Fake Security Tools on GitHub: How to Detect and Remove Unauthorized Access Mechanisms and Infostealers

---
title: Suspicious Security Tool Execution from Temp Directories
id: 8f7a3b2c-9d1e-4f5a-b8c7-2e3f4a5b6c7d
status: experimental
description: Detects execution of security tools from temporary or user-writable directories, a common pattern in fake GitHub tool infections.
references:
  - https://www.bleepingcomputer.com/news/security/fake-security-tools-on-github-push-backdoors-and-infostealers/
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_paths:
    Image|startswith:
      - 'C:\Users\*\AppData\Local\Temp\'
      - 'C:\Users\*\AppData\Roaming\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
  selection_names:
    Image|endswith:
      - '\nmap.exe'
      - '\metasploit.exe'
      - '\burpsuite.exe'
      - '\wireshark.exe'
      - '\sqlmap.exe'
      - '\hydra.exe'
      - '\hashcat.exe'
  condition: selection_paths and selection_names
falsepositives:
  - Legitimate portable security tools (verify hash and source)
level: high
---
title: Infostealer Persistence via Registry Run Keys
id: 9e8f4a5b-1c2d-4e3f-a5b6-7d8e9f0a1b2c
status: experimental
description: Detects creation of persistence mechanisms commonly used by infostealers distributed through fake GitHub security tools.
references:
  - https://attack.mitre.org/techniques/T1060/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1060
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
    Details|contains:
      - 'powershell'
      - 'cmd /c'
      - 'AppData'
      - 'Temp'
  filter:
    Image|endswith:
      - '\reg.exe'
      - '\regedit.exe'
  condition: selection and not filter
falsepositives:
  - Software installers (verify parent process)
level: medium
---
title: Suspicious Git Clone from Non-Standard Locations
id: 7c6d5e4f-3a2b-4c5d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects git operations executed from suspicious directories or with obfuscated URLs, potentially indicating malicious repository cloning.
references:
  - https://attack.mitre.org/techniques/T1195.002/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.supply_chain
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\git.exe'
    CommandLine|contains:
      - 'clone'
  filter_legitimate:
    CommandLine|contains:
      - 'github.com/microsoft/'
      - 'github.com/nmap/'
      - 'github.com/rapid7/'
      - 'github.com/wireshark/'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate development activity (tune based on organizational repos)
level: low

// Hunt for security tools executing from suspicious locations
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("nmap.exe", "metasploit.exe", "burpsuite.exe", "sqlmap.exe", "hydra.exe", "hashcat.exe")
| where FolderPath has_any ("AppData", "Temp", "Downloads", "Desktop")
| where not(FolderPath has_any ("Program Files", "Program Files (x86)", "Windows"))
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessAccountName, InitiatingProcessFileName
| order by TimeGenerated desc

// Hunt for infostealer network indicators (C2 traffic patterns)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("t.me", "telegram.org") or RemoteIP in ("185.220.101.0/24", "194.36.189.0/24")
| where InitiatingProcessFileName in~ ("nmap.exe", "metasploit.exe", "burpsuite.exe", "wireshark.exe", "sqlmap.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated desc

// Hunt for credential dumping attempts following fake tool execution
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4688
| where Process has_any ("nmap", "metasploit", "burp", "wireshark")
| where CommandLine has_any ("sekurlsa", "lsass", "credential", "password", "dump")
| project TimeGenerated, Computer, Process, CommandLine, Account

-- Hunt for fake security tools and infostealer artifacts
SELECT 
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime,
    Authenticode.Signed AS Signed,
    Authenticode.Issuer AS Issuer
FROM pslist()
WHERE 
    (Name =~ '(?i)nmap|metasploit|burp|wireshark|sqlmap|hydra|hashcat'
    AND (
        Exe =~ '(?i)appdata|temp|downloads|desktop'
        OR Authenticode.Signed =~ 'false'
    ))
    OR CommandLine =~ '(?i)github.com.*clone'

-- Check for suspicious network connections from security tools
SELECT 
    Pid,
    Name,
    RemoteAddress,
    RemotePort,
    State
FROM netstat()
WHERE 
    Name =~ '(?i)nmap|metasploit|burp|wireshark|sqlmap'
    AND State =~ 'ESTABLISHED'
    AND RemoteAddress !~ '^(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.)'

# Fake Security Tool Detection and Remediation Script
# Run as Administrator on potentially affected systems

Write-Host "=== Fake GitHub Security Tool Detection and Remediation ===" -ForegroundColor Cyan
Write-Host "Scanning for unauthorized access mechanisms and infostealers..." -ForegroundColor Yellow

# 1. Check for suspicious processes running from temp/AppData
Write-Host "`n[1] Checking for suspicious process execution paths..." -ForegroundColor Green
$suspiciousPaths = @("AppData", "Temp", "Downloads", "Desktop")
$securityTools = @("nmap", "metasploit", "burpsuite", "wireshark", "sqlmap", "hydra", "hashcat")

$processes = Get-WmiObject Win32_Process | Where-Object {
    $proc = $_
    $toolMatch = $securityTools | Where-Object { $proc.Name -like "*$_*" }
    $pathMatch = $suspiciousPaths | Where-Object { $proc.ExecutablePath -like "*$_*" }
    if ($toolMatch -and $pathMatch) { $true }
}

if ($processes) {
    Write-Host "ALERT: Suspicious processes detected:" -ForegroundColor Red
    $processes | Select-Object ProcessId, Name, ExecutablePath, CommandLine | Format-Table -AutoSize
    
    # Terminate suspicious processes
    foreach ($proc in $processes) {
        Write-Host "Terminating PID $($proc.ProcessId): $($proc.Name)" -ForegroundColor Red
        Stop-Process -Id $proc.ProcessId -Force -ErrorAction SilentlyContinue
    }
} else {
    Write-Host "No suspicious process execution detected." -ForegroundColor Green
}

# 2. Check registry Run keys for infostealer persistence
Write-Host "`n[2] Checking registry Run keys for unauthorized access mechanisms..." -ForegroundColor Green
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

$suspiciousEntries = @()
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        $entries = Get-ItemProperty -Path $key
        foreach ($entry in $entries.PSObject.Properties) {
            if ($entry.Value -match "AppData|Temp|powershell|cmd /c") {
                $suspiciousEntries += [PSCustomObject]@{
                    Key = $key
                    Name = $entry.Name
                    Value = $entry.Value
                }
            }
        }
    }
}

if ($suspiciousEntries) {
    Write-Host "ALERT: Suspicious registry persistence detected:" -ForegroundColor Red
    $suspiciousEntries | Format-Table -AutoSize
    
    # Remove suspicious entries
    foreach ($entry in $suspiciousEntries) {
        Write-Host "Removing registry entry: $($entry.Key)\$($entry.Name)" -ForegroundColor Red
        Remove-ItemProperty -Path $entry.Key -Name $entry.Name -Force -ErrorAction SilentlyContinue
    }
} else {
    Write-Host "No suspicious registry persistence detected." -ForegroundColor Green
}

# 3. Check for recently created executables in user-writable directories
Write-Host "`n[3] Checking for recently dropped executables..." -ForegroundColor Green
$recentFiles = Get-ChildItem -Path $env:APPDATA, $env:TEMP, $env:USERPROFILE\Downloads -Recurse -Filter "*.exe" -ErrorAction SilentlyContinue | 
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) } |
    Select-Object FullName, CreationTime, @{Name="SizeKB";Expression={[math]::Round($_.Length/1KB,2)}}

if ($recentFiles) {
    Write-Host "Recent executables found (verify legitimacy):" -ForegroundColor Yellow
    $recentFiles | Format-Table -AutoSize
    
    # Check Authenticode signatures
    foreach ($file in $recentFiles) {
        $sig = Get-AuthenticodeSignature -FilePath $file.FullName
        if ($sig.Status -ne "Valid") {
            Write-Host "UNSIGNED OR INVALID: $($file.FullName)" -ForegroundColor Red
        }
    }
} else {
    Write-Host "No recent executables found in user-writable directories." -ForegroundColor Green
}

# 4. Verify legitimate security tools (if installed)
Write-Host "`n[4] Verifying integrity of legitimate security tools..." -ForegroundColor Green
$legitimatePaths = @{
    "nmap" = "C:\Program Files (x86)\Nmap\nmap.exe"
    "wireshark" = "C:\Program Files\Wireshark\Wireshark.exe"
}

foreach ($tool in $legitimatePaths.GetEnumerator()) {
    if (Test-Path $tool.Value) {
        $sig = Get-AuthenticodeSignature -FilePath $tool.Value
        $hash = Get-FileHash -Path $tool.Value -Algorithm SHA256
        Write-Host "$($tool.Key): $($sig.Status) - Hash: $($hash.Hash.Substring(0,16))..." -ForegroundColor $(if ($sig.Status -eq "Valid") { "Green" } else { "Red" })
    }
}

# 5. Network connections check
Write-Host "`n[5] Checking for suspicious network connections from security tools..." -ForegroundColor Green
$netstat = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | 
    Where-Object { $_.OwningProcess -ne $null } | 
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc -and ($proc.ProcessName -match "nmap|metasploit|burp|wireshark|sqlmap|hydra")) {
            [PSCustomObject]@{
                Process = $proc.ProcessName
                PID = $_.OwningProcess
                RemoteAddress = $_.RemoteAddress
                RemotePort = $_.RemotePort
                Path = $proc.Path
            }
        }
    }

if ($netstat) {
    Write-Host "Active network connections from security tools:" -ForegroundColor Yellow
    $netstat | Format-Table -AutoSize
} else {
    Write-Host "No suspicious network connections from security tools." -ForegroundColor Green
}

Write-Host "`n=== Remediation Complete ===" -ForegroundColor Cyan
Write-Host "Recommendations:" -ForegroundColor Yellow
Write-Host "1. Only download security tools from official vendor sites or verified GitHub repositories" -ForegroundColor White
Write-Host "2. Verify SHA256 hashes against official releases before execution" -ForegroundColor White
Write-Host "3. Use Windows Defender Application Control (WDAC) or AppLocker to restrict unauthorized binaries" -ForegroundColor White
Write-Host "4. Monitor for unusual outbound connections from security workstations" -ForegroundColor White