GIFTEDCROOK, Overlord & BRICKSTORM: OTX Pulse Analysis — Multi-Front APT Campaigns & Detection Pack

---
title: Potential WinRAR Path Traversal Exploitation - GIFTEDCROOK
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit WinRAR path traversal vulnerabilities (CVE-2025-8088, CVE-2018-20250) often used by SHADOW-EARTH-066 to drop GIFTEDCROOK.
author: Security Arsenal
date: 2026/07/08
references:
    - https://otx.alienvault.com/
tags:
    - attack.initial_access
    - attack.t1203
logsource:
    category: process_creation
    product: windows
detection:
    selection_winrar:
        Image|endswith:
            - '\WinRAR.exe'
            - '\rar.exe'
    selection_traversal:
        CommandLine|contains:
            - '..\..\'
            - '../..'
            - 'AppData\'
    condition: all of selection_*
falsepositives:
    - Administrative archive management
level: high
---
title: Suspicious VSIX Extension Installation - UNK_DeadDrop
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects installation of Visual Studio or VS Code extensions from untrusted sources associated with UNK_DeadDrop campaigns.
author: Security Arsenal
date: 2026/07/08
references:
    - https://otx.alienvault.com/
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_editor:
        Image|endswith:
            - '\Code.exe'
            - '\devenv.exe'
    selection_install:
        CommandLine|contains:
            - '--install-extension'
            - '.vsix'
    filter_signed:
        CommandLine|contains: '--force' # often used to bypass prompts
    condition: all of selection_*
falsepositives:
    - Legitimate developer environment setup
level: medium
---
title: VerdantBamboo C2 Network Traffic
id: 3c4d5e6f-7a8b-9c0d-1e2f-3a4b5c6d7e8f
status: experimental
description: Detects network connections to known VerdantBamboo C2 infrastructure (BRICKSTORM).
author: Security Arsenal
date: 2026/07/08
references:
    - https://otx.alienvault.com/
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection_c2:
        DestinationHostname|contains:
            - 'service.systemsvcs.com'
        DestinationPort:
            - 443
            - 80
    condition: selection_c2
falsepositives:
    - Unknown (Low volume domain)
level: critical

// Hunt for WinRAR Suspicious Activity
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ('WinRAR.exe', 'rar.exe')
| where ProcessCommandLine has '..\..\' or ProcessCommandLine has '../..' 
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend IoC_Type = 'WinRAR Exploit'
;
// Hunt for UNK_DeadDrop IOCs
union DeviceNetworkEvents, DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in (
    '2812e0847d472cb8870c94f463331dbe53b84135132b9bf5f6d84c2382be628f',
    '339907b44f161f57ff30819f422c552382ff437b3ae437463b4222cfe86bd943',
    '35813f4401d3ad77b618275473a556eb47bfa6f4b7439dd8943b19f81aa7252e'
    )
| project Timestamp, DeviceName, ActionType, RemoteUrl, RemoteIP, SHA256, FolderPath
| extend IoC_Type = 'UNK_DeadDrop Hash'
;
// Hunt for VerdantBamboo C2
DeviceNetworkEvents
| where Timestamp > ago(90d)
| where RemoteUrl has 'service.systemsvcs.com' or RemoteIP == '166.0.132.237'
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, DeviceName
| extend IoC_Type = 'VerdantBamboo C2'

# IOC Hunt for GIFTEDCROOK, UNK_DeadDrop, and VerdantBamboo
# Requires Admin privileges for network checks

Write-Host "[+] Starting Security Arsenal Threat Hunt..." -ForegroundColor Cyan

# 1. Check for WinRAR Process
$winrar = Get-Process -Name "winrar" -ErrorAction SilentlyContinue
if ($winrar) {
    Write-Host "[!] ALERT: WinRAR is currently running." -ForegroundColor Red
} else {
    Write-Host "[-] WinRAR not running." -ForegroundColor Green
}

# 2. Check Hosts File for C2 Domains
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$maliciousDomains = @("astrocaf.com", "service.systemsvcs.com")
$hostsContent = Get-Content $hostsPath -ErrorAction SilentlyContinue

foreach ($domain in $maliciousDomains) {
    if ($hostsContent -match $domain) {
        Write-Host "[!] ALERT: Malicious domain '$domain' found in hosts file." -ForegroundColor Red
    }
}

# 3. Check for Recent VSIX Installs (UNK_DeadDrop vector)
$vsixPath = "$env:USERPROFILE\.vscode\extensions"
if (Test-Path $vsixPath) {
    $recentExt = Get-ChildItem $vsixPath | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }
    if ($recentExt) {
        Write-Host "[?] INFO: Recent VS Code extensions found (Last 30 days):" -ForegroundColor Yellow
        $recentExt | Select-Object Name, LastWriteTime
    }
}

# 4. DNS Resolution Check for C2 Infrastructure
Write-Host "[+] Resolving IOCs..." -ForegroundColor Cyan
$targets = @("astrocaf.com", "service.systemsvcs.com", "166.0.132.237")
foreach ($target in $targets) {
    try {
        $result = Resolve-DnsName -Name $target -ErrorAction Stop
        Write-Host "[!] ALERT: Resolution successful for $target - Possible C2 connectivity." -ForegroundColor Red
    } catch {
        Write-Host "[-] Resolution failed for $target." -ForegroundColor Green
    }
}