Hunting tip of the day

Threat hunting tip of the day: review non-browser connections to TLDs like [.]shop and [.]xyz.

During our STORESOCKS research, the trojanized Microsoft Store applications contacted helper and relay infrastructure using domains such as mylabubus [.]shop, checkupdatesnow[.]xyz, storetelemetryapi[.]xyz, and storetelemetryapiapps[.]xyz.
That makes these TLDs useful pivots for the campaign, but the hunting value is broader than STORESOCKS.

In many enterprise environments, [.]shop and [.]xyz traffic is relatively uncommon outside normal browsing. Filtering for connections initiated by non-browser processes can reduce the dataset significantly and surface software reaching infrastructure that does not fit its expected behavior.

Useful context includes:
- initiating process and command line
- executable path and signer
- parent process
- first-seen domain and process
- user context
- whether the binary runs from WindowsApps, ProgramData, Temp, or another writable location
- execution shortly after installation, logon, or persistence activity
The same approach can surface loaders, fake software, update mechanisms, proxy malware, and other tooling using inexpensive or disposable infrastructure.
A connection to a [-Jshop or I•Jyz domain is not malicious by itself. The stronger signal is an uncommon domain combined with a process that has no clear reason to contact it.

In our experience, removing common browsers from the results often leaves a small enough dataset for manual review.

Happy hunting.