← Back to SOC feed Coverage →

Gentlemen Ransomware C2 domain connection

kql MEDIUM Azure-Sentinel
T1568.002T1567.002
DeviceNetworkEvents
backdoorhuntingmicrosoftofficialransomware
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-29T11:00:00Z · Confidence: medium

Hunt Hypothesis

Outbound connections to decentralized Web3 C2 domains are indicative of ransomware actors establishing covert command and control channels to exfiltrate data and execute payloads. SOC teams should proactively hunt for these connections in Azure Sentinel to detect and disrupt early-stage ransomware intrusions before significant damage occurs.

KQL Query

// DETECTION STRATEGY: 
// Identify outbound connections to decentralized Web3 C2s, TryCloudflare tunnels, and abused SaaS platforms associated with Gentlemen ransomware operations.
// 
// THE MECHANIC: 
// The threat actor leverages legitimate (but highly anomalous for corporate endpoints) third-party infrastructure (like 1rpc.io, TryCloudflare, ClickHouse, and Supabase) for Command and Control and Data Exfiltration. This technique bypasses traditional reputation-based blocking and blends the C2 beacons into standard HTTPS traffic.

// These domains represent the exact hardcoded SaaS endpoints and decentralized C2 gateways extracted from the EtherRAT and TukTuk configurations in recent DFIR reporting.
let domainIocs = dynamic([
    // Tier 1: Decentralized Web3 & Blockchain Gateways
    "1rpc.io",

    // Tier 2: Public Tunneling Services (TryCloudflare)
    "witch-skins-lip-coal.trycloudflare.com",
    "fields-pct-easier-vancouver.trycloudflare.com",
    "howto-tar-naturals-coordination.trycloudflare.com",
    "workshop-lighting-protective-customs.trycloudflare.com",
    "afford-effect-construct-tricks.trycloudflare.com",
    "rapids-lil-lending-charleston.trycloudflare.com",
    "when-architectural-cdna-faster.trycloudflare.com",
    "mode-exit-legendary-trusted.trycloudflare.com",
    "seasonal-estimation-heating-necessarily.trycloudflare.com",
    "entered-medications-motherboard-advanced.trycloudflare.com",
    "walt-messaging-affairs-occurring.trycloudflare.com",

    // Tier 3: Abused SaaS Data Platforms (C2 / Exfiltration)
    "vefbdzzuaadnascpeqcn.supabase.co",
    "muurfzqprzmdkzoibxaz.supabase.co",
    "k135neflez.westus3.azure.clickhouse.cloud",
    "vngz3ntdrb.us-east1.gcp.clickhouse.cloud",
    "ep-lively-cherry-a80bmwii.eastus2.azure.neon.tech",

    // Tier 4: Fallback HTTP C2
    "borjumaniya.store"
]);

// Look for network connection events from Defender for Endpoint telemetry
DeviceNetworkEvents
  // STEP 1: Filter network traffic for the specific adversary infrastructure
  // Fast, indexed pre-filter to find rows that *might* match
  | where RemoteUrl has_any ("trycloudflare", "supabase", "1rpc", "clickhouse", "borjumaniya", "azure") 
  // Now only parse the 1% of rows that passed the filter
  | extend ExtractedHost = tostring(parse_url(RemoteUrl).Host)
  | where ExtractedHost in~ (domainIocs)
  
  // STEP 2: Schema Alignment & Entity Preparation
  // explicitly cast InitiatingProcessId to a string to satisfy the Process entity schema
  | extend ProcessIdString = tostring(InitiatingProcessId) 
  
  // STEP 3: Format the output for triage
  // ANALYST ACTION: Review 'CommandLine' and 'Process'. If the initiating process is a renamed LOLBin, a side-loaded DLL runner, or originates from a user's AppData/Downloads directory, assume immediate C2 communication and isolate the host. Check the 'DestinationUrl' to see if data exfiltration (SaaS) or C2 resolution (1rpc.io) is occurring.
  | project Timestamp, 
            DeviceName, 
            Account = InitiatingProcessAccountName, 
            Process = InitiatingProcessFileName, 
            CommandLine = InitiatingProcessCommandLine, 
            DestinationUrl = RemoteUrl, 
            DestinationIp = RemoteIP, 
            DestinationPort = RemotePort,
            ProcessIdString
            
  // STEP 4: Visual Hierarchy
  // Structure the output from context (Who/Where) to evidence (What/How) for maximum Tier 1 efficiency
  | project-reorder Timestamp, 
                    DeviceName, 
                    Account, 
                    Process, 
                    CommandLine, 
                    DestinationUrl, 
                    DestinationIp, 
                    DestinationPort
  | sort by Timestamp desc

Analytic Rule Definition

id: 8dda012e-8628-41ca-b09f-31a2a849a40e
name: Gentlemen Ransomware C2 domain connection
description: |
  This query identifies outbound connections to decentralized Web3 C2s, TryCloudflare tunnels, and abused SaaS platforms associated with the EtherRAT, TukTuk, and Gentlemen ransomware intrusion chains.
description-detailed: |
  References:
  https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware
requiredDataConnectors:
  - connectorId: MicrosoftThreatProtection
    dataTypes:
      - DeviceNetworkEvents
tactics:
  - CommandAndControl
  - Exfiltration
relevantTechniques:
  - T1568.002
  - T1567.002
query: |
  // DETECTION STRATEGY: 
  // Identify outbound connections to decentralized Web3 C2s, TryCloudflare tunnels, and abused SaaS platforms associated with Gentlemen ransomware operations.
  // 
  // THE MECHANIC: 
  // The threat actor leverages legitimate (but highly anomalous for corporate endpoints) third-party infrastructure (like 1rpc.io, TryCloudflare, ClickHouse, and Supabase) for Command and Control and Data Exfiltration. This technique bypasses traditional reputation-based blocking and blends the C2 beacons into standard HTTPS traffic.
  
  // These domains represent the exact hardcoded SaaS endpoints and decentralized C2 gateways extracted from the EtherRAT and TukTuk configurations in recent DFIR reporting.
  let domainIocs = dynamic([
      // Tier 1: Decentralized Web3 & Blockchain Gateways
      "1rpc.io",

      // Tier 2: Public Tunneling Services (TryCloudflare)
      "witch-skins-lip-coal.trycloudflare.com",
      "fields-pct-easier-vancouver.trycloudflare.com",
      "howto-tar-naturals-coordination.trycloudflare.com",
      "workshop-lighting-protective-customs.trycloudflare.com",
      "afford-effect-construct-tricks.trycloudflare.com",
      "rapids-lil-lending-charleston.trycloudflare.com",
      "when-architectural-cdna-faster.trycloudflare.com",
      "mode-exit-legendary-trusted.trycloudflare.com",
      "seasonal-estimation-heating-necessarily.trycloudflare.com",
      "entered-medications-motherboard-advanced.trycloudflare.com",
      "walt-messaging-affairs-occurring.trycloudflare.com",

      // Tier 3: Abused SaaS Data Platforms (C2 / Exfiltration)
      "vefbdzzuaadnascpeqcn.supabase.co",
      "muurfzqprzmdkzoibxaz.supabase.co",
      "k135neflez.westus3.azure.clickhouse.cloud",
      "vngz3ntdrb.us-east1.gcp.clickhouse.cloud",
      "ep-lively-cherry-a80bmwii.eastus2.azure.neon.tech",

      // Tier 4: Fallback HTTP C2
      "borjumaniya.store"
  ]);
  
  // Look for network connection events from Defender for Endpoint telemetry
  DeviceNetworkEvents
    // STEP 1: Filter network traffic for the specific adversary infrastructure
    // Fast, indexed pre-filter to find rows that *might* match
    | where RemoteUrl has_any ("trycloudflare", "supabase", "1rpc", "clickhouse", "borjumaniya", "azure") 
    // Now only parse the 1% of rows that passed the filter
    | e

Required Data Sources

Sentinel TableNotes
DeviceNetworkEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Campaigns/TheGentlemanRansomware/GentlemanRansomwareC2DomainConnection.yaml