Gremlin, SilabRAT & AI-Themed Stealers: OTX Pulse Analysis — Credential Theft & Supply Chain Threat Pack

title: Potential Gremlin Stealer or SilabRAT Browser Credential Theft
id: 4e8f9a2b-1c3d-4f5e-9a6b-7c8d9e0f1a2b
description: Detects processes accessing browser credential databases (Login Data or Cookies) common to Gremlin, SilabRAT, Vidar, and Lumma stealers.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66a4b2d6e8b4a032a1b2c3d4
tags:
    - attack.credential_access
    - attack.t1003
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\AppData\Local\Google\Chrome\User Data\Default\Login Data'
            - '\AppData\Local\Google\Chrome\User Data\Default\Cookies'
            - '\AppData\Local\Microsoft\Edge\User Data\Default\Login Data'
            - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
            - '\logins.'
            - 'key4.db'
    filter_legit:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\browser.exe'
            - '\opera.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate password managers accessing browser stores
level: high
---
title: Malicious PyPI Package Execution via PTH Hooks
id: 5b9f0a3c-2d4e-5g6f-0b7c-8d9e1f2a3b4c
description: Detects the execution of Python processes utilizing suspicious .pth files or native extensions, indicative of the Hades/Miasma supply chain attack.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66a4b2d6e8b4a032a1b2c3d6
tags:
    - attack.initial_access
    - attack.t1195
logsource:
    category: process_creation
    product: windows
detection:
    selection_python:
        Image|endswith: '\python.exe'
    selection_suspicious:
        CommandLine|contains:
            - 'import site'
            - '.pth'
            - '.abi3.so'
            - 'sitecustomize'
    condition: selection_python and selection_suspicious
falsepositives:
    - Legitimate developer environment setup
level: medium
---
title: Suspicious Cisco SD-WAN Exploitation Activity
id: 6c0g1b4d-3e5f-6h7g-1c8d-9e0f2a3b4c5d
description: Detects potential webshell activity or exploitation attempts related to CVE-2026-20128 on Cisco Catalyst SD-WAN devices.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66a4b2d6e8b4a032a1b2c3d5
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: web
    product: apache
detection:
    selection_uri:
        cs-uri-query|contains:
            - '/vpnssl/'
            - 'api/'
            - 'dataservice/'
    selection_suspicious_patterns:
        cs-uri-query|contains:
            - 'exec('
            - 'eval('
            - 'base64'
            - 'gnirtS' # String reversed obfuscation common in webshells
    condition: selection_uri and selection_suspicious_patterns
falsepositives:
    - Administrative management traffic
level: critical


**KQL (Microsoft Sentinel)**

kql
// Hunt for known Malicious File Hashes (Gremlin, SilabRAT, PyPI Worms)
let MaliciousHashes = pack_array(
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "6506d31707a39949f89534bf9705bcf889f1ecae3dbc6f4ff88d67a8be3d01b2",
    "6d332f814f15f19758d65026bbfd0a8c49671b319ec77b8fa1b27fc48afff7d9"
);
DeviceProcessEvents
| where SHA256 in (MaliciousHashes)
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, SHA256, FolderPath;

// Hunt for SilabRAT C2 Communication
DeviceNetworkEvents
| where RemoteIP == "91.199.163.124"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl;


**PowerShell Hunt Script**

powershell
# IOC Hunt for Gremlin, SilabRAT, and AI-Themed Stealers
# Requires Admin Privileges

$MaliciousHashes = @(
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b"
)

Write-Host "Checking for active network connections to SilabRAT C2..."
$C2IP = "91.199.163.124"
Get-NetTCPConnection -RemoteAddress $C2IP -ErrorAction SilentlyContinue | Select-Object LocalAddress, LocalPort, OwningProcess, State

Write-Host "Scanning common download directories for known malicious samples..."
$Paths = @("$env:USERPROFILE\Downloads", "$env:TEMP", "$env:APPDATA")

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "Checking for suspicious Python packages..."
$PythonPaths = @("$env:LOCALAPPDATA\Programs\Python", "$env:APPDATA\Python")
# Basic heuristic for .pth files in site-packages (Supply Chain Hunt)
foreach ($PPath in $PythonPaths) {
    if (Test-Path $PPath) {
        Get-ChildItem -Path $PPath -Filter "*.pth" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            Write-Host "[?] Suspicious .pth file found: $($_.FullName)" -ForegroundColor Yellow
        }
    }
}