FortiBleed FortiGate Credential Harvesting + Shai-Hulud npm Worm & AWS Bedrock Key-Jacking: OTX Detection Pack

---
title: Shai-Hulud npm Supply Chain Credential Harvesting - Postinstall Execution
id: 7f3a1b2c-9e4d-4c1a-a8f2-3d5e6b7c8d9e
status: experimental
description: Detects Node.js/npm child processes spawned during package install accessing credential stores (AWS, SSH, kubeconfig, npmrc), consistent with Shai-Hulud/ChainDrop worm behavior
references:
    - https://socket.dev/blog/tensorlake-compromise
author: Security Arsenal Threat Intel
date: 2026/10/08
tags:
    - attack.credential_access
    - attack.t1552
    - attack.t1552.001
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.exe'
            - '\npm.cmd'
    selection_access:
        CommandLine|contains:
            - '.npmrc'
            - '.aws\credentials'
            - '\.ssh\'
            - 'kubeconfig'
            - '.kube\config'
            - 'vault'
            - 'id_rsa'
    condition: selection_parent and selection_access
falsepositives:
    - Legitimate dev tooling reading configs (rare during install hooks)
level: high
---
title: FortiBleed - Suspicious FortiGate SSL VPN Authentication From Known Malicious Infrastructure
id: 2b8c4d5e-1a6f-4e2b-b3c7-8d9e0f1a2b3c
status: experimental
description: Detects network connections to or from FortiBleed-associated IPv4 indicators used for credential harvesting against FortiGate SSL VPN gateways
references:
    - https://www.ic3.gov/CSA/2026/261006.pdf
author: Security Arsenal Threat Intel
date: 2026/10/08
tags:
    - attack.initial_access
    - attack.t1078
    - attack.t1110
logsource:
    category: network_connection
    product: windows
detection:
    selection_dst:
        DestinationIp:
            - '103.27.186.156'
            - '154.202.59.169'
            - '45.154.12.132'
            - '80.75.212.113'
            - '85.11.187.8'
            - '193.8.187.2'
            - '45.227.254.210'
            - '77.91.118.10'
    selection_src:
        SourceIp:
            - '103.27.186.156'
            - '154.202.59.169'
            - '45.154.12.132'
            - '80.75.212.113'
            - '85.11.187.8'
            - '193.8.187.2'
            - '45.227.254.210'
            - '77.91.118.10'
    condition: 1 of selection_*
falsepositives:
    - Unlikely; indicators are pulse-verified malicious
level: critical
---
title: AWS Bedrock Credential Validation - Token-Jacking Probe Pattern
id: 9d1e2f3a-4b5c-6d7e-8f9a-0b1c2d3e4f5a
status: experimental
description: Detects the KMON_NOC-style validation sequence where a principal calls GetCallerIdentity followed by Bedrock model enumeration, indicative of stolen AWS key testing
references:
    - https://securitylabs.datadoghq.com/articles/beyond-valid-credentials-how-exposed-aws-keys-are-tested-for-amazon-bedrock-access
author: Security Arsenal Threat Intel
date: 2026/10/08
tags:
    - attack.discovery
    - attack.t1580
    - attack.t1078.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_validate:
        eventSource: 'sts.amazonaws.com'
        eventName: 'GetCallerIdentity'
    selection_bedrock:
        eventSource: 'bedrock.amazonaws.com'
        eventName:
            - 'ListFoundationModels'
            - 'Converse'
            - 'InvokeModel'
    condition: selection_validate and selection_bedrock
    timeframe: 10m
falsepositives:
    - Legitimate AI/ML application bootstrap sequences; tune by known IAM roles and CI/CD principals
level: high

// FortiBleed IOC retro-hunt + suspicious credential-store access (Microsoft Sentinel / Defender)
let FortiBleedIPs = dynamic(["103.27.186.156","154.202.59.169","45.154.12.132","80.75.212.113","85.11.187.8","193.8.187.2","45.227.254.210","77.91.118.10"]);
let BedrockValidatorIPs = dynamic(["112.78.151.90","78.109.78.211","83.194.172.248","103.160.185.100","109.146.93.39","115.138.247.83"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteIP in~ (FortiBleedIPs) or RemoteIP in~ (BedrockValidatorIPs)
    | summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
        Ports=make_set(RemotePort) by DeviceName, RemoteIP, InitiatingProcessFileName
    | extend HuntContext="OTX_IOC_Network_Match"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName in~ ("node.exe","npm.exe","cmd.exe","powershell.exe")
    | where ProcessCommandLine has_any (".npmrc","id_rsa",".kube","kubeconfig","credentials","vault")
    | where FileName in~ ("powershell.exe","cmd.exe","node.exe","cat.exe","type.exe","findstr.exe")
    | summarize Hits=count(), Commands=make_set(ProcessCommandLine, 10) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
    | extend HuntContext="ShaiHulud_CredStore_Access")
| order by HuntContext asc, Connections desc

# Security Arsenal - FortiBleed / Shai-Hulud / Wallet-Stealer IOC Hunt Script
# Run elevated on endpoints and build servers. Outputs findings to CSV.
$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# --- 1. Check for malicious TensorLake npm package version in node_modules / lockfiles ---
$searchRoots = @("$env:USERPROFILE","C:\projects","C:\src","D:\")
foreach ($root in $searchRoots) {
    if (Test-Path $root) {
        Get-ChildItem -Path $root -Recurse -Filter "package-lock.json" -Depth 6 | ForEach-Object {
            $content = Get-Content $_.FullName -Raw
            if ($content -match '"tensorlake"[^}]*"0\.5\.144"' -or $content -match 'tensorlake.*0\.5\.144') {
                $findings += [pscustomobject]@{Type="SHAI-HULUD_PACKAGE"; Path=$_.FullName; Detail="Malicious tensorlake 0.5.144 in lockfile"}
            }
        }
    }
}

# --- 2. Hash-sweep Firefox extension XPIs against OTX malicious SHA256 list ---
$badHashes = @(
  "7d9d7e80ed52350616be0215a7ded10aaeb9aaa64e34ff8af7f9177c8c855799",
  "da447fe02e4577da97144a4d92b395078954fde1ff196746413837e1e4a20bcd",
  "be246ca5cb1372394e0443df45454f88ca39eb4a8dcfc4a99cb8865100fb4897",
  "c550f0860012e0dfab14ed65a9425961e22025e0ab23fd9d69d294a8aa34db2f",
  "eb134bbf73046800c8177383754cf754b8776ec30cf5cc8a13655d259e49a4bf",
  "2f9270269e631bc4fd634d741afcfc3df8f54e43e40b16f38660fe8ce6c26f51",
  "25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef",
  "b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec"
)
$ffExt = "$env:APPDATA\Mozilla\Firefox\Profiles"
if (Test-Path $ffExt) {
    Get-ChildItem $ffExt -Recurse -Include "*.xpi" | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($badHashes -contains $h) {
            $findings += [pscustomobject]@{Type="MALICIOUS_FF_EXT"; Path=$_.FullName; Detail="SHA256 match: $h"}
        }
    }
}

# --- 3. Detect recent suspicious access to credential stores (Shai-Hulud behavior artifact) ---
$credPaths = @("$env:USERPROFILE\.npmrc","$env:USERPROFILE\.aws\credentials","$env:USERPROFILE\.kube\config","$env:USERPROFILE\.ssh\id_rsa","$env:USERPROFILE\.vault-token")
foreach ($p in $credPaths) {
    if (Test-Path $p) {
        $f = Get-Item $p
        if ($f.LastAccessTime -gt (Get-Date).AddDays(-3)) {
            $findings += [pscustomobject]@{Type="CREDSTORE_RECENT_ACCESS"; Path=$p; Detail="LastAccess: $($f.LastAccessTime) - validate against known activity"}
        }
    }
}

# --- 4. Active/recent connections to FortiBleed & validator IPs ---
$badIPs = @("103.27.186.156","154.202.59.169","45.154.12.132","80.75.212.113","85.11.187.8","193.8.187.2","45.227.254.210","77.91.118.10","112.78.151.90","78.109.78.211","83.194.172.248","103.160.185.100","109.146.93.39","115.138.247.83")
Get-NetTCPConnection | Where-Object { $badIPs -contains $_.RemoteAddress } | ForEach-Object {
    $findings += [pscustomobject]@{Type="MALICIOUS_CONNECTION"; Path=$_.RemoteAddress; Detail="State: $($_.State) | OwningPID: $($_.OwningProcess)"}
}

$findings | Format-Table -AutoSize
$findings | Export-Csv -Path ".\otx_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "[+] Hunt complete. $($findings.Count) findings." -ForegroundColor Cyan