CPUID Supply Chain Breach: Detecting STX RAT in Trojanized CPU-Z and HWMonitor Installers

---
title: Suspicious PowerShell Spawn by CPU-Z or HWMonitor
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects CPU-Z or HWMonitor spawning PowerShell, which is not typical behavior for these hardware utilities and indicates a trojanized binary executing a payload.
references:
  - https://attack.mitre.org/techniques/T1059/001
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\cpuz.exe'
      - '\cpuz_x64.exe'
      - '\hwmonitor.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
  condition: selection
falsepositives:
  - Legitimate administrative scripts using these tools (rare)
level: high
---
title: STX RAT Persistence via Templates Folder
id: 9b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects creation of executable files in the Windows Templates folder by a parent process resembling CPU-Z/HWMonitor installers, a common TTP for this specific STX RAT variant.
references:
  - https://attack.mitre.org/techniques/T1547/001
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: file_create
  product: windows
detection:
  selection:
    TargetFilename|contains: '\AppData\Roaming\Microsoft\Windows\Templates\'
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
  filter:
    Image|endswith:
      - '\explorer.exe'
      - '\msiexec.exe'
  condition: selection and not filter
falsepositives:
  - Legitimate Office template usage (usually .dotx, not .exe)
level: critical


**Microsoft Sentinel / Defender KQL (Kusto Query Language)**

// Hunt for suspicious network connections from CPU-Z/HWMonitor processes
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("cpuz.exe", "cpuz_x64.exe", "hwmonitor.exe")
| where RemotePort != 443 or RemoteUrl !contains "cpuid.com"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| extend SuspiciousScore = iff(RemotePort in (80, 8080, 443) and RemoteUrl !contains "cpuid.com", 1, 0)
| where SuspiciousScore == 1


**Velociraptor VQL**

-- Hunt for STX RAT artifacts in the Templates directory
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='/*', root='C:/Users/*/AppData/Roaming/Microsoft/Windows/Templates/')
WHERE Name =~ '.exe' OR Name =~ '.dll'
-- Cross-reference with process execution
SELECT Pid, Name, Exe, Parent.Pid as ParentPid, Parent.Name as ParentName, StartTime
FROM pslist()
WHERE Parent.Name =~ 'cpuz' OR Parent.Name =~ 'hwmonitor'


**Remediation Script (PowerShell)**

# Check for specific vulnerable versions of CPU-Z and HWMonitor
# And verify if the binary signature is valid (or missing/invalid indicating tampering)

$vulnerableVersions = @{
    "cpuz.exe" = @("2.05.1", "2.06.0")
    "hwmonitor.exe" = @("1.50", "1.52")
}

$programs = Get-ChildItem "C:\Program Files\CPUID", "${env:ProgramFiles(x86)}\CPUID" -Recurse -ErrorAction SilentlyContinue

foreach ($prog in $programs) {
    if ($vulnerableVersions.ContainsKey($prog.Name)) {
        $versionInfo = $prog.VersionInfo.FileVersion
        if ($versionInfo -in $vulnerableVersions[$prog.Name]) {
            Write-Host "[!] SUSPICIOUS: Found vulnerable version $($prog.Name) (v$versionInfo) at $($prog.FullName)" -ForegroundColor Red
            
            # Check Digital Signature
            $sig = Get-AuthenticodeSignature $prog.FullName
            if ($sig.Status -ne "Valid") {
                Write-Host "[!!!] CRITICAL: Signature status is $($sig.Status). File is likely trojanized." -ForegroundColor Red
            }
        }
    }
}

# Remove known STX RAT persistence artifacts (Use with caution)
$ratPath = "$env:APPDATA\Microsoft\Windows\Templates"
if (Test-Path $ratPath) {
    Write-Host "[*] Scanning $ratPath for executables..."
    Get-ChildItem $ratPath -Filter *.exe -ErrorAction SilentlyContinue | ForEach-Object {
        Write-Host "[!] Found potential RAT payload: $($_.FullName)" -ForegroundColor Yellow
    }
}