title: Potential CastleLoader PowerShell Stager Activity
id: 98c7d5a1-3f4b-4c5d-9e6f-1a2b3c4d5e6f
description: Detects PowerShell commands often used in CastleLoader campaigns, specifically those invoking IronPython or downloading shellcode.
status: experimental
date: 2026/07/28
author: Security Arsenal
references:
    - https://arcticwolf.com/resources/blog/castleloader-new-campaigns-new-tooling-and-the-needlestealer-connection/
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'IronPython'
            - 'ipy.exe'
            - 'FromBase64String'
            - 'Char[]'
    condition: selection
falsepositives:
    - Legitimate system administration scripts utilizing IronPython
level: high
---
title: NeedleStealer Browser Extension Modification
id: 11223344-5566-7788-99aa-bbccddeeff00
description: Detects modification of browser extension directories by suspicious processes, a behavior associated with NeedleStealer and other info-stealers.
status: experimental
date: 2026/07/28
author: Security Arsenal
tags:
    - attack.persistence
    - attack.t1176
logsource:
    product: windows
    category: file_change
detection:
    selection_target:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\Default\Extensions'
            - '\Mozilla\Firefox\Profiles\extensions'
    selection_image:
        Image|endswith:
            - '\python.exe'
            - '\pythonw.exe'
            - '\powershell.exe'
            - '\cmd.exe'
    filter_legit:
        Image|contains:
            - '\Chrome\Application'
            - '\Firefox\'
    condition: selection_target and selection_image and not filter_legit
falsepositives:
    - Legitimate browser extension updates
level: medium
---
title: MCP/AI Infrastructure Suspicious Shell Execution
id: aabbccdd-1122-3344-5566-778899001122
description: Detects suspicious shell command execution patterns observed in MCP honeypots, such as accessing secrets or model files.
status: experimental
date: 2026/07/28
author: Security Arsenal
references:
    - https://beelzebub.ai/blog/it-thought-it-had-won/
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - '/bin/sh'
            - '/bin/bash'
        CommandLine|contains:
            - 'secrets-store'
            - 'aws bedrock'
            - 'mcp'
            - 'cat /proc'
    condition: selection
falsepositives:
    - DevOps tools legitimately accessing AI APIs
level: high


kql
// KQL Hunt for C2 Traffic and Suspicious Processes
// Hunt for network connections to known bad IOCs and suspicious PowerShell/IronPython activity

let IoC_Domains = dynamic([
    "teamsvoicepremium.com", "italianhitech.com", "ebedidance.com", 
    "drrajivparti.com", "p-rala.com", "xx.com", "kzeva2010.sbs", 
    "snitch-dev.space", "gui-snitch.online"
]);
let IoC_IPs = dynamic([
    "94.26.90.112", "115.84.87.150", "23.27.175.241", "102.210.28.96",
    "103.151.172.25", "108.80.112.16", "115.84.114.84", "152.55.176.13"
]);

// Network Connections
DeviceNetworkEvents
| where RemoteUrl in~ IoC_Domains or RemoteIP in~ IoC_IPs
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort

// Process Creation related to malware families
union DeviceProcessEvents, DeviceEvents
| where Timestamp > ago(7d)
| where (ProcessCommandLine contains "IronPython" or ProcessCommandLine contains "ipy.exe" 
        or ProcessCommandLine contains "FromBase64String") 
   or (InitiatingProcessFileName =~ "powershell.exe" and ProcessCommandLine contains "downloadstring")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName


powershell
# PowerShell Hunt Script: CastleLoader and NeedleStealer Artifacts
# Checks for specific file hashes, processes, and registry persistence

$MaliciousHashes = @(
    "d26ea6828cc01ae151d99bbee78c4e6d132e9077842a558bce3901fa0970d9be"
)

$SuspiciousProcesses = @("ipy.exe", "pythonr", "netsupport")

Write-Host "[+] Checking for Malicious File Hashes..."
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0kb -and $_.Length -lt 10mb } | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hash -in $MaliciousHashes) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) (Hash: $hash)" -ForegroundColor Red
        }
    }

Write-Host "[+] Checking for Suspicious Processes..."
Get-Process | Where-Object { 
    $SuspiciousProcesses -like ($_.ProcessName + "*") 
} | ForEach-Object {
    Write-Host "[!] SUSPICIOUS PROCESS RUNNING: $($_.ProcessName) (PID: $($_.Id))" -ForegroundColor Yellow
}

Write-Host "[+] Checking Scheduled Tasks for Persistence..."
Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -like "*powershell*" -or $_.Actions.Execute -like "*python*" 
} | Select-Object TaskName, TaskPath, Actions | Format-Table -AutoSize


# Response Priorities