Threat Hunting Queries, RMM Tool Comparison, and Sandbox Evasion Analysis

Multi-Part Threat Intelligence Package
Classification: Internal Use - Threat Hunting
Last Updated: September 2026

---

PART 1: THREAT HUNT QUERIES

SIEM Queries (Splunk/ELK)

Query 1: Detect CRA Phishing Email

text
Copy
1# Splunk Query Language (SPL)
2# Find emails impersonating CRA with suspicious origins
3
4index=email (from:*cra* OR from:*revenue* OR subject:*CRA*) 
5  NOT from:cra.gc.ca 
6  (dmarc=fail OR spf=fail OR dkim=fail)
7| stats count by src_ip, from, subject
8| where count > 5  # Bulk sending pattern

Expected Results:

• Emails from 185.220.101.45, 193.45.67.89
• Subject: "CRA Tax Compliance", "Audit Notice"
• Failed authentication checks

Query 2: Detect Any.Run Access in Network

text
Copy
1index=proxy OR index=web_traffic 
2  (url="*any.run/tasks*" OR domain="any.run")
3| stats count, distinct_count(src_ip), values(url) by dest_ip
4| where distinct_count > 1  # Multiple users accessing Any.Run

Expected Results:

• Users clicking Any.Run links
• Redirect chains to attacker domains
• Timing correlation with phishing sends

Query 3: Detect RMM Tool Installation via EDR

text
Copy
1index=editsearch eventtype=process_execution 
2  (process_name=AnyDesk.exe OR process_name=ScreenConnect.exe OR process_name=TeamViewer.exe)
3  parent_process!="explorer.exe" AND parent_process!="services.exe"
4| stats count, values(parent_process), values(user) by hostname
5| where count > 1  # Multiple RMM processes = suspicious

Expected Results:

• RMM spawned from Temp, Downloads, ProgramData
• Parent process: unknown executable, cmd.exe, powershell.exe
• Time correlation with malware execution

Query 4: Detect C2 Beacon Pattern

text
Copy
1index=proxy method=POST uri="*/api/register*" OR uri="*/api/check*"
2  dest_ip IN (185.220.101.45, 193.45.67.89, 109.234.45.123)
3| stats count, earliest(timestamp), latest(timestamp) by src_ip, dest_ip
4| eval time_diff = latest(timestamp) - earliest(timestamp)
5| where count > 3 AND time_diff < 3600  # Multiple requests in 1 hour

Expected Results:

• Regular POST requests every 5 minutes
• Small payload size (500-1000 bytes)
• Consistent timing pattern

Query 5: Detect Credential Harvesting

text
Copy
1index=web_traffic method=POST 
2  (uri="*/login*" OR uri="*/auth*" OR uri="*/credential*")
3  dest!="accounts.acme.local" AND dest!="okta.com"
4| stats count, values(form_data) by src_ip, dest
5| where count > 1  # Multiple credential submissions

Expected Results:

• User submitting credentials to attacker domain
• Username/password fields in POST body
• Tax authority themed URLs

Query 6: Detect LSASS Memory Dumping

text
Copy
1index=windows eventtype=sysmon event_id=10 
2  target_image="*lsass.exe"
3  granted_access IN (0x1010, 0x1040, 0x143a)
4  source_image!="svchost.exe" AND source_image!="wdiag.exe"
5| stats count, values(source_image), values(user) by hostname
6| where count > 1

Expected Results:

• Credential harvesting tools accessing LSASS
• Source: cmd.exe, powershell.exe, or unknown process
• Time correlation with RMM installation

Query 7: Detect Lateral Movement

text
Copy
1index=windows event_id=4624 
2  logon_type=3  # Network logon
3  source_workstation!="DC*"
4  dest_account="*admin*"
5| stats count, distinct_count(source_workstation), values(source_ip) by dest_workstation
6| where count > 5 AND distinct_count > 1  # Multiple sources trying admin accounts

Expected Results:

• Compromised workstation accessing domain controllers
• Pass-the-hash attacks
• Lateral movement via PsExec or similar

Sentinel/Azure Kusto Queries

Query: Detect CRA Phishing + RMM + C2 Chain

text
Copy
1// Multi-step detection chain
2union
3(
4  EmailEvents
5  | where SenderFromAddress contains "cra" and SenderFromAddress !contains "cra.gc.ca"
6  | where AuthenticationDetails !contains "pass"
7  | project EmailID, TimeGenerated, SenderFromAddress, Subject, FileName = AttachmentFileName
8),
9(
10  DeviceProcessEvents
11  | where FileName in ("AnyDesk.exe", "ScreenConnect.exe", "TeamViewer.exe")
12  | where InitiatingProcessParentFileName !in ("explorer.exe", "services.exe")
13  | project DeviceID, TimeGenerated, FileName, InitiatingProcessCommandLine
14),
15(
16  DeviceNetworkEvents
17  | where RemoteIP in ("185.220.101.45", "193.45.67.89")
18  | where RemotePort == 80 and InitiatingProcessFileName in ("*.exe")
19  | project DeviceID, TimeGenerated, RemoteIP, RemotePort, InitiatingProcessCommandLine
20)
21| summarize 
22    EmailDetected = countif(FileName contains ".eml" or Subject contains "CRA"),
23    RMMDetected = countif(FileName in ("AnyDesk.exe", "ScreenConnect.exe", "TeamViewer.exe")),
24    C2Detected = countif(RemoteIP in ("185.220.101.45", "193.45.67.89"))
25  by DeviceID
26| where EmailDetected > 0 and RMMDetected > 0 and C2Detected > 0
27// Full chain detected = HIGH CONFIDENCE COMPROMISE

---

PART 2: RMM TOOL COMPARISON & ABUSE PATTERNS

Feature Comparison Matrix

Feature	AnyDesk	ScreenConnect	TeamViewer	Kaseya VSA
Primary Use	Remote support	IT remote access	Remote support	MSP management
Installation Size	2.8 MB	15-20 MB	8-12 MB	50+ MB
Memory Footprint	20-30 MB	50-80 MB	30-50 MB	100+ MB
Default Listening Port	7070	8040	5900	5721
Configuration Storage	ProgramData\AnyDesk\	Registry HKLM	Registry HKCU/HKLM	C:\Program Files...
Unattended Access	Supported	Supported	Supported	Supported
Cross-Platform	Windows/Mac/Linux	Windows only	Windows/Mac/Linux	Windows only
Code Signing	Optional	Yes (ConnectWise)	Yes (TeamViewer)	Yes (Kaseya)
Abuse by Attackers	High	Very High	Medium	Low (complex installation)

Why Attackers Prefer AnyDesk

1. Small Footprint: Easy to hide, minimal detection risk
2. Minimal Configuration: Works out-of-box without complex setup
3. Cross-Platform: Can target diverse environments
4. Quick Persistence: Auto-start option + session resumption
5. Evasion-Friendly: Less logging than competitors
6. API Support: Programmable for automated deployment

Detection Evasion Techniques by RMM Tool

AnyDesk Evasion

Technique 1: Rename binary
  - anydesk.exe → svchost.exe, explorer.exe, update.exe
  - Detection bypass: Filename-based signatures fail
  - Defense: Hash-based detection + behavioral analysis

Technique 2: Move installation
  - Standard: C:\Program Files\AnyDesk\
  - Evasion: C:\Windows\System32\, C:\ProgramData\, C:\Temp\
  - Defense: Monitor all AnyDesk processes regardless of location

Technique 3: Custom configuration
  - attacker-config.ini with:
    - Auto-connect to attacker C2
    - Disable notifications
    - Enable unattended access
    - Hide from user interface
  - Detection: Analyze custom .ini files

ScreenConnect Evasion

Technique 1: Legitimate installer spoofing
  - Use real ScreenConnect installer
  - Inject attacker-controlled config before install
  - Appears as legitimate ConnectWise product
  - Defense: Monitor for suspicious configuration parameters

Technique 2: Registry manipulation
  - Modify HKLM\Software\ConnectWise\ScreenConnect
  - Change "Server" value to attacker C2
  - Appears legitimate in installed programs
  - Defense: Monitor registry changes post-install

Technique 3: Service name spoofing
  - Service Name: "Windows Update" (display name)
  - Actual Binary: C:\Program Files\ScreenConnect\sc.exe
  - Hidden service (sc query shows no result)
  - Defense: Check all services including hidden ones

Legitimate vs. Malicious RMM Installation Indicators

Legitimate Installation (IT-Approved):

Installation Source: Software Center, Group Policy, IT ticket
Installation Path: C:\Program Files\ (standard location)
Installer: Signed by vendor (ConnectWise, TeamViewer)
Configuration: Default or pre-approved settings
Approval: IT-approved ticket in ticketing system
Timing: Business hours, known IT activity
Documentation: IT documentation, support staff aware

Malicious Installation (Attacker-Controlled):

Installation Source: Phishing email, malware dropper
Installation Path: C:\Windows\Temp\, C:\ProgramData\, etc.
Installer: Unsigned, or stolen signature
Configuration: Custom attacker configuration
Approval: No IT approval, no ticket
Timing: Off-hours, when user away from desk
Documentation: No IT documentation, hidden from users
Persistence: Automatic restart, multiple persistence methods
C2 Contact: Connects to attacker IP immediately after install

---

PART 3: SANDBOX EVASION TECHNIQUES

How Attackers Abuse Any.Run

Technique 1: Environment Detection

Any.Run is a Virtual Machine - Detect it:

text
Copy
1bool IsRunningInSandbox() {
2    // Any.Run runs on Hyper-V/KVM
3    
4    // Check registry for VM indicators
5    RegistryKey key = Registry.LocalMachine.OpenSubKey(@"HARDWARE\Description\System");
6    string systemBiosVersion = (key.GetValue("SystemBiosVersion") as string) ?? "";
7    
8    if (systemBiosVersion.Contains("QEMU") || 
9        systemBiosVersion.Contains("Xen") ||
10        systemBiosVersion.Contains("KVM")) {
11        return true;  // Virtual machine detected
12    }
13    
14    // Check for Any.Run specific indicators
15    if (Directory.Exists(@"C:\Program Files\Any.Run")) return true;
16    if (File.Exists(@"C:\Windows\System32\drivers\anyrun.sys")) return true;
17    
18    // Check CPU count (Any.Run uses low-core VMs)
19    if (Environment.ProcessorCount < 4) return true;  // Likely virtualized
20    
21    return false;
22}

Attacker Response:

• Detect Any.Run environment
• If detected: Do NOT execute malware
• Instead: Display benign content (fake tax form)
• Real user (not analyst) won't detect payload

Technique 2: Time-Based Triggers

Analysis takes time; Real infection happens fast:

text
Copy
1Stopwatch sw = Stopwatch.StartNew();
2
3// Execute malware
4try {
5    ExecutePayload();
6} catch {
7    // Malware execution attempted
8}
9
10sw.Stop();
11
12// If execution took less than 2 seconds = automated analysis
13// If execution took more than 30 seconds = human analyst with debugger
14if (sw.ElapsedMilliseconds > 30000) {
15    // Analysis detected - exit without executing
16    Environment.Exit(0);
17}

Implication: Analysts can't slow-step through code; real malware executes instantly.

Technique 3: Any.Run URL Redirect Chain

User Path:

1. Click phishing email link → https://any.run/tasks/a1b2c3d4e5f6/
2. Any.Run loads malware analysis page
3. User doesn't see actual malware (it's sandboxed)
4. Hidden JavaScript: if (NOT_ANY_RUN_ENVIRONMENT) { redirect to attacker site }
5. Real user redirected to: https://tax-audit-check.ca/
6. User sees fake login form
7. User enters credentials → Harvested by attacker

Analysis Bypass:

• Analyst views Any.Run page (sees benign content)
• Real user gets redirected to attacker site
• Any.Run appears as "safe" malware analysis

Technique 4: Checking for Security Analysts

text
Copy
1bool IsBeingAnalyzed() {
2    // Check for debugger attachment
3    bool isDebuggerAttached = Debugger.IsAttached;
4    if (isDebuggerAttached) return true;
5    
6    // Check for analysis tools
7    string[] analysisTools = {
8        "ida.exe", "idaw.exe",           // IDA Pro
9        "ghidra",                         // Ghidra
10        "dnSpy.exe",                      // .NET Spy
11        "procmon.exe",                    // Process Monitor
12        "regmon.exe",                     // Registry Monitor
13        "wireshark.exe",                  // Network traffic analyzer
14        "tcpdump"                         // tcpdump
15    };
16    
17    foreach (string tool in analysisTools) {
18        Process[] processes = Process.GetProcessesByName(tool);
19        if (processes.Length > 0) return true;  // Analyst tool detected
20    }
21    
22    return false;
23}

Defeating Sandbox Evasion

Counter-Technique 1: Disable Evasion Checks

Modify binary to skip detection code:

1. Disassemble malware (IDA Pro, Ghidra)
2. Identify evasion checks (IsRunningInSandbox, IsBeingAnalyzed functions)
3. Modify JMP instructions to skip checks
4. Or: Patch registry to indicate "real" system
5. Re-execute with evasion disabled

Counter-Technique 2: Behavioral Analysis

Observe malware behavior regardless of evasion:

Monitoring Points:
- File operations: What files are created/modified?
- Registry operations: What registry keys are modified?
- Process execution: What child processes are spawned?
- Network communication: What IPs/domains are contacted?
- Memory: What code is injected/executed?

Result: Even if malware doesn't fully execute, behavior is visible

Counter-Technique 3: Passive File Analysis

Analyze malware without execution:

1. Unpack .NET Reactor (extract obfuscated IL code)
2. Decompile to C# source code (dnSpy)
3. Read logic statically (no need to execute)
4. Identify C2 servers, payload download URLs, persistence mechanisms
5. Extract strings (hardcoded domains, keys, commands)

Counter-Technique 4: Yara Signatures

Detect malware by static patterns (no execution needed):

text
Copy
1rule AnyTax_Evasion_Techniques {
2    strings:
3        // Environment detection
4        $s1 = "QEMU" wide ascii
5        $s2 = "VMware" wide ascii
6        $s3 = "Hyper-V" wide ascii
7        
8        // Analysis tools
9        $s4 = "ida.exe" wide ascii
10        $s5 = "ghidra" wide ascii
11        $s6 = "procmon.exe" wide ascii
12        
13        // C2 communication
14        $s7 = "c2-control.xyz" nocase ascii
15        $s8 = "185.220.101" ascii
16        
17        // RMM tools
18        $s9 = "AnyDesk" wide ascii
19        $s10 = "ScreenConnect" wide ascii
20    condition:
21        (3 of ($s1, $s2, $s3)) or  // Multiple VM checks
22        (2 of ($s4, $s5, $s6)) or  // Multiple analysis tool checks
23        (any of ($s7, $s8)) or      // C2 infrastructure
24        (any of ($s9, $s10))        // RMM tools
25}

---

Summary: Threat Hunting to Sandbox Evasion

Complete Detection Stack:

Layer 1: Email Gateway Detection
  ↓ (Block phishing emails)
  
Layer 2: SIEM Threat Hunting
  ↓ (Detect C2 beacons, credential harvesting)
  
Layer 3: Endpoint EDR Detection
  ↓ (Catch RMM installation, LSASS access)
  
Layer 4: Network IDS/IPS Detection
  ↓ (Block C2 traffic, lateral movement)
  
Layer 5: Forensic Analysis
  ↓ (Understand attack chain, attribute threat actor)
  
Layer 6: Sandbox/Malware Analysis
  ↓ (Defeat evasion techniques, understand capabilities)
  
Result: Multi-layered defense, redundant detection

---

End of Threat Hunting, RMM Comparison, and Sandbox Evasion Document