Gremlin Stealer, OtterCookie, and The Gentlemen: Supply Chain, RaaS, and Credential Theft — OTX Pulse Analysis

title: Potential Gremlin Stealer Process Injection
id: 8c7f9b2a-1d3e-4a5f-9b6c-7d8e9f0a1b2c
description: Detects suspicious processes accessing browser credential files or memory patterns consistent with Gremlin Stealer resource hiding techniques.
status: experimental
date: 2026/05/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660000000000
tags:
    - attack.credential_access
    - attack.t1005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\\powershell.exe'
            - '\\cmd.exe'
            - '\\wscript.exe'
        CommandLine|contains:
            - 'Get-Process'
            - 'ReadAllBytes'
            - 'System.Reflection'
    condition: selection
falsepositives:
    - Legitimate system administration scripts
level: high
---
title: Suspicious NPM Process Spawn (OtterCookie)
id: 9d8e0f3b-2e4f-5b6a-0c1d-2e3f4a5b6c7d
description: Detects Node.js or npm spawning unusual child processes like PowerShell or CMD, characteristic of malicious npm packages like OtterCookie.
status: experimental
date: 2026/05/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660000000001
tags:
    - attack.initial_access
    - attack.t1192
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        Image|endswith:
            - '\
ode.exe'
            - '\
pm.cmd'
    selection_child:
        Image|endswith:
            - '\\powershell.exe'
            - '\\cmd.exe'
            - '\\wscript.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate build scripts
level: medium
---
title: Cisco SD-WAN Vulnerability Exploitation Attempt
id: 0e1f2a3b-4c5d-6e7f-8a9b-0c1d2e3f4a5b
description: Detects potential exploitation attempts against Cisco Catalyst SD-WAN Manager related to CVE-2026-20182 and CVE-2026-20133.
status: experimental
date: 2026/05/16
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660000000002
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
    product: apache
    definition: 'Requirements: At least one of the keywords in "cs-uri-query" or "cs-uri-stem"'
detection:
    selection_uri:
        cs-uri-query|contains:
            - '/app/login'
            - '/j_security_check'
    selection_suspicious:
        cs-uri-query|contains:
            - 'authenticationBypass'
            - 'matrixparams'
    condition: selection_uri and selection_suspicious
falsepositives:
    - Unknown
level: critical

// Hunt for Gremlin/OtterCookie File Hashes
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    '1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5',
    '2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b',
    'd94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa',
    '06f63fe3eba5a2d1e2177d49f25721c2bdd90f3c46f19e29740899fa908453bf'
)
| project Timestamp, DeviceName, FolderPath, SHA256, InitiatingProcessAccountName

// Hunt for Network Connections to Malicious IPs
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in (
    '194.87.92.109',
    '176.65.139.31',
    '94.228.161.88',
    '147.45.197.92'
)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName

# IOC Hunt Script for Gremlin Stealer and OtterCookie Indicators
# Requires Administrative Privileges

$MaliciousHashes = @(
    \"1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5\",
    \"2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b\",
    \"281b970f281dbea3c0e8cfc68b2e9939b253e5d3de52265b454d8f0f578768a2\",
    \"691896c7be87e47f3e9ae914d76caaf026aaad0a1034e9f396c2354245215dc3\",
    \"971198ff86aeb42739ba9381923d0bc6f847a91553ec57ea6bae5becf80f8759\",
    \"d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa\"
)

$MaliciousIPs = @(
    \"194.87.92.109\",
    \"176.65.139.31\"
)

Write-Host \"[+] Hunting for malicious file hashes...\" -ForegroundColor Cyan

# Check common download and temp directories
$Paths = @(\"$env:USERPROFILE\\Downloads\", \"$env:TEMP\", \"C:\\ProgramData\")

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | Where-Object {
            $MaliciousHashes -contains $_.Hash
        } | ForEach-Object {
            Write-Host \"[!] MALICIOUS FILE DETECTED: $($_.Path) (Hash: $($_.Hash))\" -ForegroundColor Red
        }
    }
}

Write-Host \"[+] Checking for active network connections to C2 IPs...\" -ForegroundColor Cyan

$Connections = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {
    $MaliciousIPs -contains $_.RemoteAddress
}

if ($Connections) {
    $Connections | ForEach-Object {
        $Process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host \"[!] SUSPICIOUS CONNECTION: Remote IP $($_.RemoteAddress):$($_.RemotePort) owned by $($Process.ProcessName) (PID: $($_.OwningProcess))\" -ForegroundColor Red
    }
} else {
    Write-Host \"[-] No suspicious connections found.\" -ForegroundColor Green
}

Write-Host \"[+] Hunt complete.\"