Stories from the SOC: Mystery of the postponed proxyware install
Essential information
- Published
- 24/11/2025 21:10
- Modified
- 21/12/2025 18:00
- Tags
- 2025-11-24 c2 server disk-cleaning utility download cradle in-memory execution node.js powershell proxyware unauthorized software
- Related entities
- 5 observables, 10 techniques (mitre), 6 others
Description
A suspicious PowerShell alert led to the discovery of an attack chain aimed at installing proxyware on a compromised system. The infection originated from a disk-cleaning utility installed three days prior, which included malicious scripts and established a connection to a C2 server. The attack utilized a download cradle and in-memory execution techniques to evade detection. The SOC team successfully intercepted the attack before the proxyware installation could complete. The incident highlights the risks associated with unauthorized software installations and the importance of restricting PowerShell access in corporate environments.