fa4.fldwnld.online,detect,high,2027-02-04,STAC4749 backdoor staging,campaign:STAC4749
domain,fa2.filesdwnload.top,detect,high,2027-02-04,STAC4749 backdoor and implant staging,campaign:STAC4749
domain,fa3.filesdownld.top,detect,high,2027-02-04,STAC4749 Golang implant staging,campaign:STAC4749
domain,fa5.flsdwnld.online,detect,high,2027-02-04,STAC4749 implant and proxy staging,campaign:STAC4749
domain,fa16.dwlfils.online,detect,high,2027-02-04,STAC4749 backdoor staging,campaign:STAC4749
domain,fa103.aohoodie.com,detect,high,2027-02-04,STAC4749 Golang implant staging,campaign:STAC4749
domain,re1.filesdwnld.top,detect,high,2027-02-04,STAC4749 payload staging,campaign:STAC4749
domain,re2.filesdwnload.top,detect,high,2027-02-04,STAC4749 loader staging,campaign:STAC4749
domain,re4.fldwnld.online,detect,high,2027-02-04,STAC4749 loader staging,campaign:STAC4749
domain,re5.flsdwnld.online,detect,high,2027-02-04,STAC4749 backdoor staging,campaign:STAC4749
domain,re8.dowlfles.online,detect,high,2027-02-04,STAC4749 payload staging,campaign:STAC4749
domain,re19.downlf.online,detect,high,2027-02-04,STAC4749 payload staging,campaign:STAC4749
domain,re20.downlfl.online,detect,high,2027-02-04,STAC4749 payload staging,campaign:STAC4749
domain,re103.aohoodie.com,detect,high,2027-02-04,STAC4749 C2,campaign:STAC4749
domain,re104.artcnb.com,detect,high,2027-02-04,STAC4749 C2,campaign:STAC4749
# --- Named C2 domains ---
domain,legio.name,detect,high,2027-02-04,STAC4749 reverse SOCKS proxy C2 (sc5.exe),campaign:STAC4749
domain,jrown.fun,detect,high,2027-02-04,STAC4749 backdoor C2,campaign:STAC4749
domain,imarketads.com,detect,high,2027-02-04,STAC4749 sideloaded DLL C2,campaign:STAC4749
# --- Cloudflare Workers subdomains. Specific subdomains only. ---
# The bare workers.dev apex is shared infrastructure and is deliberately NOT listed.
domain,conf.grahql.workers.dev,detect,medium,2026-11-04,STAC4749 backdoor C2,campaign:STAC4749
domain,api.grahql.workers.dev,detect,medium,2026-11-04,STAC4749 backdoor C2,campaign:STAC4749
domain,webconf.shop-api.workers.dev,detect,medium,2026-11-04,STAC4749 backdoor C2,campaign:STAC4749
# --- Fake IT-helpdesk Teams tenant domains. Primary value is the Teams allowlist. ---
domain,sequrityupdate.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,scan-security.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,system-online.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,system-connect.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,corp-connect.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,info-secure.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,supportsoft.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,update-syscontrol.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,sequpdate.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,service-clien.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,service-corporation.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,scansequrity.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,service-help.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,it-service.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,sequritycheck.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
domain,upsecscan.top,detect,medium,2026-11-04,STAC4749 Teams vishing tenant domain,campaign:STAC4749
# --- First-stage loaders ---
sha256,1cf3131b6f487067b3746dd4743544fbbfa553fb2941176b8213996aac61425c,detect,high,2027-02-04,STAC4749 loader sekv,campaign:STAC4749
sha256,746a693e2ba1bb50b941a6ea30026cce02ab9b64ffb9fa6168a62f7aa9557f0a,detect,high,2027-02-04,STAC4749 loader sekv,campaign:STAC4749
sha256,23cb533bc3a5b535c06c8f0865e6cdebf442d56a7ac275baddcb9785279e4b88,detect,high,2027-02-04,STAC4749 loader helper,campaign:STAC4749
sha256,44f8bd68487d0c40227ed44321cf16fc4a34d645252e98d6ba3f81e9f05e7900,detect,high,2027-02-04,STAC4749 loader helper,campaign:STAC4749
sha256,d5572db12b800e87f986ef1138690ec5e17dfa5a0720dc75d453233ada88ee6d,detect,high,2027-02-04,STAC4749 loader helper,campaign:STAC4749
sha256,2d8ea8fb20f1311e04ea88baa7cff957f6cb73899a524dc2bd39523e14ab022f,detect,high,2027-02-04,STAC4749 loader helper,campaign:STAC4749
# --- Python backdoors and reverse proxy ---
sha256,bb96d21b7a61628724f13c6d4506b9d7bb56020d1c41fc79310f74666bb75904,detect,high,2027-02-04,STAC4749 Python backdoor updater,campaign:STAC4749
md5,36e80c375861d3ff0a55d5e49c8fe12e,detect,high,2027-02-04,STAC4749 Python backdoor msupdate (vendor sha256 malformed),campaign:STAC4749
sha256,35a75212862ce719ae6de1758949be33a3de787fab31e2d98436bacce8369d92,detect,high,2027-02-04,STAC4749 reverse SOCKS proxy sc5,campaign:STAC4749
# --- Golang implants ---
sha256,94b66ac8391ca543b0dffde6a2d475d29afce6fe32995eda76d379553da68407,detect,high,2027-02-04,STAC4749 Golang implant autumn,campaign:STAC4749
sha256,9faa993d608c09eed5dcc9c945b8dd07431fcc192f0232ef379293622a1f3586,detect,high,2027-02-04,STAC4749 Golang implant graph,campaign:STAC4749
sha256,c2fa32ac59f6424657a8513a7f158082877b97436b8502c3879f5736713e2132,detect,high,2027-02-04,STAC4749 Golang implant tube,campaign:STAC4749
sha256,3f0dbc159dcdfb884ebc577dfe873d468617bf5a483bf832469cd209efbe84d4,detect,high,2027-02-04,STAC4749 Golang implant midnight,campaign:STAC4749
sha256,95fcab7e8892cb87bcadb523a4491bf10ee0788b859647ca7cca1e1d92d7519a,detect,high,2027-02-04,STAC4749 Golang implant agree,campaign:STAC4749
sha256,219aa20e572dee9d1ef47ae1c33a851fc4fcecc5a45d15ce80c863da67cfeb10,detect,high,2027-02-04,STAC4749 Golang implant dizzy,campaign:STAC4749
sha256,65060c1d1c6020ac445ea7b394ef9b1bd9aa23f27d9a508470403c7296924ce8,detect,high,2027-02-04,STAC4749 Golang implant confirm,campaign:STAC4749
# --- DLL side-loading pair ---
sha256,cd3163a308ba40c3a5e153c0326b7cf23a36debb6255624f9afb7e7ca5182391,detect,high,2027-02-04,STAC4749 malicious vcruntime140_1.dll,campaign:STAC4749
sha256,d8fed5a9fa8baee68d241190f29a2e91f5c549a684cb66c92de3974fc9f3db22,detect,high,2027-02-04,STAC4749 trojanised copyq archive,campaign:STAC4749

STAC4749 behavioural signatures. These survived every rotation between Feb and Jun 2026.

1. IDENTITY-TO-ENDPOINT PIVOT  (highest value; requires both data sets)
   External federated Teams chat or call from a non-allowlisted domain
   THEN within 60 minutes on the same user's host:
   quickassist.exe OR remsupp*.exe OR dwagent*.exe OR anydesk.exe starts.

2. REMOTE-SUPPORT PARENTAGE
   Parent = quickassist.exe / remsupp* / dwagent* / dwrcs* / anydesk
   Child  = powershell / pwsh / cmd / mshta / wscript / cscript / curl /
            certutil / bitsadmin / rundll32 / regsvr32 / msiexec

3. IMPLANT AUTHENTICATION FLAG
   Any process command line containing:  --token-raw
   Single most durable string in the toolkit. Names rotate; this did not.

4. LOADER NAME SHAPE
   Short alpha prefix + optional underscore + 6-12 random digits + .exe
   in AppData\Roaming, AppData\Local\Temp or ProgramData.
   Observed prefixes: sekv_  helper_  74fs_  7414fs  ms_

5. AUDIO-DRIVER MASQUERADE
   HKCU ...\CurrentVersion\Run value named:
     Realtek HD Audio / Realtek HD Audio Universal Service /
     Realtek Audio / Realtek Audio UHD / WinAudio life2 /
     SecurityHealth / OneDriveUpdate
   whose DATA points into AppData, ProgramData, Temp or Users\Public.
   Genuine Realtek autostarts never point at a user-writable path.

6. STARTUP VBS SHORTCUT
   mklink-style .vbs creating a hidden shortcut in
   %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup

7. PYTHON BACKDOOR ARTEFACTS
   PyInstaller unpack artefacts: AppData\Local\Temp\base_library.zip
   PyArmour-obfuscated bytecode; AES key and IV fetched from a public
   GitHub repository at runtime.
   Log path artefact: C:\ProgramData\AppSreen\logs\appscreen.log
   (note the misspelling of "AppScreen" -- it is the actor's, not a typo)

8. TLS CERTIFICATE PINNING ISSUERS
   Custom CA issuer common names seen on the C2 certificates:
     loop-CA        connectify-CA        james-bond-CA
   Hunt these in TLS inspection / JA3 / certificate logs if available.

9. RANSOMWARE STAGE
   vssadmin delete shadows / wmic shadowcopy delete /
   wbadmin delete catalog / bcdedit recoveryenabled No
   THEN simultaneous mass encryption across hosts,
   THEN ransom note:  readme.chaos.txt

10. OPERATOR ARTEFACT
   Commands mistyped in a Cyrillic keyboard layout appearing in shell
   history is a strong hands-on-keyboard indicator for this actor.

STAC4749 tooling. NONE of this belongs on a flat blocklist.
Every entry is either legitimate software or a name too generic to alert on.

LEGITIMATE TOOLS ABUSED  -- hunt contextually, never block by name
  quickassist.exe        Microsoft Quick Assist, the preferred entry tool
  RemSupp                cloud RMM, preferred from April 2026 onward
  DWAgent / dwagsvc      redundant remote access in ransomware cases
  AnyDesk                redundant remote access in ransomware cases
  msconfig.exe           used to enable RDP service configuration
  CopyQ                  clipboard manager used as a DLL side-loading host
  Remote Desktop         enabled via HKLM ...\Terminal Server\fDenyTSConnections

MALWARE FILENAMES  -- too generic or too volatile to alert on by name.
Use the hashes in the CSV block and the behaviours above instead.
  Loaders     sekv_<10 digits>.exe   helper_<10 digits>.exe
              74fs_<10 digits>.exe   7414fs*.exe   ms_876234.exe
              45234ssdf403851640.exe
  Backdoors   updater.exe   msupdate.exe   path1.exe
  Golang      graph.exe  confirm.exe  midnight.exe  shield.exe  tube.exe
              dizzy.exe  agree.exe  autumn.exe  left.exe  nation.exe
              hire.exe   WiSec.exe   graph3.exe
              ^ single-word English nouns, chosen to defeat name-based rules
  Proxy       sc5.exe  (reverse SOCKS, ~1000 concurrent connections)
  Side-load   vcruntime140_1.dll inside copyq-13.0.0.zip

PERSISTENCE VALUE NAMES  -- alert only WITH a user-writable target path
  Realtek HD Audio                Realtek HD Audio Universal Service
  Realtek Audio                   Realtek Audio UHD
  WinAudio life2                  SecurityHealth
  OneDriveUpdate                  mklink-%.vbs

RANSOM NOTE
  readme.chaos.txt

VISHING PERSONA DISPLAY NAMES  -- context only, trivially changed
  AnthonyBrooks  DylanHarper   EthanParker    DylanHartman
  JasonMitchell  DylanFoster   EllaBrooks     RyanBennett
  LoganCooper    LoganMitchell NicholasGrant  TimothyPorter

# STAC4749 exposure audit. Run before anything else.
# Requires the MicrosoftTeams PowerShell module and a Teams Administrator role.

Connect-MicrosoftTeams

# 1. Can any tenant on the internet chat your staff right now?
Get-CsTenantFederationConfiguration |
  Select-Object AllowFederatedUsers, AllowPublicUsers,
                AllowedDomains, BlockedDomains,
                AllowTeamsConsumer, AllowTeamsConsumerInbound

#    AllowFederatedUsers = True with an EMPTY AllowedDomains list means
#    open federation. That is the precondition this campaign requires.

# 2. Which external-access policies are actually assigned?
Get-CsExternalAccessPolicy |
  Select-Object Identity, EnableFederationAccess,
                EnablePublicCloudAccess, EnableTeamsConsumerAccess

# 3. Block the known vishing tenant domains immediately.
#    This is a stopgap. The domain-allowlist control in Playbook P1 is the fix.
$stac4749 = @(
  "sequrityupdate.top","scan-security.top","system-online.top",
  "system-connect.top","corp-connect.top","info-secure.top",
  "supportsoft.top","update-syscontrol.top","sequpdate.top",
  "service-clien.top","service-corporation.top","scansequrity.top",
  "service-help.top","it-service.top","sequritycheck.top","upsecscan.top"
)
$blocked = (Get-CsTenantFederationConfiguration).BlockedDomains.Domain
$stac4749 | Where-Object { $_ -notin $blocked } |
  ForEach-Object { "MISSING FROM BLOCKLIST: $_" }

# 4. Is Quick Assist reachable by standard users?
Get-AppxPackage -AllUsers -Name "MicrosoftCorporationII.QuickAssist" |
  Select-Object Name, Version, InstallLocation

# 5. Which endpoints already have an unsanctioned remote-support tool?
#    Cross-check against Falcon Q2 output before treating any as benign.
Get-CimInstance -ClassName Win32_Product |
  Where-Object { $_.Name -match "AnyDesk|DWAgent|RemSupp|TeamViewer|ScreenConnect" } |
  Select-Object Name, Version, InstallDate

Work these four gates in order. A query that has not cleared all four is not a detection, it is a hypothesis.

Gate 1 — Telemetry ready

• Confirm ProcessRollup2 events carry a populated CommandLine in your tenant. Q4, Q8, Q9, Q12 and Q15 are worthless without it.
• Confirm AsepValueUpdate and RegGenericValueUpdate are flowing. Run a Run-key write on a test host and verify it lands.
• Confirm RegStringValue is populated for the registry events you receive. On some sensor versions a DWORD write lands in a numeric field and Q11's value column reads empty. This is the one field in the pack flagged ⚠ validate in tenant.
• Confirm the Purview unified audit log is enabled and that Teams chat and call events are being retained. Without this, the highest-value correlation in the pack cannot be built.
• Confirm RansomwareOpenFile is present. It depends on your prevention policy configuration.

Gate 2 — Benign baseline

• Run Q1, Q2, Q9, Q15 and Q16 over 30 days with no exclusions. Record the hit count and the top ten contributing processes or accounts for each.
• Any query returning more than roughly 50 hits per day fleet-wide needs its exclusion list built before it is scheduled, not after.
• Q3, Q5, Q7, Q10, Q12, Q13 and Q14 should return zero or near-zero in a clean estate. A non-zero result on any of those is an investigation, not a tuning task.

Gate 3 — Positive test

• Q3: launch Quick Assist on a lab host and start PowerShell from inside the session. The query must return the pair.
• Q5 and Q6: write and execute a benign signed binary renamed to helper_1234567890.exe in %APPDATA%.
• Q7: create an HKCU Run value named Realtek Audio UHD pointing at a benign EXE in %APPDATA%, then delete it.
• Q12: run any benign binary with --token-raw=test appended. The query must return it.
• Q13 and Q14: use your TI platform's detonation host, or add one indicator to a lab DNS sinkhole and resolve it.
• Q15: run vssadmin list shadows first to confirm the process is visible, then a scoped delete in a snapshot-protected lab VM only.

Gate 4 — Promotion criteria

• Five consecutive business days with zero unexplained hits before any query becomes a Custom IOA.
• Every IOA starts in Monitor. Nothing goes straight to Detect.
• Each promoted rule carries a documented rollback: the rule group name, the assigned host group, and the person who can disable it out of hours.
• Re-baseline after each of your own RMM or backup software upgrades. Those are the two products most likely to break these exclusion lists.

This campaign exploits no vulnerability, so there is nothing to patch. The controls below remove the preconditions instead: open Teams federation, unrestricted remote-support tooling, and a user account with enough privilege to persist. Each control cites a MITRE mitigation for the why and a platform authority for the what.

Five playbooks covering the highest-leverage controls. Every step carries prerequisites, reboot impact and a rollback. Test each in a pilot ring before estate-wide deployment.

P1 — Restrict Microsoft Teams external access to an allowlist (control H1, H2)

Prerequisites: MicrosoftTeams PowerShell module v5.0 or later; Teams Administrator or Global Administrator role; an agreed list of partner domains from the business. Reboot required: none. Changes propagate across the tenant in up to 24 hours. Rollback: capture the current configuration to JSON first (step 1), then re-apply it with Set-CsTenantFederationConfiguration. Reverting restores open federation, so treat the rollback as an incident in its own right and time-box it.

Connect-MicrosoftTeams

# STEP 1 -- CAPTURE ROLLBACK STATE BEFORE CHANGING ANYTHING
$backup = Get-CsTenantFederationConfiguration
$backup | ConvertTo-Json -Depth 6 |
  Out-File "C:\Admin\rollback-teams-federation-2026-08-04.json"

# STEP 2 -- define the partner domains the business actually needs
$allow = @("partner-one.example.com","partner-two.example.com")
$allowList = $allow | ForEach-Object { New-CsEdgeDomainPattern -Domain $_ }
$allowObj  = New-CsEdgeAllowList -AllowedDomain $allowList

# STEP 3 -- switch federation from open to allowlist-only
Set-CsTenantFederationConfiguration `
  -AllowFederatedUsers $true `
  -AllowedDomains $allowObj `
  -AllowPublicUsers $false `
  -AllowTeamsConsumer $false `
  -AllowTeamsConsumerInbound $false

# STEP 4 -- verify
Get-CsTenantFederationConfiguration |
  Select-Object AllowFederatedUsers, AllowPublicUsers,
                AllowTeamsConsumer, AllowTeamsConsumerInbound,
                @{n="Allowed";e={ $_.AllowedDomains.AllowedDomain.Domain }}

# ROLLBACK (only with documented approval)
# $r = Get-Content "C:\Admin\rollback-teams-federation-2026-08-04.json" | ConvertFrom-Json
# Set-CsTenantFederationConfiguration -AllowFederatedUsers $r.AllowFederatedUsers `
#   -AllowPublicUsers $r.AllowPublicUsers -AllowTeamsConsumer $r.AllowTeamsConsumer

P2 — Block Quick Assist and unsanctioned RMM via AppLocker (control H3, H7)

Prerequisites: Application Identity service (AppIDSvc) set to Automatic; an existing AppLocker policy or a decision to create one; a security group containing your genuine support staff; a pilot host group. Reboot required: no reboot, but AppIDSvc must be started and a policy refresh applied. Sessions already running a blocked binary are not terminated, so schedule a logoff cycle. Rollback: export the effective policy before merging (step 1) and re-import it with Set-AppLockerPolicy -XmlPolicy, which replaces rather than merges. If AppLocker locks out a business-critical tool out of hours, setting AppIDSvc to Manual and stopping it disables enforcement immediately as a break-glass measure.

# STEP 1 -- CAPTURE ROLLBACK STATE
Get-AppLockerPolicy -Effective -Xml |
  Out-File "C:\Admin\rollback-applocker-2026-08-04.xml" -Encoding utf8

# STEP 2 -- ensure the enforcement service is running
Set-Service -Name AppIDSvc -StartupType Automatic
Start-Service -Name AppIDSvc

# STEP 3 -- author the deny rules.
# Deploy as a GPO under:
#   Computer Configuration > Windows Settings > Security Settings
#     > Application Control Policies > AppLocker > Executable Rules
#
# Rule 1  DENY  Publisher: MicrosoftCorporationII.QuickAssist  (all versions)
#               Except: security group CORP-IT-Support
# Rule 2  DENY  Path: *\remsupp*.exe
# Rule 3  DENY  Path: *\dwagent*.exe  and  *\dwagsvc*.exe  and  *\dwrcs*.exe
# Rule 4  DENY  Path: *\anydesk*.exe
# Rule 5  DENY  Path: *\screenconnect*.exe  and  *\connectwisecontrol*.exe
# Rule 6  DENY  Path: *\rustdesk*.exe  and  *\ultraviewer*.exe
# Rule 7  DENY  Path: *\atera*.exe  and  *\splashtop*.exe  and  *\logmein*.exe
# Rule 8  DENY  Path: %OSDRIVE%\Users\*\AppData\Local\Temp\*.exe
#               Except: your software-deployment service account
#
# Deny rules override allow rules in AppLocker, so these take precedence
# over any broad "allow Program Files" rule already in the policy.

# STEP 4 -- start in AUDIT ONLY on the pilot ring
Set-AppLockerPolicy -XmlPolicy "C:\Admin\rmm-deny.xml" -Merge

# STEP 5 -- review what WOULD have been blocked, for at least 5 business days
Get-WinEvent -LogName "Microsoft-Windows-AppLocker/EXE and DLL" |
  Where-Object { $_.Id -in 8003,8006 } |
  Select-Object TimeCreated, Id, Message -First 200

# STEP 6 -- only after a clean audit week, switch the rule collection to Enforce.

# ROLLBACK
# Set-AppLockerPolicy -XmlPolicy "C:\Admin\rollback-applocker-2026-08-04.xml"
# BREAK-GLASS: Stop-Service AppIDSvc ; Set-Service AppIDSvc -StartupType Manual

P3 — Enable the four relevant ASR rules (control H4)

Prerequisites: Microsoft Defender Antivirus in active mode (not passive) with real-time protection on; Defender platform version 4.18.2201 or later; local administrator or Intune. Reboot required: none. Rules take effect immediately. Rollback: set the same GUIDs to Disabled, or to AuditMode to keep visibility without enforcement. The Remove-MpPreference form in the rollback block clears the rule entirely rather than leaving it disabled, which is the cleaner state to return to.

# Run elevated. Deploy via Intune Endpoint Security -> Attack Surface Reduction
# for the estate; this form is for the pilot ring and for verification.

# STEP 1 -- CAPTURE ROLLBACK STATE
Get-MpPreference |
  Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids |
  Out-File "C:\Admin\rollback-asr-ids-2026-08-04.txt"
Get-MpPreference |
  Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions |
  Out-File "C:\Admin\rollback-asr-actions-2026-08-04.txt"

# STEP 2 -- start in AUDIT mode (value 2). Do not skip this.
$rules = @(
  "BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550",  # block exe content from email/webmail
  "D3E037E1-3EB8-44C8-A917-57927947596D",  # block JS/VBS launching downloaded exe
  "5BEB7EFE-FD9A-4556-801D-275E5FFC04CC",  # block obfuscated scripts
  "D1E49AAC-8F56-4280-B9BA-993A6D77406C"   # block process creation from PSExec/WMI
)
foreach ($id in $rules) {
  Add-MpPreference -AttackSurfaceReductionRules_Ids $id `
                   -AttackSurfaceReductionRules_Actions AuditMode
}

# STEP 3 -- after 5 clean business days, switch to Enabled (block).
# foreach ($id in $rules) {
#   Set-MpPreference -AttackSurfaceReductionRules_Ids $id `
#                    -AttackSurfaceReductionRules_Actions Enabled
# }

# STEP 4 -- verify
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids,
                                 AttackSurfaceReductionRules_Actions

# ROLLBACK
# foreach ($id in $rules) { Remove-MpPreference -AttackSurfaceReductionRules_Ids $id }

P4 — Enforce RDP-disabled on workstations and audit the key (control H10)

Prerequisites: a GPO scoped to the workstation OU only, never to servers or to jump hosts; confirmation from IT that no support workflow depends on workstation RDP. Reboot required: none for the policy value. A reboot or gpupdate /force applies it, and any existing RDP session survives until it is disconnected. Rollback: set the GPO value back to Disabled for the "Allow users to connect remotely" setting, or unlink the GPO. Because this is enforced by policy rather than a one-off registry write, an attacker's local change is reverted at the next refresh, which is the entire point of doing it this way.

# GPO PATH (preferred -- survives a local registry write by an attacker)
#   Computer Configuration > Policies > Administrative Templates
#     > Windows Components > Remote Desktop Services
#     > Remote Desktop Session Host > Connections
#   "Allow users to connect remotely by using Remote Desktop Services" = Disabled
#
# Where RDP IS required, in the same node set:
#   "Require user authentication for remote connections by using
#    Network Level Authentication" = Enabled

# VERIFY the effective state on a host (1 = RDP denied)
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" `
                 -Name fDenyTSConnections |
  Select-Object fDenyTSConnections

# AUDIT the key so an attacker's attempt is logged even when policy reverts it.
# Enable: Computer Configuration > Policies > Windows Settings > Security
#         Settings > Advanced Audit Policy > Object Access > Audit Registry
# Then set a SACL on the Terminal Server key for "Set Value" by Everyone.
# Resulting events: Security 4657. Feeds the section 7 native hunt.

# ROLLBACK
# Set the GPO setting to "Disabled" -> reverts to allowing RDP, or unlink the GPO.
# Emergency single-host restore (requires local admin, use sparingly):
# Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" `
#                  -Name fDenyTSConnections -Value 0

P5 — PowerShell script block logging and transcription (control H9)

Prerequisites: a write-restricted network share or SIEM forwarder for transcripts; log volume budget (script block logging is verbose); PowerShell 5.1 or later. Reboot required: none. New PowerShell sessions pick the policy up immediately; existing sessions do not. Rollback: set both policy values to Disabled, or delete the registry keys created below. Rollback is safe and immediate, but understand that it removes the only forensic record of a download cradle, so prefer reducing retention over disabling collection.

# GPO PATH (preferred)
#   Computer Configuration > Policies > Administrative Templates
#     > Windows Components > Windows PowerShell
#   "Turn on PowerShell Script Block Logging"  = Enabled
#   "Turn on Module Logging"                   = Enabled  (module names: *)
#   "Turn on PowerShell Transcription"         = Enabled
#        Transcript output directory: \\logsrv\pstranscripts$
#        (share must be append-only to the workstation computer accounts)

# EQUIVALENT REGISTRY FORM, for a pilot host. Run elevated.
$sb = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
$tr = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription"
New-Item -Path $sb -Force | Out-Null
New-Item -Path $tr -Force | Out-Null
Set-ItemProperty -Path $sb -Name EnableScriptBlockLogging -Value 1 -Type DWord
Set-ItemProperty -Path $tr -Name EnableTranscripting       -Value 1 -Type DWord
Set-ItemProperty -Path $tr -Name EnableInvocationHeader    -Value 1 -Type DWord
Set-ItemProperty -Path $tr -Name OutputDirectory `
                 -Value "\\logsrv\pstranscripts$" -Type String

# VERIFY -- run a harmless command, then confirm a 4104 event exists
Write-Output "asr-validation-probe"
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -MaxEvents 20 |
  Where-Object { $_.Id -eq 4104 } |
  Select-Object TimeCreated, Id -First 5

# ROLLBACK
# Remove-Item -Path $sb -Recurse -Force
# Remove-Item -Path $tr -Recurse -Force

Assume a 17-hour clock. The fastest observed intrusion went from first Teams contact to encryption in under 17 hours. If Q3, Q5, Q7 or Q12 fires, treat it as an active hands-on-keyboard intrusion, not a malware alert, and start Phase 1 immediately rather than queueing it for triage.

Validation gates. Section 11 defines the four gates every query must clear before it is trusted: telemetry confirmed present in the tenant (including the one field flagged ⚠ validate in tenant, RegStringValue on registry events in Q11), a 30-day benign baseline with exclusions built before scheduling rather than after, a positive test that proves each query actually fires, and a promotion rule of five consecutive clean business days in Monitor before any Custom IOA reaches Detect. Sixteen queries ship. Seven rate CONF high, six medium and none low, with three carrying an FP risk of medium or higher and one (Q9) rated high FP and explicitly scoped to host-level corroboration rather than fleet-wide alerting.

The dominant gap is structural, not a missing query. Four of the sixteen mapped techniques have no endpoint detection because they do not happen on the endpoint. Until the Teams and Entra audit data in section 7 is joined to the Falcon data in section 8, this pack detects the intrusion from step 2 onward and never sees step 1. Closing that join is worth more than any additional CQL.

Planned for v0.2: a joined Teams-to-endpoint correlation query once the Purview and Falcon data sets are in the same search head, and a volumetric egress hunt to close the exfiltration gap noted in section 15.

Source snapshots. The verbatim fetched text of all five threat-intelligence sources is stored alongside this pack in STAC4749-TeamsVishing-Chaos-Hunt-sources/. Every atomic indicator in section 10 was traced back to those files mechanically before publication.