TELESHIM · MIXEDKEY · BINDCLOAK

Zscaler ThreatLabz reported on 2026-07-20 that a threat actor with links to East Asia is running a multi-stage espionage operation against government entities in the Middle East. The actor's objective is durable, low-noise remote access to government hosts, and the whole design is built around blending with normal traffic and normal filenames rather than around speed or destruction.

Access begins with a ZIP containing an ISO/IMG disk image whose lure themes are diplomatic and energy documents (a petroleum and gas exploration cooperation protocol, an agreement on common border offices). The image carries a legitimately signed ASUSTek binary, RegSchdTask.exe, next to a malicious AsTaskSched.dll. Running the signed binary sideloads the DLL, which is the first-stage backdoor TELESHIM. TELESHIM copies itself to C:\programdata\shimgen_Data\, registers a scheduled task named shimgen that fires every 6 minutes, and then polls the Telegram Bot API for operator commands. After recon, the operator stages a second sideload pair in a plausible-looking C:\ProgramData\<vendor>\ directory (a renamed legitimate GoPro binary plus a malicious pthreadVC2.dll) and a second scheduled task named Feedback running every 10 minutes. That DLL is MIXEDKEY, a reflective loader which decrypts the final implant BINDCLOAK using a key derived from the host's volume serial number, then loads it in memory. BINDCLOAK beacons to cert[.]hypersnet[.]com.

The highest-value defensive angle is the persistence pair, not the malware. Every hash in this pack is perishable and two of the three components are only ever on disk as a DLL next to a signed binary the actor did not write. What the actor cannot easily change is the shape: a minute-interval scheduled task launching a signed vendor executable out of C:\ProgramData\, whose child processes are net, tasklist, ipconfig and netstat. That combination is close to nonexistent in a clean estate and it catches all three stages at once. Hunt it first (Q1, Q2, Q8).

The second-highest angle is the C2 channel's own weakness. Using api.telegram.org hides the destination but not the behaviour: a 6-minute poll interval produces a metronome-regular request pattern from a process that has no business talking to Telegram at all. On a government estate where Telegram is not sanctioned business software, any host resolving api.telegram.org from a non-browser process is worth a look (Q7).

Defender priority: today, sweep for scheduled tasks named shimgen or Feedback with a minute-level repeat interval, and for any process running out of C:\programdata\shimgen_Data\ or writing AsTaskSched.dll / pthreadVC2.dll / dlpprem64.dll under C:\ProgramData\. Block cert[.]hypersnet[.]com, ssl[.]blsouqs[.]com and contacts[.]ftabnews[.]com at the resolver. Then decide a policy position on ISO/IMG attachments, which is the single control that would have stopped this chain at step one.

Hash handling — what was shipped and what was withheld

The vendor IOC table publishes MD5, SHA-1 and SHA-256 for nine samples. Two independent fetches (tier-1 direct, and the tier-2 syndication) agree character-for-character on all nine MD5 values and all nine SHA-1 values, and on eight of the nine SHA-256 values. Those seventeen-plus-eight values are shipped.

One SHA-256 is deliberately withheld. The SHA-256 for the MIXEDKEY loader (pthreadVC2.dll) could not be read cleanly. The tier-1 fetch rendered that one cell as a corrupted repeating hex run — the 44-character fragment 3b3eaea783fd6dab90f0408274bf8a9c49adbdc70c0e repeated three times, well over 64 characters. The tier-2 syndication rendered a plausible 64-character value for the same cell, but that same table also mis-split the adjacent dlpprem64.dll row, absorbing the filename's leading d into the hash field and printing the name as lpprem64.dll. A table with a demonstrated character-level error is not a trustworthy sole witness for an indicator that would be pushed to a block list, so this pack ships REPLACE_WITH_MIXEDKEY_SHA256 in its place and covers MIXEDKEY behaviourally instead (Q4, Q10). MIXEDKEY's MD5 and SHA-1 are two-witness confirmed and are shipped normally, so the sample is still pivotable.

No source consulted contained any instruction directed at the reader or at an automated agent — no text asking for a command to be run, a further URL to be fetched, or prior instructions to be disregarded. Each snapshot records that check explicitly.

Known gaps in the intel

• No registry value name. Run-key persistence is reported for the first stage but no value name or exact key path is published, so Q9 hunts the shape (an autostart value pointing into C:\ProgramData\) rather than a literal name.
• No Telegram bot token or chat ID. Without these the Telegram channel can only be hunted by behaviour and volume, never by identifier.
• No IP addresses. The vendor published hostnames only. This pack therefore ships zero IP indicators; resolver logs are the pivot.
• BINDCLOAK detail is in Part 2, which was not published at time of writing. Its on-host behaviour beyond the beacon domain is uncovered here, and is flagged as a gap in the coverage map.
• Victimology is thin. "Government entities in the Middle East" is as specific as any source gets. No sector sub-vertical, no country, no victim count.

Attack chain

Hunt hypotheses, ordered by fidelity

Every value below is traceable to a saved source snapshot in TELESHIM-MiddleEast-Gov-Hunt-sources/. Domains are defanged for safe reading; the import block in section 10 carries live values.

Network

File hashes — SHA-256

File hashes — MD5 and SHA-1 (for retro-hunt and VirusTotal pivots)

Host artefacts

Run these where Falcon telemetry is absent, thin, or where you want a second, independent witness. All are read-only.

N1 — Scheduled task sweep (Windows, no EDR required)

Task Scheduler operational log event 4698 records task creation. This also finds tasks created before sensor deployment, which Q2 cannot.

Get-ScheduledTask | Where-Object {
    $_.TaskName -match 'shimgen|Feedback'
} | Select-Object TaskName, TaskPath, State,
    @{n='Action';e={ ($_.Actions | ForEach-Object Execute) -join '; ' }},
    @{n='Repeat';e={ ($_.Triggers | ForEach-Object { $_.Repetition.Interval }) -join '; ' }}

# Broader: any task repeating more often than every 15 minutes whose action lives in ProgramData
Get-ScheduledTask | ForEach-Object {
    $exe = ($_.Actions | ForEach-Object Execute) -join ';'
    $rep = ($_.Triggers | ForEach-Object { $_.Repetition.Interval }) -join ';'
    if ($exe -like '*\ProgramData\*' -and $rep -match 'PT([1-9]|1[0-5])M') {
        [pscustomobject]@{ Task=$_.TaskName; Exe=$exe; Repeat=$rep }
    }
}

N2 — Autostart values pointing into ProgramData

$keys = @(
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($k in $keys) {
  if (Test-Path $k) {
    (Get-Item $k).GetValueNames() | ForEach-Object {
      $v = (Get-ItemProperty -Path $k -Name $_).$_
      if ($v -like '*ProgramData*') { "$k :: $_ = $v" }
    }
  }
}

N3 — Telegram C2 in proxy / TLS logs

Two independent discriminators, neither of which requires decrypting the session:

• URI path, if you terminate TLS: requests to api.telegram.org whose path matches /bot*/getUpdates or /bot*/getFile. A human using Telegram Desktop does not generate getUpdates polling against the Bot API.
• User-Agent: the implant hardcodes AppleWebKit/534.31 … Chrome/13.0.748.0 Safari/534.31, claiming Chrome 13 on Mac OS X 10.5.8. On a Windows government estate that string alone is a finding, whatever the destination.
• Cadence: group requests to api.telegram.org by client IP and look for a near-constant inter-request delta around 6 minutes. Human chat traffic is bursty; a poll loop is not.

N4 — Anti-analysis stress file

Look in each user's %TEMP% for a very large CVR*.tmp. The genuine Office CVR crash-report files are small; a roughly 1 GB one is the sandbox-evasion write.

Get-ChildItem "$env:TEMP\CVR*.tmp" -ErrorAction SilentlyContinue |
  Where-Object { $_.Length -gt 100MB } |
  Select-Object FullName, Length, LastWriteTime

N5 — Mail gateway retro-hunt

• Search 90 days of mail logs for attachments with an .iso or .img extension, and for ZIP attachments that contain one. Report volume, senders, and recipients by department.
• Retro-hunt the four lure archive and image SHA-256 values from section 4 against your gateway's attachment hash store.
• Search subject lines and attachment names for the lure themes: petroleum, gas, exploration, cooperation protocol, border offices, common border.

N6 — Mutex check on a suspect host

On a host already under suspicion, an existing named mutex confirms a live instance. Use Sysinternals handle.exe and search for WebKitFormBoundary7MA4YWxkTrZu0g. Absence proves nothing; presence is decisive.

No query below carries an in-query time filter. Set the search window in the Falcon console instead — a @timestamp comparison against an expression is rejected by the CQL parser, so the window belongs in the UI. Start at 90 days for the hash and domain queries and 7 days for the behavioural ones.

// HUNT: TELESHIM sideload host executing from its shimgen_Data staging directory
// MITRE: T1574.001, T1036.005 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ImageFileName=/\\programdata\\shimgen_Data\\/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])

// HUNT: TELESHIM / MIXEDKEY persistence task registration
// MITRE: T1053.005 | CONF: high  FP: medium  COST: low
// REQUIRES: ScheduledTaskRegistered
// TUNING: 'Feedback' is generic. Keep hits whose TaskExecutable sits under
// TUNING: \ProgramData\ or \Users\...\AppData\; drop tasks under \Program Files\
// TUNING: that are signed by a vendor you already inventory.
#event_simpleName=/^(ScheduledTaskRegistered|ScheduledTaskModified)$/
| TaskName=/^\\?(shimgen|Feedback)$/i
| table([@timestamp, ComputerName, UserName, TaskName, TaskExecutable, TaskAuthor])

// HUNT: minute-level scheduled task creation via schtasks.exe
// MITRE: T1053.005, T1007 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// TUNING: baseline your software-deployment and monitoring service accounts and
// TUNING: exclude them by UserName; the actor ran this interactively under a
// TUNING: normal user context, so a human-owned hit is the interesting one.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^schtasks\.exe$/i
| CommandLine=/\/sc\s+minute/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine])

// HUNT: TELESHIM / MIXEDKEY sideload DLL staged under ProgramData
// MITRE: T1574.001, T1105, T1036.005 | CONF: high  FP: medium  COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten
// TUNING: pthreadVC2.dll is a real library. Keep hits where the writing process
// TUNING: is not a known installer or MSI service, and where the DLL landed in a
// TUNING: vendor-named folder (Intel, Lenovo, Crypto) that vendor did not create.
// TUNING: AsTaskSched.dll and dlpprem64.dll under ProgramData have no benign form.
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| TargetFileName=/\\programdata\\.*\\(AsTaskSched|pthreadVC2|dlpprem64)\.dll$/i
| table([@timestamp, ComputerName, UserName, TargetFileName, ContextBaseFileName, SHA256HashData])

// HUNT: confirmed TELESHIM / BINDCLOAK / lure SHA-256 values
// MITRE: T1204.002, T1105 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2, PeFileWritten or ImageHash with hash enrichment
// NOTE: MIXEDKEY (pthreadVC2.dll) is intentionally NOT listed - its published
// NOTE: SHA-256 could not be read reliably from any source. Use Q4 and Q10 for it.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten|ImageHash)$/
| SHA256HashData=/^(5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d|cac1f37beaa814461f7709a073aeec468c74e5d70f7d693a9e367ece4a3a78be|0637069c7052118fd5c0f1113541bdd35e5f71cd9689f2516045da152c6fa8d9|3b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d|c84542ac30cbe9bb8bd648bad323c37801023bf9451c1c0990452466e084340f|db11ff3f37a8b2aa25c480871504b886a6364167ecb501eacf7345f6bbf9582b|789fd11285642861190dc074c1e9a5957073f1a2afebd5160f9cc907f7f320bd|32529043d15e9111ba284f1d8a9e4b3f58e071c6b69c8f271d4d02feacd44e66)$/i
| table([@timestamp, ComputerName, UserName, FileName, TargetFileName, ImageFileName, SHA256HashData])

// HUNT: BINDCLOAK C2 and connectivity-check hostname resolution
// MITRE: T1071.001, T1571 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/^(cert\.hypersnet\.com|ssl\.blsouqs\.com|contacts\.ftabnews\.com)$/i
| table([@timestamp, ComputerName, UserName, DomainName, ContextProcessId, RequestType])

// HUNT: machine-cadence Telegram Bot API polling (TELESHIM C2 dead drop)
// MITRE: T1102, T1071.001 | CONF: medium  FP: high  COST: medium
// REQUIRES: DnsRequest
// TUNING: exclude hosts with Telegram Desktop installed, and any subnet where
// TUNING: Telegram is sanctioned. Then raise the threshold until the result set
// TUNING: is reviewable - on a clean government estate the floor should be near
// TUNING: zero, so any surviving host is worth a full triage rather than a tune.
#event_simpleName=/^DnsRequest$/
| DomainName=/^api\.telegram\.org$/i
| groupBy([ComputerName], function=count(as=Lookups))
| Lookups > 50
| sort(Lookups, order=desc, limit=200)
| table([ComputerName, Lookups])

// HUNT: discovery-command burst under a TELESHIM / MIXEDKEY sideload host
// MITRE: T1087, T1057, T1049, T1082, T1007, T1033, T1518.001, T1497
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| ParentBaseFileName=/^(shimgen|RegSchdTask|GoProAlertService|winProAlertService)\.exe$/i
| FileName=/^(cmd|net|net1|tasklist|hostname|ipconfig|netstat|whoami|systeminfo|schtasks|wmic|reg)\.exe$/i
| groupBy([ComputerName, UserName, ParentBaseFileName], function=[count(as=Commands), collect([FileName, CommandLine])])
| sort(Commands, order=desc, limit=200)

// HUNT: Run-key autostart whose target lives under ProgramData
// MITRE: T1547.001 | CONF: medium  FP: medium  COST: low
// REQUIRES: AsepValueUpdate / RegGenericValueUpdate
// TUNING: build a one-week allowlist of RegValueName + RegStringValue pairs first;
// TUNING: your endpoint agents and OEM utilities will be nearly all of it. Then
// TUNING: alert only on new pairs. Treat any target under \ProgramData\Crypto\ or
// TUNING: a *_Data folder as a priority regardless of the allowlist.
#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName=/\\CurrentVersion\\Run(Once)?$/i
| RegStringValue=/\\programdata\\/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue])

// HUNT: encrypted final-stage payload staged in the Platform Crypto Provider path
// MITRE: T1027, T1140, T1480.001, T1620 | CONF: medium  FP: medium  COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten, or broad file-write telemetry
// TUNING: Crypto\DSS is a real Windows path. Genuine writers are TPM and crypto
// TUNING: service components under \Windows\System32\. Exclude those by
// TUNING: ContextBaseFileName and keep anything written by a process running from
// TUNING: ProgramData, AppData or a user profile. The known blob is a 32-hex name.
#event_simpleName=/^(PeFileWritten|NewExecutableWritten|ZipFileWritten)$/
| TargetFileName=/\\programdata\\crypto\\dss\\/i
| table([@timestamp, ComputerName, UserName, TargetFileName, ContextBaseFileName, FileSize])

Three of the ten hunts are clean enough for promotion to a preventative Custom IOA. The rest stay Investigate-only. Promote in the order below, each after a one-week Detect-mode soak.

IOA-1 — Execution from the TELESHIM staging directory

IOA-2 — Discovery burst under a ProgramData sideload host

IOA-3 — Sideload DLL written beside a signed vendor binary in ProgramData

Staying Investigate-only

• Q2, Q3 — task names and minute intervals are too generic to block on. High value as scheduled searches with email alerting.
• Q7 — never promote. Blocking api.telegram.org is a business policy decision, not a detection one, and it belongs at the proxy with an exception process.
• Q9, Q10 — both sit on paths with genuine legitimate writers. Alert, do not block.
• Q5, Q6 — better served by Falcon IOC Management (section 10) than by a Custom IOA.

Work these four gates in order. Do not promote anything to a blocking Custom IOA until gate 4 is signed off — a false block on a signed vendor binary in a government estate is its own incident.

Gate 1 — Telemetry readiness

Gate 2 — Benign baseline

• Run Q1 over 90 days. Expected result: zero. Any hit at all is an incident, not a tuning exercise.
• Run Q2 over 90 days and record every distinct TaskName plus TaskExecutable pair. Build the Feedback allowlist from this and nothing else.
• Run Q3, Q9 and Q10 over 30 days and count distinct hosts per day. If any exceeds roughly 20 hosts a day you have a legitimate driver to exclude before the query is usable as an alert.
• Run Q4 over 90 days. Expect hits only on pthreadVC2.dll from real software. Record which products, then narrow the alerting form of the query to the other two DLL names.
• Run Q7 over 30 days and plot the host count by lookup volume. Set the threshold above the natural population, then confirm the survivors by hand.

Gate 3 — Positive validation

Prove each detection fires, using benign stand-ins only. Nothing here needs malware.

1. Q1: create C:\programdata\shimgen_Data\, copy notepad.exe into it as shimgen.exe, run it, close it. Q1 must return the execution. Delete the directory afterwards.
2. Q2 and Q3: register a task named shimgen pointing at calc.exe with a 6-minute repeat, confirm both queries fire, then delete the task.
3. Q4: copy any signed DLL into C:\ProgramData\Test\AsTaskSched.dll. Q4 must return the write. Delete it.
4. Q5: do not synthesise a hash match. Instead confirm the query parses and that SHA256HashData is populated by running it with one hash swapped for a hash you know exists in your estate.
5. Q6: resolve one campaign hostname once from a test host, using nslookup only. Q6 must return it. Note the lookup in your test log so the SOC does not chase it.
6. Q8: from the shimgen.exe stand-in in step 1, spawn ipconfig /all and net user. Q8 must group both under the parent.
7. Q9: add a Run value pointing at an executable under C:\ProgramData\, confirm, remove.
8. Q10: write a small file named with 32 hex characters and a .PCPKEY extension into C:\ProgramData\Crypto\DSS\ from a user-profile process. Confirm, delete.

Gate 4 — Promotion

Controls are tiered by deployment friction, not by importance. Each cites a MITRE mitigation for the why and a platform authority for the what. All are Windows and mail-gateway controls, because that is the entire surface this chain touches — there is no Linux, macOS, cloud or Kubernetes component to harden.

No control in this section lacks a framework citation, but two rest partly on vendor guidance rather than a numbered benchmark line: H-N1 (the ISO-mount policy is a Microsoft baseline setting, not a CIS-numbered item on every build) and H-N3 (ASR GUIDs are a Microsoft reference, not a CIS control). Both are sound and threat-relevant; review them against your own build standard before enforcing.

Read the rollback line before running any step. Every step below changes endpoint state. Pilot each on a ring of no more than 20 hosts first. Run all PowerShell from an elevated session.

PB-1 · Restrict disk-image mounting (implements H-N1)

Prerequisites: Domain admin for the GPO path, or local admin for the per-host path. Confirm first that no imaging, patching or software-deployment tool in your estate mounts ISO or IMG files as part of normal operation — check with the desktop engineering team before piloting. Windows 11 22H2 or Windows Server 2022 for the policy route; the registry route covers older builds.

Reboot required: No. A sign-out and sign-in applies the shell change.

Rollback: re-import the exported keys saved in step 1 with reg import, or set the GPO back to Not Configured and run gpupdate /force. The mount verb returns immediately for new sessions.

# --- Step 1: ALWAYS export first. This is the rollback artifact. ---
$bk = "C:\Windows\Temp\iso-mount-backup-2026-07-26"
New-Item -ItemType Directory -Path $bk -Force | Out-Null
reg export "HKEY_CLASSES_ROOT\Windows.IsoFile\shell\mount" "$bk\isofile-mount.reg" /y
reg export "HKEY_CLASSES_ROOT\Windows.VhdFile\shell\mount"  "$bk\vhdfile-mount.reg" /y
Get-ChildItem $bk    # confirm both .reg files exist and are non-empty BEFORE step 2

# --- Step 2 (preferred, Win11 22H2+ / Server 2022+): policy route ---
# Computer Configuration \ Administrative Templates \ System \ Removable Storage Access
#   "Prevent users from mounting ISO/IMG files"  ->  Enabled
# Equivalent registry value:
$k = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer"
New-Item -Path $k -Force | Out-Null
New-ItemProperty -Path $k -Name "NoUseStoreOpenWith" -Value 0 -PropertyType DWord -Force | Out-Null
New-ItemProperty -Path $k -Name "NoAutoplayfornonVolume" -Value 1 -PropertyType DWord -Force | Out-Null

# --- Step 3 (older builds only): remove the shell mount verb ---
# Do this ONLY if step 2's policy is unavailable on the build.
Remove-Item -Path "Registry::HKEY_CLASSES_ROOT\Windows.IsoFile\shell\mount" -Recurse -Force -ErrorAction SilentlyContinue
Remove-Item -Path "Registry::HKEY_CLASSES_ROOT\Windows.VhdFile\shell\mount"  -Recurse -Force -ErrorAction SilentlyContinue

# --- Step 4: verify ---
Test-Path "Registry::HKEY_CLASSES_ROOT\Windows.IsoFile\shell\mount"   # expect False on the step-3 route
# Then, as a STANDARD user, double-click a test .img -- the mount must fail.

PB-2 · Enable the two ASR rules in Block mode (implements H-N3)

Prerequisites: Microsoft Defender Antivirus in active mode (not passive alongside another AV, or ASR rules are inert). Run in Audit mode for one week first and review the events, as the prevalence rule can block legitimate freshly built in-house tooling.

Reboot required: No.

Rollback: re-run the same command with -AttackSurfaceReductionRules_Actions Disabled for the same GUIDs, or AuditMode to keep visibility without blocking. Effective immediately, no reboot.

# --- Step 1: record current state. This is the rollback reference. ---
$pref = Get-MpPreference
[pscustomobject]@{
  Ids     = $pref.AttackSurfaceReductionRules_Ids -join ','
  Actions = $pref.AttackSurfaceReductionRules_Actions -join ','
} | Format-List

# --- Step 2: AUDIT first, for one week ---
$rules = @('01443614-cd74-433a-b99e-2ecdc07bfc25',   # prevalence / age / trusted-list
           'd4f940ab-401b-4efc-aadc-ad5f3c50688a')   # Office child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids $rules `
                 -AttackSurfaceReductionRules_Actions AuditMode,AuditMode

# --- Step 3: review the audit week before enforcing ---
Get-WinEvent -LogName 'Microsoft-Windows-Windows Defender/Operational' -MaxEvents 500 |
  Where-Object { $_.Id -in 1121,1122 } |
  Select-Object TimeCreated, Id, Message |
  Format-List

# --- Step 4: enforce ---
Add-MpPreference -AttackSurfaceReductionRules_Ids $rules `
                 -AttackSurfaceReductionRules_Actions Enabled,Enabled

# --- Step 5: verify both GUIDs report action 1 ---
$p = Get-MpPreference
for ($i = 0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) {
  "$($p.AttackSurfaceReductionRules_Ids[$i]) = $($p.AttackSurfaceReductionRules_Actions[$i])"
}

PB-3 · AppLocker deny-execute on ProgramData, audit-first (implements H-N2)

Prerequisites: Application Identity service (AppIDSvc) running and set to automatic. A pilot ring. Critically, one full week in Audit mode with the event review in step 3 completed and signed off — enforcing this without knowing which of your agents execute from ProgramData will break them.

Reboot required: No, but AppIDSvc must be started, and it does not start by default on all builds.

Rollback: re-import the policy XML exported in step 1 with Set-AppLockerPolicy -XmlPolicy, or clear the local policy entirely with the documented empty-policy import in step 5. To disable without touching policy, stop and disable AppIDSvc. Effective on the next policy refresh.

# --- Step 1: export the existing policy. This is the rollback artifact. ---
$bk = "C:\Windows\Temp\applocker-backup-2026-07-26.xml"
Get-AppLockerPolicy -Effective -Xml | Out-File $bk -Encoding UTF8
(Get-Content $bk).Length    # must be non-zero BEFORE continuing

# --- Step 2: ensure the enforcement service is running ---
Set-Service -Name AppIDSvc -StartupType Automatic
Start-Service -Name AppIDSvc

# --- Step 3: create the rule in AUDIT mode, then wait a week ---
# In secpol.msc: Application Control Policies \ AppLocker \ Executable Rules
#   Action: Deny
#   User:   Everyone   (exempt your admin group)
#   Path:   %PROGRAMDATA%\*
#   Enforcement mode: "Audit only"
# Also add a DLL rule with the same path -- sideloading defeats EXE-only control.
# Review what WOULD have been blocked:
Get-WinEvent -LogName 'Microsoft-Windows-AppLocker/EXE and DLL' -MaxEvents 1000 |
  Where-Object { $_.Id -eq 8003 } |
  Select-Object -ExpandProperty Message |
  Sort-Object -Unique

# --- Step 4: add an allow rule per legitimate publisher found in step 3, ---
# --- then switch Enforcement mode to "Enforce rules". ---

# --- Step 5: verify, and note the rollback command ---
Get-AppLockerPolicy -Effective -Xml | Select-String 'PROGRAMDATA'
# ROLLBACK:  Set-AppLockerPolicy -XmlPolicy $bk
# HARD OFF:  Stop-Service AppIDSvc; Set-Service AppIDSvc -StartupType Disabled

PB-4 · Resolver and firewall blocks (implements H-I2, H-I3)

Prerequisites: Change-control approval for a resolver and firewall change. Apply the resolver block before the firewall rule so you get the higher-fidelity DNS alert.

Reboot required: No. Flush the DNS cache on endpoints to make the block effective immediately.

Rollback: remove the DNS zones with Remove-DnsServerZone and delete the firewall rule with Remove-NetFirewallRule -DisplayName using the exact name below. Both take effect immediately.

# --- Step 1: sinkhole the three campaign hostnames (Windows DNS example) ---
$hosts = @('cert.hypersnet.com','ssl.blsouqs.com','contacts.ftabnews.com')
foreach ($h in $hosts) {
  Add-DnsServerPrimaryZone -Name $h -ReplicationScope Forest -ErrorAction Continue
  # point the apex at your sinkhole listener so the attempt is logged, not just dropped
  Add-DnsServerResourceRecordA -ZoneName $h -Name '@' -IPv4Address '10.10.10.10' -ErrorAction Continue
}
# Verify from a workstation:  nslookup cert.hypersnet.com   -> expect the sinkhole IP

# --- Step 2: deny outbound ICMP from workstations to the internet ---
New-NetFirewallRule -DisplayName 'HuntPack TELESHIM - Deny outbound ICMP to internet' `
  -Direction Outbound -Protocol ICMPv4 -IcmpType 8 -Action Block `
  -RemoteAddress Internet -Profile Domain,Private,Public -Enabled True

# --- Step 3: verify ---
Get-NetFirewallRule -DisplayName 'HuntPack TELESHIM - Deny outbound ICMP to internet' |
  Select-Object DisplayName, Enabled, Action, Direction
Test-Connection -TargetName 203.0.113.1 -Count 1 -ErrorAction SilentlyContinue   # expect failure

# ROLLBACK:
#   foreach ($h in $hosts) { Remove-DnsServerZone -Name $h -Force }
#   Remove-NetFirewallRule -DisplayName 'HuntPack TELESHIM - Deny outbound ICMP to internet'

PB-5 · Triage collection script for a suspect host (read-only)

Prerequisites: Local admin on the target, or run through Falcon Real Time Response. Read-only — it changes nothing on the host and is safe to run before a containment decision.

Reboot required: No.

Rollback: none required. The script only reads state and writes one report file to C:\Windows\Temp\; delete that file when you are done with it.

$out = "C:\Windows\Temp\teleshim-triage-$env:COMPUTERNAME.txt"
"=== TELESHIM triage $(Get-Date -Format s) on $env:COMPUTERNAME ===" | Out-File $out

"--- Staging directories ---" | Out-File $out -Append
foreach ($p in @('C:\programdata\shimgen_Data','C:\ProgramData\Crypto\DSS')) {
  if (Test-Path $p) {
    "PRESENT: $p" | Out-File $out -Append
    Get-ChildItem $p -Force -Recurse -ErrorAction SilentlyContinue |
      Select-Object FullName, Length, CreationTime, LastWriteTime |
      Out-File $out -Append
  } else { "absent: $p" | Out-File $out -Append }
}

"--- Sideload DLLs anywhere under ProgramData ---" | Out-File $out -Append
Get-ChildItem 'C:\ProgramData' -Recurse -Force -ErrorAction SilentlyContinue -Include `
  'AsTaskSched.dll','pthreadVC2.dll','dlpprem64.dll' |
  Select-Object FullName, Length, CreationTime,
    @{n='SHA256';e={ (Get-FileHash $_.FullName -Algorithm SHA256).Hash }} |
  Out-File $out -Append

"--- Sideload host binaries under ProgramData ---" | Out-File $out -Append
Get-ChildItem 'C:\ProgramData' -Recurse -Force -ErrorAction SilentlyContinue -Include `
  'shimgen.exe','RegSchdTask.exe','GoProAlertService.exe','winProAlertService.exe' |
  Select-Object FullName, Length, CreationTime,
    @{n='SHA256';e={ (Get-FileHash $_.FullName -Algorithm SHA256).Hash }} |
  Out-File $out -Append

"--- Suspect scheduled tasks ---" | Out-File $out -Append
Get-ScheduledTask | ForEach-Object {
  $exe = ($_.Actions | ForEach-Object Execute) -join ';'
  $rep = ($_.Triggers | ForEach-Object { $_.Repetition.Interval }) -join ';'
  if ($_.TaskName -match 'shimgen|Feedback' -or $exe -like '*\ProgramData\*') {
    "TASK $($_.TaskName) | $($_.State) | $exe | repeat=$rep" | Out-File $out -Append
  }
}

"--- Autostart values targeting ProgramData ---" | Out-File $out -Append
foreach ($k in @('HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
                 'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
                 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
                 'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce')) {
  if (Test-Path $k) {
    (Get-Item $k).GetValueNames() | ForEach-Object {
      $v = (Get-ItemProperty -Path $k -Name $_).$_
      if ($v -like '*ProgramData*') { "$k :: $_ = $v" | Out-File $out -Append }
    }
  }
}

"--- Oversized TEMP stress files ---" | Out-File $out -Append
Get-ChildItem "$env:TEMP\CVR*.tmp" -ErrorAction SilentlyContinue |
  Where-Object { $_.Length -gt 100MB } |
  Select-Object FullName, Length | Out-File $out -Append

"--- Live connections and DNS cache ---" | Out-File $out -Append
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess |
  Out-File $out -Append
Get-DnsClientCache -ErrorAction SilentlyContinue |
  Where-Object { $_.Entry -match 'telegram|hypersnet|blsouqs|ftabnews' } |
  Out-File $out -Append

"=== end ===" | Out-File $out -Append
Write-Host "Report written to $out"

Before you isolate: this is a hands-on-keyboard espionage actor with an interactive C2, not commodity malware. If you have any reason to believe more than one host is involved, scope the whole estate with Q1, Q2, Q5 and Q6 before touching the first host. Isolating one host tells the operator they are burned and can cost you the rest of the intrusion. Confirm the scoping decision with the incident lead.

Gaps worth naming plainly

• BINDCLOAK's on-host behaviour is uncovered. ThreatLabz Part 2 had not published at time of writing. This pack detects the loader that installs it and the domain it calls, and nothing in between. Re-run the pipeline when Part 2 is out.
• Reflective loading (T1620) has no telemetry. There is no module-load event to hunt. Q10 is a proxy that catches the encrypted blob on disk; if the actor moves that blob to a path with legitimate writers or fetches it directly into memory, Q10 goes blind.
• The inline hook (T1014) is invisible here. A 7-byte patch at offset 0x1394 of an already-running signed image needs memory-integrity or in-process telemetry that this pack does not use.
• C2 detection is hostname-bound. Q6 covers three known hosts. Rotating infrastructure defeats it entirely, which is why Q1, Q2 and Q8 — none of which depend on a network indicator — are the durable detections.
• One withheld hash. MIXEDKEY's SHA-256 is a labelled placeholder, not a detection. Q4 and Q10 cover that stage behaviourally. If a trustworthy second witness for that hash appears, fill the placeholder and re-run the provenance gate.

Validation of everything above runs through section 11. In short: confirm the telemetry in gate 1 before believing any zero result, baseline in gate 2 before alerting, prove each query fires with the benign stand-ins in gate 3, and do not move any detection to Block until gate 4 is signed off. The three queries that matter most on day one — Q1, Q2 and Q8 — are also the three cheapest to validate, so there is no reason to defer them.

Planned v0.2: re-run when ThreatLabz publishes Part 2 to add BINDCLOAK on-host detection and close the T1620 and T1090.001 gaps. Fill the MIXEDKEY SHA-256 placeholder if a trustworthy second witness appears.

Provenance: the fetched text of every cited source is saved verbatim in TELESHIM-MiddleEast-Gov-Hunt-sources/ alongside this file. Every atomic indicator shipped in section 10 traces back to at least one of those snapshots. Each snapshot also records an explicit check for injected instructions aimed at a reader or an automated agent; none was found in any source.