title: Potential Webshell Activity via Hades/VShell
id: 6f3a9b8d-5c1e-4a2d-8b9e-1f3c5d6a7b8c
description: Detects potential webshell activity associated with Hades implant or VShell as seen in Thailand MoF attacks, characterized by suspicious process spawning from web server services.
status: stable
author: Security Arsenal
date: 2026/07/24
references:
    - https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\httpd.exe'
            - '\nginx.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: Suspicious PowerShell Loader - TAG-195 TinyEgg/ChonkyChicken
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects PowerShell download cradles and obfuscation often used by MaaS families like TinyEgg and ChonkyChicken to load modular stealers.
status: stable
author: Security Arsenal
date: 2026/07/24
references:
    - https://www.recordedfuture.com/research/tag-195-evolves-maas-ecosystem
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'DownloadString'
            - 'IEX'
            - 'Invoke-Expression'
            - 'FromBase64String'
    filter:
        CommandLine|contains:
            - 'windowsupdate'
            - 'microsoft'
    condition: selection and not filter
falsepositives:
    - System administration scripts
level: medium
---
title: FortiBleed Credential Cracking Tool Execution
id: 9e8f7a6b-5c4d-3e2f-1a0b-9c8d7e6f5a4b
description: Detects execution of credential cracking tools like hashcat often used post-harvest by CyberStrike Harvester to process stolen FortiGate credentials.
status: stable
author: Security Arsenal
date: 2026/07/24
references:
    - https://arcticwolf.com/resources/blog/inside-fortibleed-reverse-engineering-the-cyberstrike-harvester-behind-a-global-fortigate-credential-factory/
tags:
    - attack.credential_access
    - attack.t1110.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\hashcat.exe'
        or OriginalFileName: 'hashcat.exe'
    condition: selection
falsepositives:
    - Authorized penetration testing
level: critical


kql
// Hunt for TAG-195 C2 Domains and TA458 Infrastructure
// Searches for network connections to known malicious domains and IPs
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ (
    "xtrafftrck.net", 
    "screenly.cam", 
    "ahdaratlegalservices.com", 
    "upgybj.store", 
    "xsza.net", 
    "laosji.net"
) 
 or RemoteIP == "43.246.208.207"
| summarize count() by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessAccountName
| order by count_ desc


powershell
# IOC Hunt Script for July 24, 2026 OTX Pulses
# Checks for malicious file hashes and C2 domain presence

$MaliciousHashes = @(
    "7f74bb6ba185978134c318bc5f91d23c", # CyberStrike/EKZ
    "2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98", # CyberStrike
    "6c23b7723a9f69ea48f02c8fe13fd60ecbfc2fb28e32e481c46ec968a66c66cd", # TinyEgg
    "45c8cbaeb5c7708e7b8030e701747c65203958e82eddc41f39e0ca93bd36c114", # ChonkyChicken
    "b7b322f4638ead5c39031ffc7ca8c791c8d47211b09449f7ceb49f0c32a19b45", # ChonkyChicken
    "818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7"  # AMOS/Cluw
)

$C2Domains = @(
    "xtrafftrck.net", 
    "screenly.cam", 
    "ahdaratlegalservices.com", 
    "laosji.net", 
    "upgybj.store", 
    "xsza.net"
)

Write-Host "[+] Scanning running processes for known malicious hashes..." -ForegroundColor Cyan
Get-Process | ForEach-Object {
    $proc = $_
    try {
        $path = $proc.Path
        if ($path -and (Test-Path $path)) {
            $hash = (Get-FileHash -Path $path -Algorithm MD5).Hash.ToLower()
            if ($MaliciousHashes -contains $hash) {
                Write-Host "[!] MALICIOUS PROCESS DETECTED: PID $($proc.Id) - $($proc.ProcessName) - $path" -ForegroundColor Red
            }
        }
    } catch {}
}

Write-Host "[+] Checking DNS Client Cache for C2 domains..." -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $C2Domains -contains $_.Entry } | ForEach-Object {
    Write-Host "[!] SUSPICIOUS DNS ENTRY FOUND: $($_.Entry) -> $($_.Data)" -ForegroundColor Yellow
}


# Response Priorities

*   **Immediate:**
    *   Block all listed domains (`xtrafftrck.net`, `upgybj.store`, etc.) and IP addresses (`43.246.208.207`) at the firewall and proxy.
    *   Scan all endpoints for the provided file hashes (CyberStrike, TinyEgg, AMOS).
    *   Initiate hunting for webshell activity on public-facing servers (specifically Apache and IIS).

*   **24 Hours:**
    *   Verify user identities for accounts with access to FortiGate SSL VPNs and webmail platforms; reset credentials if suspicious activity is detected.
    *   Patch vulnerabilities associated with CVE-2026-35616 (FortiBleed) and CVE-2026-8496 (SOGo) if patches are available, or apply mitigations (WAF rules).
    *   Review AI agent marketplace access (ClawHub) and quarantine any downloaded skills matching the SHA256s provided.

*   **1 Week:**
    *   Architecture hardening: Disable password spraying attacks by implementing MFA on all VPN and webmail entry points.
    *   Review and restrict the use of AI coding assistants/skills within the development environment.
    *   Conduct a forensic review of the Thailand MoF campaign indicators (Hades/Hermes) to ensure no lateral movement occurred if the organization operates in the targeted sectors.