Defending Against TDS-Driven SEO Poisoning: Detecting Fake Open-Source Installers

---
title: Potential Fake Tool Execution from User Profile
id: 8a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects execution of binaries with names resembling common open-source tools originating from user profile directories (Downloads/Desktop), a hallmark of fake installers.
references:
  - https://thehackernews.com/2026/06/fake-sites-mimicking-open-source-tools.html
author: Security Arsenal
date: 2026/06/12
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\putty.exe'
      - '\vncviewer.exe'
      - '\7zFM.exe'
      - '\notepad++.exe'
      - '\filezilla.exe'
      - '\wireshark.exe'
  selection_path:
    Image|contains:
      - '\Downloads\'
      - '\Desktop\'
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
  condition: all of selection_*
falsepositives:
  - Legitimate portable versions of tools run by administrators
level: high
---
title: Suspicious Access to Browser Credential Files by Non-Browser Process
id: 9b3c2d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects Remus Stealer or SessionGate behavior where a non-browser process attempts to open Chrome or Edge 'Login Data' or 'Cookies' files.
references:
  - https://thehackernews.com/2026/06/fake-sites-mimicking-open-source-tools.html
author: Security Arsenal
date: 2026/06/12
tags:
  - attack.credential_access
  - attack.t1555.003
logsource:
  category: file_access
  product: windows
detection:
  selection_target:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Google\Chrome\User Data\Default\Cookies'
      - '\Microsoft\Edge\User Data\Default\Login Data'
      - '\Microsoft\Edge\User Data\Default\Cookies'
  filter_browsers:
    Image|contains:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\opera.exe'
      - '\brave.exe'
  condition: selection_target and not filter_browsers
falsepositives:
  - Legitimate backup software or password managers accessing browser stores
level: critical

// Hunt for processes spawned by browsers that resemble TDS redirects or downloaders
// Looks for cmd, powershell, or mshta spawned directly after a browser navigation
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
| where ProcessFileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, ProcessFileName, FolderPath
| order by Timestamp desc

-- Hunt for executables in User Downloads or Desktop that are unsigned or
-- have invalid signatures, indicative of fake installers.
SELECT 
    FullPath,
    Size,
    Mtime,
    SigState,
    SigSubject,
    SigSigners
FROM glob(globs="C:\Users\*\Downloads\*.exe")
WHERE SigState != "Valid" 
   OR SigSubject NOT CONTAINS "Microsoft" 
   AND SigSubject NOT CONTAINS "Open Source Developer"
-- Add specific known vendor names you trust to the exclusion list

<#
.SYNOPSIS
    Scans user profile download directories for executables lacking valid digital signatures.
    Designed to identify potential fake open-source installers from SEO poisoning campaigns.
#>

$RiskPaths = @("$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop")
$FoundThreats = @()

foreach ($Path in $RiskPaths) {
    if (Test-Path $Path) {
        Write-Host "Scanning $Path for unsigned executables..." -ForegroundColor Cyan
        
        Get-ChildItem -Path $Path -Filter *.exe -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            
            # Check for invalid signature or no signature
            if ($sig.Status -ne 'Valid') {
                $FoundThreats += [PSCustomObject]@{
                    File = $_.FullName
                    Status = $sig.Status
                    Signer = $sig.SignerCertificate.Subject
                }
            }
        }
    }
}

if ($FoundThreats.Count -gt 0) {
    Write-Host "[ALERT] Potentially malicious unsigned executables found:" -ForegroundColor Red
    $FoundThreats | Format-Table -AutoSize
    # Optional: Quarantine logic here (Move-Item)
} else {
    Write-Host "No unsigned executables found in standard download folders." -ForegroundColor Green
}