k0t Network Edge Campaign: FortiGate, FortiWeb and GlobalProtect Credential Harvesting

Threat Hunting IOCs & Queries

The following compromise indicators and detection queries cover k0t's edge-device, identity and exfiltration tradecraft.

Known Indicators of Compromise

• Domains: mesh.buttruyen.com (MeshCentral C2 server), meshcentral.girydsfsggvb.com, agent.afahimsa.top (MeshAgent host), sthyjk.com (AdaptixC2 Windows agent staging), alknene.shop, radesashar.com (Nezha dashboard C2)
• IP Addresses: 64.94.85.14 (AdaptixC2 team server, port 4321), 193.149.187.81 (staging host for 1.exe), 162.33.178.213 (staging host for the AdaptixC2 installer), 162.33.179.249, 168.100.11.99, 62.60.131.43, 62.60.135.64, 193.24.123.162, 193.149.176.50, 193.169.194.21 (scanning activity)
• File Hashes: The source lists 7 MD5, 7 SHA1 and 7 SHA256 hashes for the campaign's scanner scripts (fort.py, fortnew.py, exploit_2026_0257.py) and the AdaptixC2 Windows agent installer (clear-thinking_61.92.4_INSTALL.exe) without mapping individual hashes to individual files. SHA256: 158215c7371e868f3d0c7fd2e92f05026a8678a3635629d89bd6042ee543278a, 1d1b76d30a69aa39b224053481483156f82dde026edd6f5d964f6e03f5f04a6d, 4db6bea4c1e4bce5020039def4087a073f4753a6b297b2832c19c10423ac842d, 552d0096f60c36a35c6096b3e4b38d743c29f8c56f3862fa3b7ef06c932e2a21, f9e95af4cda14dd5596c452a1a698f60412a7b2a9540321ee2a10b3bcbbd2a0e, 39c4decc4881ec02a47cd01c0fd8c3030527b466124ad03c6f99cfaa0ba0b72e, 808145ec3351569083fda27a910ebdf9e054e8ca42e40c021af5d6712c2ab87c
• Filenames: fort.py, fortnew.py, exploit_2026_0257.py, clear-thinking_61.92.4_INSTALL.exe, 1.exe

These indicators are current to Group-IB and NyxLab's October 21, 2026 publication. Focused Hunts checked the AdaptixC2 team server IP, the MeshCentral and agent domains, and the primary payload hash against AbuseIPDB, AlienVault OTX, ThreatFox and URLhaus on October 28, 2026; none returned abuse history or malware-family data beyond mirrors of this same report, so no live-status annotation is added above. k0t rotates its scanning and staging infrastructure between campaigns, so expect these specific domains and IPs to age out faster than the behavioral queries below, which target how the operators move once inside, not where they currently host their tools.

LSASS Memory Access by a Non-Standard Process

Priority: High, observed in this campaign (Mimikatz); Credential Access impact; Tier 1 endpoint telemetry; rarely benign.
Behavior Targeted: Looks for a process other than a known security or system binary opening a handle into lsass.exe with memory-read access rights, then surfaces the device, the accessing process and the access mask for review.
MITRE ATT&CK: T1003.001 – OS Credential Dumping: LSASS Memory
Telemetry Required: Sysmon Event ID 10 (ProcessAccess) on endpoints and domain controllers, or Microsoft Defender for Endpoint with the DeviceEvents table populated
Expected Results: A true positive shows an unsigned or unexpected binary (not antivirus, not a debugger) as the source process against lsass.exe as the target, often from a temp or user-writable directory.
False Positive Likelihood: LOW, legitimate processes with a business reason to touch LSASS memory are a short, known list (security agents, backup software with credential-vaulting features); most environments can allowlist them quickly.
Tuning Guidance: Extend the SourceImage/InitiatingProcessFileName exclusion list with the organization's own EDR, backup and password-vault agents. The access-mask values below cover the common full and VM-read permissions used by credential dumpers; narrow to a single value if the broader set is noisy in a specific environment.

Splunk SPL Query

index=* (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="WinEventLog:Microsoft-Windows-Sysmon/Operational")
    EventCode=10 earliest=-7d
    TargetImage="*\\lsass.exe"
    (GrantedAccess="0x1010" OR GrantedAccess="0x1410" OR GrantedAccess="0x1438" OR GrantedAccess="0x143a" OR GrantedAccess="0x1fffff")
| where NOT (SourceImage="*\\MsMpEng.exe" OR SourceImage="*\\lsass.exe" OR SourceImage="*\\Taskmgr.exe" OR SourceImage="*\\WmiPrvSE.exe")
| stats count min(_time) AS first_seen max(_time) AS last_seen by Computer, SourceImage, GrantedAccess
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL Query (Defender/Sentinel)

DeviceEvents
| where Timestamp > ago(7d)
| where ActionType == "WriteToLsassProcessMemory"
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "lsass.exe")
| summarize Count = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, InitiatingProcessCommandLine
| order by Count desc

Kerberoasting: Abnormal Service-Ticket Request Volume

Priority: High, observed in this campaign (Impacket GetUserSPNs); Credential Access impact; Tier 1 identity telemetry.
Behavior Targeted: Counts the number of distinct service names a single source requests Kerberos service tickets for inside an hour window, flagging requesters whose ticket diversity is far above normal application behavior.
MITRE ATT&CK: T1558.003 – Steal or Forge Kerberos Tickets: Kerberoasting
Telemetry Required: Windows Security Event ID 4769 (Kerberos Service Ticket Operations) on domain controllers, forwarded to Splunk or ingested into Microsoft Sentinel's SecurityEvent table
Expected Results: A true positive shows one workstation or server account requesting tickets for five or more distinct service accounts within an hour, a pattern normal users and applications do not produce.
False Positive Likelihood: MEDIUM, a handful of legitimate tools (vulnerability scanners, some SharePoint and monitoring services) enumerate SPNs broadly; confirm the requesting host's role before escalating.
Tuning Guidance: Raise the distinct-SPN threshold (currently 5 per hour) for environments with known SPN-enumeration tools, or add those hosts to an exclusion list. Where the SIEM captures Kerberos ticket encryption type, adding a filter for RC4 (etype 0x17) sharpens this further, since most modern service accounts should negotiate AES.

Splunk SPL Query

index=* (source="XmlWinEventLog:Security" OR source="WinEventLog:Security")
    EventCode=4769 earliest=-7d
| bucket _time span=1h
| stats dc(ServiceName) AS distinct_spns count AS requests by _time, IpAddress, TargetUserName
| where distinct_spns >= 5
| sort - distinct_spns
| convert ctime(_time)

Microsoft KQL Query (Defender/Sentinel)

SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4769
| where Status == "0x0"
| summarize distinct_spns = dcount(ServiceName), requests = count()
    by bin(TimeGenerated, 1h), IpAddress, TargetUserName
| where distinct_spns >= 5
| sort by distinct_spns desc

Domain Controller Coerced Into an Outbound Connection

Priority: High, observed in this campaign (PetitPotam); Credential Access impact; durable TTP; domain controllers rarely originate outbound connections at all.
Behavior Targeted: Looks for lsass.exe or svchost.exe on any monitored host, including domain controllers, opening an outbound SMB connection to a non-private (public) IP address, the signature of a forced-authentication coercion relaying the machine's credentials to an attacker-controlled listener.
MITRE ATT&CK: T1187 – Forced Authentication
Telemetry Required: Sysmon Event ID 3 (Network Connection) on domain controllers and servers, or Microsoft Defender for Endpoint's DeviceNetworkEvents table
Expected Results: A true positive shows a domain controller's lsass.exe or svchost.exe connecting outbound on port 445 to an internet-routable address it has no business reason to reach.
False Positive Likelihood: LOW, domain controllers and core servers almost never need to open outbound SMB to a public address; any match deserves review.
Tuning Guidance: Scope this query to known domain controllers and tier-0 servers by device group if the SIEM supports it, since the same pattern on a general-purpose workstation is far less significant. Add any sanctioned external SMB relationship (rare) to an allowlist rather than widening the private-range exclusion.

Splunk SPL Query

index=* (source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" OR source="WinEventLog:Microsoft-Windows-Sysmon/Operational")
    EventCode=3 earliest=-7d
    DestinationPort=445
    (Image="*\\lsass.exe" OR Image="*\\svchost.exe")
| where NOT (cidrmatch("10.0.0.0/8", DestinationIp) OR cidrmatch("172.16.0.0/12", DestinationIp) OR cidrmatch("192.168.0.0/16", DestinationIp))
| stats count min(_time) AS first_seen max(_time) AS last_seen by Computer, Image, DestinationIp, DestinationPort
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL Query (Defender/Sentinel)

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort == 445
| where InitiatingProcessFileName in~ ("lsass.exe", "svchost.exe")
| where not(ipv4_is_private(RemoteIP))
| summarize Count = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| order by Count desc

Rclone Transfer to Cloud Storage Outside Backup Hours

Priority: High, observed in this campaign; Exfiltration impact; Tier 1 endpoint telemetry; a named, stable tool to hunt even as C2 infrastructure rotates.
Behavior Targeted: Looks for rclone.exe process execution where the command line both performs a sync, copy or move operation and references an S3-compatible or MEGA destination, surfacing the device, account and full command line.
MITRE ATT&CK: T1567.002 – Exfiltration to Cloud Storage
Telemetry Required: Endpoint process creation logging (Sysmon Event ID 1, Defender for Endpoint DeviceProcessEvents) with full command-line capture
Expected Results: A true positive shows rclone.exe running against a bucket or remote name the organization's backup team does not recognize, often from a file server or domain controller rather than a dedicated backup host.
False Positive Likelihood: MEDIUM, Rclone is a legitimate backup tool; cross-check the destination bucket and the executing account against approved backup jobs before escalating.
Tuning Guidance: Replace the generic "s3"/"wasabi"/"mega" match with the organization's actual approved cloud-backup destinations once known, so anything outside that list stands out. Extend the command-line match list if the environment also needs to watch for rclone run from a renamed binary.

Splunk SPL Query

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Endpoint.Processes
    where earliest=-7d Processes.process_name="rclone.exe"
        (Processes.process="*sync*" OR Processes.process="*copy*" OR Processes.process="*move*")
        (Processes.process="*s3*" OR Processes.process="*wasabi*" OR Processes.process="*mega*")
    by Processes.dest Processes.user Processes.process
| rename Processes.* AS *
| sort first_seen
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL Query (Defender/Sentinel)

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "rclone.exe" or ProcessCommandLine has "rclone"
| where ProcessCommandLine has_any ("sync", "copy", "move")
| where ProcessCommandLine has_any ("s3", "wasabi", "mega")
| summarize Count = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, AccountName, ProcessCommandLine
| order by FirstSeen asc

Rogue Administrator Account on an Edge Security Appliance

Priority: Medium, observed in this campaign; Persistence impact; kept for tactic coverage outside credential theft, since appliance-side persistence is the stage that starts the whole chain.
Behavior Targeted: Looks for an administrator-privileged account change event on one of the three edge products in this campaign, grouping by the device, the new account and the source of the change for review.
MITRE ATT&CK: T1136.001 – Create Account: Local Account
Telemetry Required: Fortinet FortiGate/FortiWeb and Palo Alto Networks syslog, forwarded as CIM-normalized Change data in Splunk or ingested into Microsoft Sentinel's CommonSecurityLog (CEF) table
Expected Results: A true positive shows a new administrator account appearing on the appliance with no matching internal change ticket, often from a management session the organization's own staff did not initiate.
False Positive Likelihood: MEDIUM, legitimate admin onboarding and vendor support accounts also appear this way; cross-check against the organization's own change log before escalating.
Tuning Guidance: The Activity and DeviceEventClassID string matches below are generic placeholders for "an admin-type account was added"; replace them with the exact event class or subtype your specific FortiGate, FortiWeb or PAN-OS syslog configuration emits, which varies by firmware version. Add a known-change allowlist (ticket-linked admin additions) to cut noise.

Splunk SPL Query

| tstats summariesonly=false count min(_time) AS first_seen max(_time) AS last_seen
    from datamodel=Change.All_Changes
    where earliest=-14d All_Changes.action="created" (All_Changes.object_category="user" OR All_Changes.object_category="account")
    by All_Changes.dvc All_Changes.user All_Changes.src All_Changes.vendor_product
| rename All_Changes.* AS *
| where vendor_product="*Fortinet*" OR vendor_product="*Palo Alto*"
| sort first_seen
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL Query (Defender/Sentinel)

CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceVendor in ("Fortinet", "Palo Alto Networks")
| where Activity has_any ("admin", "user-add", "config")
| where DestinationUserPrivileges =~ "Admin"
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Events = count()
    by DeviceVendor, DeviceProduct, DestinationUserName, SourceIP, Activity
| order by FirstSeen asc

Note: These queries were generated with AI assistance and are a starting point for threat hunting and detection rule considerations.