TeamPCP - Session ID Keyed MD5-XOR Cipher (T1140)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•3•0•3

Detects the unique XOR decryption routine logic utilizing the actor's embedded Session messenger identifier as the key string. This rule specifically looks for file creation or modification events of '.pth' files, correlated with process command lines containing 'contact [alphanumeric] on session'.