Hunt Strategy & Objective
Identify telemetry consistent with PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale.
⏱️ Lookback: 30 days
Hunt Hypothesis
Observable activity related to PCPJack may be present where the documented behavior occurred.
Target Platforms & Environment
Windows
macOS
Linux
Cloud
Publicly documented behavior and indicators only.
Required Telemetry & Data Sources
process creation
network/DNS logs
authentication logs
Procedural Hunting Sequence
- 1 Scope: identify affected technologies and telemetry coverage.
- 2 SIEM/EDR Logic: run the attached Sigma, SPL, and KQL triage logic and pivot on cited indicators.
- 3 Triage & Containment: validate matches, isolate confirmed suspicious assets under local procedures, and preserve evidence.
- 4 Forensic Validation: confirm timestamps, parent-child process lineage, network pivots, and source provenance.
Hunt Queries
Query Pattern 1
Triage on keyword PCPJack and cited indicators
✓
True Positive Confirmation Evidence
●
Matches to cited public indicators or documented behavior
!
Benign & False Positive Explanations
●
Legitimate administrative or software activity
Validation Checklist
Preserve logs and timestamps
Confirm the source URL and evidence IDs
Escalation Criteria
Corroborated matches across independent telemetry
Traceability & Related Detections
🔍 Evidence:
25bc4908-e5…
🔍 Evidence:
5218cf6f-15…
🔍 Evidence:
72057df2-8e…
🔍 Evidence:
8b950278-90…
🔍 Evidence:
9069666a-ca…
🛡️ Detection: 1eb1e1b1-9d…
🛡️ Detection: d48b3fcf-c3…
🛡️ Detection: ca5ad419-d7…