GTG-20006 / Midnight Blizzard Abused Claude AI to Regenerate Malware After Detection — SOC Detection and Threat Hunting Guide

---
title: Build Toolchain Execution from Script Interpreter or Non-Developer Context
id: 4c2a8f61-9d3b-4e7a-b5c2-1a6f9d0e8b34
status: experimental
description: Detects compilers and build tools spawned by script interpreters or Office applications, or running from user-writable/temp paths — consistent with AI-assisted malware rebuild-and-recompile workflows where payloads are regenerated after detection.
references:
  - https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html
  - https://attack.mitre.org/techniques/T1027/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/04
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\cl.exe'
      - '\link.exe'
      - '\csc.exe'
      - '\msbuild.exe'
      - '\go.exe'
      - '\gcc.exe'
      - '\rustc.exe'
      - '\pyinstaller.exe'
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\winword.exe'
      - '\excel.exe'
  condition: selection_img and selection_parent
falsepositives:
  - Developer workstations where builds are legitimately scripted — baseline and exclude build servers and engineering endpoints by host, not globally
  - Software packaging/Intune content prep on admin endpoints
level: high
---
title: Newly Created Executable Launched from User-Writable Path
id: 8e1b3c47-6a2d-4f95-a8e0-3c7b2d914f56
status: experimental
description: Detects execution of executables or DLL loads from user-writable staging paths commonly used for rapidly regenerated payloads (AppData, Temp, ProgramData). Designed to catch variant churn where hashes and filenames change but staging behavior does not.
references:
  - https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html
  - https://attack.mitre.org/techniques/T1204/
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/09/04
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
  selection_ext:
    Image|endswith:
      - '.exe'
      - '.dll'
      - '.scr'
  filter_signed_system:
    Image|contains:
      - '\AppData\Local\Microsoft\'
      - '\AppData\Local\Google\'
      - '\AppData\Local\Mozilla\'
      - '\AppData\Local\Programs\'
      - '\AppData\Roaming\Microsoft\'
  condition: selection_path and selection_ext and not filter_signed_system
falsepositives:
  - Legitimate per-user application installs (Teams, Slack updaters) — tune with signer/prevalence enrichment in your EDR rather than removing the rule
level: medium
---
title: Persistence Registration Shortly Following Payload Staging in ProgramData or AppData
id: 2f7d5a19-4c8e-4b63-9a17-6e0c3f845d21
status: experimental
description: Detects scheduled task creation or Run key persistence pointing at payloads staged in user-writable paths. Persistence is the behavioral constant that survives AI-assisted payload regeneration — the binary changes, the persistence mechanism points at the new variant.
references:
  - https://thehackernews.com/2026/09/russian-state-sponsored-hackers-use.html
  - https://attack.mitre.org/techniques/T1053/005/
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/09/04
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.t1547.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
      - '/create'
      - 'AppData'
  selection_reg:
    Image|endswith: '\reg.exe'
    CommandLine|contains:
      - '\CurrentVersion\Run'
      - 'add'
  condition: 1 of selection_*
falsepositives:
  - Enterprise software deployment tooling (SCCM/Intune) — exclude known management service accounts and source hosts
level: high

let lookback = 7d;
let staging_paths = dynamic(["\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\Users\\Public\\", "\\ProgramData\\"]);
let recent_drops =
    DeviceFileEvents
    | where TimeGenerated > ago(lookback)
    | where ActionType == "FileCreated"
    | where FolderPath has_any (staging_paths)
    | where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".scr"
    | project DropTime=TimeGenerated, DeviceId, DeviceName, FolderPath, FileName, SHA256;
DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName endswith ".exe" or FileName endswith ".dll"
| project ExecTime=TimeGenerated, DeviceId, ProcessName=FileName, ProcessPath=FolderPath,
          ProcessSHA256=SHA256, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| join kind=inner recent_drops on DeviceId, $left.ProcessSHA256 == $right.SHA256
| extend MinutesBetweenDropAndExec = datetime_diff('minute', ExecTime, DropTime)
| where MinutesBetweenDropAndExec between (0 .. 30)
| summarize VariantsOnHost=dcount(SHA256), FirstSeen=min(DropTime), LastSeen=max(ExecTime),
            make_set(FileName), make_set(FolderPath), make_set(ProcessCommandLine)
          by DeviceName, AccountName
| order by VariantsOnHost desc;

-- Hunt: freshly staged executables in user-writable paths, enriched with process and network lineage
LET staged = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/AppData/Local/Temp/**/*.exe',
                 'C:/Users/*/AppData/Roaming/**/*.exe',
                 'C:/Users/Public/**/*.exe',
                 'C:/ProgramData/**/*.exe'])
WHERE Mtime > now() - 604800   -- created/modified in the last 7 days
ORDER BY Mtime DESC;

SELECT FullPath AS StagedBinary,
       Size,
       Mtime AS Modified,
       proc.Pid AS RunningPid,
       proc.CommandLine AS ProcessCmdline,
       proc.Username AS ProcessUser,
       net.RemoteAddr AS C2RemoteIP,
       net.RemotePort AS C2RemotePort,
       net.Status AS ConnState
FROM staged
LEFT JOIN (
    SELECT Pid, Name, Exe, CommandLine, Username
    FROM pslist()
) AS proc ON proc.Exe = staged.FullPath
LEFT JOIN (
    SELECT Pid AS NetPid, RemoteAddr, RemotePort, Status
    FROM netstat()
    WHERE Status =~ 'ESTABLISHED|LISTEN'
) AS net ON net.NetPid = proc.Pid

# GTG-20006 / Midnight Blizzard regeneration-workflow hardening and audit
# Run elevated. Test in a lab ring before broad deployment.

# --- 1. Verify behavior-based and cloud-delivered Defender protections ---
$mp = Get-MpPreference
$status = [PSCustomObject]@{
    RealTimeMonitoring      = -not $mp.DisableRealtimeMonitoring
    BehaviorMonitoring      = -not $mp.DisableBehaviorMonitoring
    CloudProtectionLevel    = (Get-MpComputerStatus).MAPSReporting
    CloudBlockLevel         = $mp.MpCloudBlockLevel        # 0=default, 1=moderate, 2=high, 3=zero-tolerance
    PUAProtection           = $mp.PUAProtection            # 1 = enabled
}
$status | Format-List

# --- 2. Harden: raise cloud block level and enable PUA protection ---
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -MpCloudBlockLevel High
Set-MpPreference -PUAProtection Enabled
Set-MpPreference -DisableBehaviorMonitoring $false
Set-MpPreference -DisableRealtimeMonitoring $false

# --- 3. Enable ASR rules that break payload staging/execution from user paths ---
# Block executable content from email client and webmail
Add-MpPreference -AttackSurfaceReductionRules_Ids "BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550" -AttackSurfaceReductionRules_Actions Enabled
# Block Office applications from creating child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids "D4F940AB-401B-4EFC-AADC-AD5F3C50688A" -AttackSurfaceReductionRules_Actions Enabled
# Block execution of potentially obfuscated scripts
Add-MpPreference -AttackSurfaceReductionRules_Ids "5BEB7EFE-FD9A-4556-801D-275E5FFC04CC" -AttackSurfaceReductionRules_Actions Enabled
# Block untrusted/unsigned processes from running from USB
Add-MpPreference -AttackSurfaceReductionRules_Ids "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" -AttackSurfaceReductionRules_Actions Enabled

# --- 4. Audit: find compilers/build tools on endpoints that shouldn't have them ---
$toolchains = @("cl.exe","link.exe","csc.exe","MSBuild.exe","go.exe","gcc.exe","rustc.exe","pyinstaller.exe")
$hits = foreach ($t in $toolchains) {
    Get-ChildItem -Path "C:\Users","C:\ProgramData" -Filter $t -Recurse -ErrorAction SilentlyContinue |
        Select-Object FullName, LastWriteTime
}
if ($hits) {
    Write-Warning "Build toolchain binaries found in user-writable paths — investigate for on-host payload rebuild activity:"
    $hits | Format-Table -AutoSize
} else {
    Write-Host "[OK] No toolchain binaries found in audited user-writable paths."
}

# --- 5. Audit persistence constants: tasks and Run keys pointing into staging paths ---
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Where-Object { $_.Execute -match 'AppData|ProgramData|Users\\Public' }
    if ($actions) { [PSCustomObject]@{ TaskName=$_.TaskName; Path=$_.TaskPath; Execute=($actions.Execute -join ';') } }
} | Format-Table -AutoSize

Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
                 "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue |
    ForEach-Object { $_.PSObject.Properties } |
    Where-Object { $_.Value -match 'AppData|ProgramData|Users\\Public' } |
    Select-Object Name, Value | Format-Table -AutoSize