CL-STA-1178 Blinder Tunnel + Agent Tesla Q3 Surge: OTX Detection Pack for ShelbyLoader, GTA VI Lures, Langflow RCE and AWS Bedrock Key Testing

---
title: CL-STA-1178 ShelbyLoader AppDomainManager and DLL Sideload Chain
id: 9b2d7b6f-5c41-4dd9-a1c7-clsta1178apdm
status: experimental
description: Detects .NET AppDomainManager hijack and suspicious DLL sideload artifacts associated with ShelbyLoader V2, RuntimeBroker.dll, PsProxy.dll and Blackwood.dll.
author: Security Arsenal
date: 2026/11/06
references:
  - https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/
logsource:
  product: windows
  category: process_creation
level: high
logsource:
  product: windows
  category: process_creation
detection:
  sel_img:
    Image|endswith:
      - '\RuntimeBroker.exe'
      - '\powershell.exe'
      - '\msbuild.exe'
      - '\dotnet.exe'
  sel_cli:
    CommandLine|contains:
      - 'AppDomainManager'
      - 'ShelbyLoader'
      - 'PsProxy.dll'
      - 'Blackwood.dll'
      - 'coding challenge'
      - 'Dubai Airports'
  condition: sel_img and sel_cli
falsepositives:
  - Legitimate .NET development with explicit AppDomainManager configuration
fields:
  - CommandLine
  - ParentCommandLine
  - Image
  - User
---
title: Chisel Reverse Tunnel or GitHub C2 Egress from Developer Workstations
id: 4a83d7b1-22c8-4f93-b4e5-blinderchisel
status: experimental
description: Identifies Chisel-like reverse tunnel arguments or rare egress to raw GitHub content from office/developer endpoints consistent with Blinder Tunnel C2.
author: Security Arsenal
date: 2026/11/06
references:
  - https://unit42.paloaltonetworks.com/blinder-tunnel-targets-critical-infrastructure/
logsource:
  product: windows
  category: process_creation
detection:
  sel_args:
    CommandLine|contains:
      - 'chisel client'
      - 'chisel server'
      - 'R:0.0.0.0'
      - '--reverse'
      - 'raw.githubusercontent.com'
      - 'githubusercontent'
  sel_rare_parent:
    ParentImage|endswith:
      - '\devenv.exe'
      - '\code.exe'
      - '\RuntimeBroker.exe'
      - '\powershell.exe'
  condition: sel_args and sel_rare_parent
level: medium
falsepositives:
  - Developer tunneling and package retrieval
fields:
  - CommandLine
  - ParentImage
  - DestinationHostname
---
title: AWS Credential Validation for Amazon Bedrock Access
id: c76a0fd8-9d10-4ce1-aac4-bedrockvalidate
status: experimental
description: Detects rapid sequence of GetCallerIdentity followed by Bedrock ListFoundationModels or InvokeModel checks from interactive or newly exposed keys.
author: Security Arsenal
date: 2026/11/06
references:
  - https://securitylabs.datadoghq.com/articles/beyond-valid-credentials-how-exposed-aws-keys-are-tested-for-amazon-bedrock-access
logsource:
  product: aws
  service: cloudtrail
detection:
  sel_identity:
    eventName: 'GetCallerIdentity'
  sel_bedrock:
    eventName:
      - 'ListFoundationModels'
      - 'InvokeModel'
      - 'Converse'
      - 'ListModelCustomizationJobs'
  timeframe: 15m
  condition: sel_identity and sel_bedrock
level: high
falsepositives:
  - Legitimate AI enablement testing by cloud platform teams
fields:
  - userIdentity.accessKeyId
  - sourceIPAddress
  - userAgent
  - eventName

let lookback = 7d;
let bad_domains = dynamic(["wekash.net","splace.co.za","carloxmextos.org","gta6cyberleek.com","cyberleek.click","mygta6.icu","gta6keycodes.com","cyberleek.my","contact-rockstargames.com","cyberleek.cfd","cyberleek.world"]);
let bad_hashes = dynamic(["6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239","f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9","53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402","bedd2297739632da8ee470367295fe976e55be74d628dcaee7fa98121ee530f1","923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any (bad_domains) or RemoteIP in ())
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType),
(DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where SHA256 in (bad_hashes) or ProcessCommandLine has_any ("AppDomainManager","ShelbyLoader","PsProxy.dll","Blackwood.dll","chisel client","raw.githubusercontent.com")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, ParentFileName, SHA256, AccountName),
(SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID in (4688, 4624, 4625)
| where CommandLine has_any ("chisel","AppDomainManager","aws sts get-caller-identity","bedrock list-foundation-models")
| project TimeGenerated, Computer, Account, CommandLine, ProcessName, IpAddress)

$ErrorActionPreference = 'SilentlyContinue'
$Hashes = @('6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239','f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9','53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402','bedd2297739632da8ee470367295fe976e55be74d628dcaee7fa98121ee530f1','923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608')
$Names = @('ShelbyLoader','RuntimeBroker.dll','PsProxy.dll','Blackwood.dll','chisel')
$Domains = @('wekash.net','splace.co.za','carloxmextos.org','gta6cyberleek.com','cyberleek.click','mygta6.icu','gta6keycodes.com','contact-rockstargames.com')
Write-Output '[*] Recent prefetch, amcache and shimcache process names'
Get-ChildItem $env:SystemRoot\Prefetch -Filter *.pf | Where-Object {$_.Name -match 'RUNTIMEBROKER|CHISEL|MSBUILD|DOTNET|POWERSHELL'} | Select-Object Name,LastWriteTime
Write-Output '[*] User-writable AppDomainManager and DLL staging paths'
$paths = @($env:APPDATA,$env:LOCALAPPDATA,$env:TEMP,'C:\ProgramData')
foreach ($p in $paths) { Get-ChildItem $p -Recurse -Force -ErrorAction SilentlyContinue | Where-Object {$Names -contains $_.Name -or ($Hashes -contains ((Get-FileHash $_.FullName -Algorithm SHA256).Hash))} | Select-Object FullName,Length,LastWriteTime }
Write-Output '[*] Persistence locations with challenge, airport or loader names'
Get-CimInstance Win32_StartupCommand | Where-Object {$_.Command -match 'AppDomainManager|Shelby|RuntimeBroker|Blackwood|Dubai|coding'} | Select-Object Name,Command,Location,User
Get-ScheduledTask | Where-Object {$_.TaskName -match 'Dubai|Challenge|Shelby|RuntimeBroker|Blackwood' -or $_.Actions.Execute -match 'powershell|msbuild|dotnet|chisel'} | Select-Object TaskName,TaskPath,State
Write-Output '[*] DNS cache and active TCP endpoints for lure domains'
Get-DnsClientCache | Where-Object {$_.Entry -match ($Domains -join '|')} | Select-Object Entry,Name,Data
Get-NetTCPConnection -State Established | Where-Object {$_.OwningProcess -in (Get-Process | Where-Object {$_.ProcessName -match 'powershell|dotnet|RuntimeBroker|chisel'}).Id} | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess
Write-Output '[*] AWS CLI/Bedrock validation traces in shell history'
Get-Content "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt" -ErrorAction SilentlyContinue | Where-Object {$_ -match 'get-caller-identity|bedrock|list-foundation-models|invoke-model|chisel|githubusercontent'}