title: Potential Gremlin Stealer Process Activity
id: 4e8b6c12-1c3a-4b5f-9a2d-1f3e4a5b6c7d
description: Detects suspicious process execution patterns associated with Gremlin Stealer and other info stealers accessing browser data.
status: experimental
date: 2026/05/16
author: Security Arsenal
references:
    - https://unit42.paloaltonetworks.com/gremlin-stealer-evolution/
tags:
    - attack.credential_access
    - attack.collection
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    filter:
        CommandLine|contains:
            - 'AppData\Local\Google\Chrome\User Data'
            - 'AppData\Roaming\Mozilla\Firefox\Profiles'
            - 'AppData\Local\Microsoft\Edge\User Data'
    condition: selection and filter
falsepositives:
    - Legitimate backup scripts
level: high
---
title: Cisco SD-WAN Vulnerability Exploitation Attempt
date: 2026/05/16
id: 5f9c7d23-2d4b-5c6a-0b3e-2g4f5a6b7c8d
description: Detects potential exploitation of CVE-2026-20182 or similar auth bypass on Cisco SD-WAN devices via webshell behavior.
status: experimental
author: Security Arsenal
references:
    - https://blog.talosintelligence.com/sd-wan-ongoing-exploitation/
tags:
    - attack.initial_access
    - cve.2026.20182
logsource:
    category: web
    product: apache
    service: access
detection:
    selection_uri:
        cs-uri-query|contains:
            - 'vpnsvc'
            - 'webshell'
            - '.jsp'
    selection_status:
        sc-status: 200
    condition: all of selection_*
falsepositives:
    - Legitimate administrative access
level: critical
---
title: Suspicious PowerShell Download from GitHub (Claude Code Lure)
date: 2026/05/16
id: 6a0d8e34-3e5c-6d7b-1c4f-3h5g6a7b8c9d
description: Detects PowerShell scripts downloading content from GitHub, often associated with trojanized repositories like the Claude Code leak campaign.
status: experimental
author: Security Arsenal
references:
    - https://www.zscaler.com/blogs/security-research/anthropic-claude-code-leak
tags:
    - attack.initial_access
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains: 'Invoke-WebRequest'
        CommandLine|contains: 'github.com'
    filter_legit:
        ParentImage|contains: 
            - '\Visual Studio\'
            - '\GitHub Desktop\'
            - '\git\'
    condition: selection and not filter_legit
falsepositives:
    - Developers installing legitimate tools
level: medium

// Hunt for Gremlin C2 Connections and Suspicious Processes
let GremlinIPs = dynamic(["194.87.92.109", "176.65.139.31"]);
DeviceNetworkEvents
| where RemoteIP in (GremlinIPs)
| extend Timestamp = TimeGenerated, DeviceName = DeviceName, RemoteIP = RemoteIP
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessAccountName, InitiatingProcessCommandLine
| union ( 
    DeviceProcessEvents
    | where ProcessCommandLine has_any ("AppData\\Local\\Google\\Chrome\\User Data", "AppData\\Roaming\\Mozilla\\Firefox", "-enc", "FromBase64String")
    | project Timestamp = TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName
)
| order by Timestamp desc

# IOC Hunt Script for Gremlin and OtterCookie Indicators
$MaliciousIPs = @("194.87.92.109", "176.65.139.31")
$ProcessList = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

Write-Host "Checking for established connections to known C2 IPs..." -ForegroundColor Yellow

foreach ($IP in $MaliciousIPs) {
    $Connections = $ProcessList | Where-Object { $_.RemoteAddress -eq $IP }
    if ($Connections) {
        Write-Host "[ALERT] Found connection to malicious IP: $IP" -ForegroundColor Red
        $Connections | ForEach-Object {
            $Proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            Write-Host "   PID: $($_.OwningProcess) | Process: $($Proc.ProcessName) | Path: $($Proc.Path)"
        }
    }
}

# Check for specific file hashes (Sample check - requires hash db)
Write-Host "Checking file system for suspicious payloads..." -ForegroundColor Yellow
$PathsToCheck = @("$env:TEMP", "$env:APPDATA")
$Extensions = @(".exe", ".dll", ".ps1", ".js")

foreach ($Path in $PathsToCheck) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Include $Extensions -ErrorAction SilentlyContinue | ForEach-Object {
            # In a real scenario, calculate hash and compare to IOC list
            if ($_.Length -gt 0kb -and $_.Length -lt 500kb -and $_.CreationTime -gt (Get-Date).AddDays(-7)) {
                Write-Host "[SUSPICIOUS] Recent small binary found: $($_.FullName)" -ForegroundColor Cyan
            }
        }
    }
}


---

# Response Priorities