FakeAgent Malvertising + SectopRAT/StealC, npm/Rust Supply Chain Stealers & N4D Mesh Controller: OTX Pulse Analysis — Enterprise Detection Pack

---
title: FakeAgent SectopRAT Fake Claude Desktop Installer Execution
id: 8f1a2b3c-4d5e-4f6a-9b0c-1d2e3f4a5b01
status: experimental
description: Detects execution of fake Claude Desktop installers and SectopRAT loader behavior associated with the FakeAgent malvertising campaign, including DLL sideloading of VMProtect-packed payloads.
author: Security Arsenal Threat Intelligence
date: 2026/08/22
references:
    - https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\claude-setup.exe'
            - '\claude desktop.exe'
            - '\claude-desktop-installer.exe'
    selection_download:
        CommandLine|contains:
            - 'download-app.us'
            - '107.189.24.255'
    selection_sideload:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            - 'AppData\Local\Temp'
            - 'AppData\Roaming\Claude'
    condition: selection_img or selection_download or selection_sideload
falsepositives:
    - Legitimate Claude Desktop installation from anthropic.com (validate signer and download source)
level: high
tags:
    - attack.initial_access
    - attack.t1189
    - attack.t1574.002
---
title: Malicious Package Install Script Execution - npm and Cargo Build-Time Payload
id: 8f1a2b3c-4d5e-4f6a-9b0c-1d2e3f4a5b02
status: experimental
description: Detects suspicious child processes spawned by npm install scripts or Cargo build scripts, consistent with BRIDGEHEAD npm typosquatting and the proc-macro1 Rust crate supply chain attack.
author: Security Arsenal Threat Intelligence
date: 2026/08/22
references:
    - https://www.cloudsek.com/blog/bridgehead-npm-typosquatting-wsl-windows-crypto-wallet-stealer
    - https://socket.dev/blog/popular-rust-crates-compromised
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
            - '\cargo.exe'
            - '\rustc.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\curl.exe'
            - '\certutil.exe'
            - '\wsl.exe'
            - '\rundll32.exe'
    selection_cli:
        CommandLine|contains:
            - 'DownloadString'
            - 'Invoke-WebRequest'
            - 'github.com'
            - '-enc '
            - 'wsl -e'
            - 'wsl.exe --exec'
    condition: selection_parent and selection_child and selection_cli
falsepositives:
    - Legitimate build scripts downloading native dependencies; tune by package allowlist
level: high
tags:
    - attack.supply_chain_compromise
    - attack.t1195.001
    - attack.t1059.001
---
title: Suspicious Direct-IP HTTPS Connection on Non-Standard Port - Supply Chain Payload Staging
id: 8f1a2b3c-4d5e-4f6a-9b0c-1d2e3f4a5b03
status: experimental
description: Detects HTTPS connections to raw IP addresses on non-standard ports matching proc-macro1 payload staging (23.254.165.112:9089) and N4D Mesh Controller infrastructure patterns.
author: Security Arsenal Threat Intelligence
date: 2026/08/22
references:
    - https://socket.dev/blog/popular-rust-crates-compromised
    - https://securitylabs.datadoghq.com/articles/n4d-mesh-controller-go-titan-new-infrastructure-hunting/
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '23.254.165.112'
            - '107.189.24.255'
            - '209.99.186.235'
    selection_domain:
        DestinationHostname|endswith:
            - 'download-app.us'
            - 'cdnorigin.net'
    selection_port:
        DestinationPort:
            - 9089
    condition: selection_ip or selection_domain or selection_port
falsepositives:
    - Internal direct-IP services; restrict selection_port to external ranges if needed
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001

// Security Arsenal - OTX Pulse Hunt: FakeAgent/BRIDGEHEAD/proc-macro1/N4D IOCs & behaviors
// Microsoft Sentinel / Defender XDR - 30-day retro hunt
let MaliciousIPs = dynamic(["107.189.24.255", "209.99.186.235", "23.254.165.112"]);
let MaliciousDomains = dynamic(["download-app.us", "cdnorigin.net", "checkmyschool.org", "education-gov.com", "studentdiscount.online", "studentloansyyyy.com", "students-portal.com"]);
let MaliciousSHA256 = dynamic(["1cd58cfba596da296ab1878d74023e00c399345a1b6c2a0e5446c53563f4e3bb", "1fe3646d27d286db8123297e06ae7badf3e26f352a04f91b6d82c28869a91664", "6f088ade49456db2422c3edfbb9998f4a3e9cce7c4c00a7279fb45d672a82b7d", "52c11f246309cce5556a00408bafb9868622114903dbd8128dc4ce3eca2df27a", "6888d4c54ef2b5bf23889f9637c2efe77e1d2af4724d315b73d646cf5547dc73", "408ef22050ffc5a67e005802809026b29f297a8019f8fda91a2afa8e877ba434", "74d3447e7cf99c99ea01a16332ec27432dfb0f491e10e67cd118065a60483306", "492f2ab86f8d8911adc79c10ec1541704f5311d207d9d799b0d2a57fcc6a4391", "c9561a3b00a0fa38b7772675d987f84bd429c55cd024fc08a98245c2d1632848"]);
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteIP in (MaliciousIPs) or RemoteUrl has_any (MaliciousDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
    | extend HitType = "Network IOC";
let FileHits = DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 in (MaliciousSHA256)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, FileName, SHA256, ActionType
    | extend HitType = "File Hash IOC";
let InstallScriptHits = DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where InitiatingProcessFileName in~ ("node.exe", "npm.cmd", "cargo.exe", "rustc.exe", "wsl.exe")
    | where ProcessCommandLine has_any ("DownloadString", "Invoke-WebRequest", "-enc", "github.com", "23.254.165.112")
       or FileName in~ ("powershell.exe", "cmd.exe", "curl.exe", "certutil.exe", "rundll32.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
    | extend HitType = "Build/Install Script Execution";
union NetworkHits, FileHits, InstallScriptHits
| sort by TimeGenerated desc

# Security Arsenal - OTX IOC Hunt Script
# FakeAgent (SectopRAT/StealC), BRIDGEHEAD, proc-macro1, N4D Mesh Controller
# Run elevated on Windows endpoints; review output CSV for hits.

$report = @()

# --- 1. Network IOCs: active & recent connections ---
$badIPs = @("107.189.24.255","209.99.186.235","23.254.165.112")
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $badIPs -contains $_.RemoteAddress -or $_.RemotePort -eq 9089 }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    $report += [PSCustomObject]@{ Check="NetworkIOC"; Detail="$($c.LocalAddress):$($c.LocalPort) -> $($c.RemoteAddress):$($c.RemotePort) [$($proc.ProcessName)]"; Severity="CRITICAL" }
}

# --- 2. DNS cache for malicious domains ---
$badDomains = @("download-app.us","cdnorigin.net","checkmyschool.org","education-gov.com","studentdiscount.online","studentloansyyyy.com","students-portal.com")
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $d = $_.Entry; $badDomains | Where-Object { $d -like "*$_*" } }
foreach ($d in $dns) {
    $report += [PSCustomObject]@{ Check="DNSCache"; Detail="$($d.Entry) -> $($d.Data)"; Severity="HIGH" }
}

# --- 3. Fake Claude installer artifacts (FakeAgent campaign) ---
$susPaths = @("$env:TEMP","$env:LOCALAPPDATA\Temp","$env:APPDATA\Claude","$env:USERPROFILE\Downloads")
foreach ($p in $susPaths) {
    if (Test-Path $p) {
        Get-ChildItem $p -Recurse -ErrorAction SilentlyContinue -Include "claude-setup*","claude*desktop*.exe","*.msi" |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-45) } | ForEach-Object {
            $sig = Get-AuthenticodeSignature $_.FullName
            if ($sig.Status -ne "Valid") {
                $report += [PSCustomObject]@{ Check="FakeInstaller"; Detail="$($_.FullName) [Sig: $($sig.Status)] [Hash: $((Get-FileHash $_.FullName -Algorithm SHA256).Hash)]"; Severity="HIGH" }
            }
        }
    }
}

# --- 4. Known malware hashes on disk ( Downloads/AppData sweep ) ---
$badHashes = @("1cd58cfba596da296ab1878d74023e00c399345a1b6c2a0e5446c53563f4e3bb","1fe3646d27d286db8123297e06ae7badf3e26f352a04f91b6d82c28869a91664","6f088ade49456db2422c3edfbb9998f4a3e9cce7c4c00a7279fb45d672a82b7d","52c11f246309cce5556a00408bafb9868622114903dbd8128dc4ce3eca2df27a","6888d4c54ef2b5bf23889f9637c2efe77e1d2af4724d315b73d646cf5547dc73","408ef22050ffc5a67e005802809026b29f297a8019f8fda91a2afa8e877ba434","74d3447e7cf99c99ea01a16332ec27432dfb0f491e10e67cd118065a60483306","492f2ab86f8d8911adc79c10ec1541704f5311d207d9d799b0d2a57fcc6a4391","c9561a3b00a0fa38b7772675d987f84bd429c55cd024fc08a98245c2d1632848")
Get-ChildItem "$env:USERPROFILE\Downloads","$env:LOCALAPPDATA","$env:APPDATA" -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -lt 50MB } | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($badHashes -contains $h) {
        $report += [PSCustomObject]@{ Check="MalwareHash"; Detail="$($_.FullName) [$h]"; Severity="CRITICAL" }
    }
}

# --- 5. Suspicious Run-key persistence (SectopRAT/StealC commonly persist here) ---
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
    Get-ItemProperty $k -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match "Temp|AppData|claude|node|cargo" -and $_.Name -notmatch "^PS" } | ForEach-Object {
            $report += [PSCustomObject]@{ Check="Persistence"; Detail="$k\$($_.Name) = $($_.Value)"; Severity="MEDIUM" }
        }
    }
}

# --- 6. Compromised npm/Rust dependencies in local dev caches ---
$npmCache = "$env:LOCALAPPDATA\npm-cache"
$cargoHome = "$env:USERPROFILE\.cargo\registry"
$badPkgs = @("proc-macro1","proc-macro-en")
foreach ($root in @($npmCache,$cargoHome)) {
    if (Test-Path $root) {
        Get-ChildItem $root -Recurse -Directory -ErrorAction SilentlyContinue | Where-Object { $n=$_.Name; $badPkgs | Where-Object { $n -like "*$_*" } } | ForEach-Object {
            $report += [PSCustomObject]@{ Check="MaliciousPackage"; Detail="$($_.FullName)"; Severity="CRITICAL" }
        }
    }
}

$report | Sort-Object Severity | Format-Table -AutoSize
$report | Export-Csv "$env:TEMP\otx_ioc_hunt_$(Get-Date -Format yyyyMMdd_HHmmss).csv" -NoTypeInformation
Write-Host "[+] Hunt complete. $($report.Count) findings. CSV written to $env:TEMP" -ForegroundColor Yellow