Head Mare PhantomCore via TrueConf Supply-Chain Compromise + STARDUST CHOLLIMA Rust Crate Backdoor: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Suspicious Child Process from Rust Build Toolchain - Supply Chain Compile-Time Execution
id: 9f2a1c44-7b3d-4e5a-8c1f-a2b3c4d5e6f7
status: experimental
description: Detects cargo/rustc build processes spawning shell or download utilities, consistent with the malicious proc-macro1 build.rs fetching and executing a remote payload at compile time (STARDUST CHOLLIMA crates.io campaign).
author: Security Arsenal Threat Intelligence
references:
  - https://www.wiz.io/blog/rust-supply-chain-attack-on-arrayref-significant-overlap-with-dprk-campaigns
date: 2026/08/22
tags:
  - attack.initial_access
  - attack.t1195.002
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\cargo.exe'
      - '\rustc.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  filter_cargo_bin:
    Image|endswith: '\cargo.exe'
  condition: selection_parent and selection_child and not filter_cargo_bin
falsepositives:
  - Legitimate build scripts compiling native C dependencies may invoke compilers; shells and download utilities are rare and warrant review
level: high
---
title: TrueConf Server Process Spawning Shell or Web Server Script - Web Shell Deployment
id: 3b7c8d9e-2f4a-4b6c-9d1e-5f6a7b8c9d0e
status: experimental
description: Detects TrueConf server processes spawning command interpreters or scripting engines, indicating post-exploitation web shell deployment or installer replacement by Head Mare APT operators.
author: Security Arsenal Threat Intelligence
references:
  - https://ics-cert.kaspersky.com/publications/reports/2026/08/12/head-mare-exploits-vulnerabilities-in-trueconf-server-to-deliver-phantomcore-malware
date: 2026/08/22
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'trueconf'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\bitsadmin.exe'
      - '\certutil.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; TrueConf server processes should not spawn interactive shells in normal operation
level: critical
---
title: Network Connection to PhantomCore or proc-macro1 Backdoor C2 Infrastructure
id: 5e6f7a8b-1c2d-4e5f-a6b7-c8d9e0f1a2b3
status: experimental
description: Detects outbound connections to known PhantomCore C2 IPv4 and proc-macro1 backdoor C2 hostname from OTX pulses dated 2026-08-21.
author: Security Arsenal Threat Intelligence
date: 2026/08/22
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_ip:
    DestinationIp:
      - '194.87.239.71'
  selection_dns:
    DestinationHostname|contains:
      - 'hwsrv-798836.hostwindsdns.com'
  condition: selection_ip or selection_dns
falsepositives:
  - None expected for these dedicated C2 indicators
level: critical

// Security Arsenal - Head Mare / STARDUST CHOLLIMA Supply Chain Hunt
// Hunts C2 connections, compile-time payload execution, and TrueConf exploitation artifacts
let Lookback = 14d;
let C2_IPs = dynamic(["194.87.239.71"]);
let C2_Hosts = dynamic(["hwsrv-798836.hostwindsdns.com"]);
let BadHashes = dynamic([
  "0e4541c3153ec5ed01497f19cf4f63d0",
  "0e79996d9483d1e44fea32b0a48c2c19",
  "129462164a7d52e9ea8560b60f0412c5",
  "12d4e8f5295f2ef7e0f9bfc0f4830939",
  "2bb75c20e778eb5c416965bd4d4259b1",
  "43f435c3c437bc879a2d7d4634f43494",
  "489f43be558b2679284ceabed7adc4f3",
  "25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae",
  "61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4",
  "b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436",
  "f22e3e01e38bcdf001f0d15a2dbfdec5a1cf8eff",
  "f4767ad92cb61401fd69139cade563501c39b991",
  "fc0fdb978eac72f4484b48db058e4473f1bc516e",
  "ff7e20cf642346bf893f1eca808df82035bb53d0"]);
union isfuzzy=true
  // C2 network connections
  (DeviceNetworkEvents
  | where TimeGenerated > ago(Lookback)
  | where RemoteIP in~ (C2_IPs) or RemoteUrl has_any (C2_Hosts)
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
  | extend Hunt = "C2 Connection"),
  // cargo/rustc spawning shells or downloaders (proc-macro1 compile-time execution)
  (DeviceProcessEvents
  | where TimeGenerated > ago(Lookback)
  | where InitiatingProcessFileName in~ ("cargo.exe", "rustc.exe", "cargo", "rustc")
  | where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "wget.exe", "certutil.exe", "sh", "bash")
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, MD5
  | extend Hunt = "Compile-Time Payload Execution"),
  // TrueConf server spawning shells (web shell / installer replacement)
  (DeviceProcessEvents
  | where TimeGenerated > ago(Lookback)
  | where InitiatingProcessCommandLine has "trueconf" or InitiatingProcessFileName has "trueconf"
  | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "mshta.exe", "bitsadmin.exe")
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256, MD5
  | extend Hunt = "TrueConf Post-Exploitation"),
  // Hash hits on endpoints
  (DeviceFileEvents
  | where TimeGenerated > ago(Lookback)
  | where MD5 in~ (BadHashes) or SHA256 in~ (BadHashes) or SHA1 in~ (BadHashes)
  | project TimeGenerated, DeviceName, FolderPath, FileName, MD5, SHA256, SHA1, ActionType
  | extend Hunt = "IOC Hash Match")
| sort by TimeGenerated desc

# Security Arsenal - Supply Chain Compromise Hunt
# Head Mare (TrueConf/PhantomCore) + STARDUST CHOLLIMA (proc-macro1) IOC Sweep
# Run elevated on endpoints, build servers, and TrueConf hosts. Read-only.

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

$C2IPs    = @('194.87.239.71')
$C2Hosts  = @('hwsrv-798836.hostwindsdns.com')
$BadMD5   = @('0e4541c3153ec5ed01497f19cf4f63d0','0e79996d9483d1e44fea32b0a48c2c19',
              '129462164a7d52e9ea8560b60f0412c5','12d4e8f5295f2ef7e0f9bfc0f4830939',
              '2bb75c20e778eb5c416965bd4d4259b1','43f435c3c437bc879a2d7d4634f43494',
              '489f43be558b2679284ceabed7adc4f3')
$BadSHA1  = @('f22e3e01e38bcdf001f0d15a2dbfdec5a1cf8eff','f4767ad92cb61401fd69139cade563501c39b991',
              'fc0fdb978eac72f4484b48db058e4473f1bc516e','ff7e20cf642346bf893f1eca808df82035bb53d0')
$BadSHA256= @('25ad700976873c76af785cb99b33c48db7df8b81f21d1e9e06b3676b9a9373ae',
              '61198155da51b838772eecf5bfaac6cbc4dcc388dccc56658fc28a8e831b34d4',
              'b5c1b5b0763a8809a644a8f92224653f0aca623a98eecc714d27f74b80fbe436')

Write-Host '[*] Checking active/historical network connections to C2...'
$conns = Get-NetTCPConnection | Where-Object { $C2IPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $p = Get-Process -Id $c.OwningProcess
    $findings += [pscustomobject]@{Type='C2-Connection'; Detail="$($p.ProcessName) (PID $($c.OwningProcess)) -> $($c.RemoteAddress):$($c.RemotePort) [$($c.State)]"}
}

Write-Host '[*] Checking DNS cache for C2 hostname...'
$dns = Get-DnsClientCache | Where-Object { $n = $_.Entry; ($C2Hosts | Where-Object { $n -like "*$_*" }) }
foreach ($d in $dns) { $findings += [pscustomobject]@{Type='C2-DNSCache'; Detail="$($d.Entry) -> $($d.Data)"} }

Write-Host '[*] Scanning Cargo caches and project lockfiles for proc-macro1 / poisoned crate versions...'
$cargoPaths = @("$env:USERPROFILE\.cargo\registry", "$env:USERPROFILE\.cargo\git")
foreach ($base in $cargoPaths) {
    if (Test-Path $base) {
        Get-ChildItem -Path $base -Recurse -Directory -Filter 'proc-macro1*' | ForEach-Object {
            $findings += [pscustomobject]@{Type='Malicious-Crate'; Detail="proc-macro1 found: $($_.FullName)"}
        }
    }
}
Get-ChildItem -Path "$env:USERPROFILE" -Recurse -Filter 'Cargo.lock' -Depth 6 | ForEach-Object {
    $content = Get-Content $_.FullName -Raw
    if ($content -match 'proc-macro1' -or
        $content -match 'name = "arrayref"[\s\S]{0,80}version = "0\.3\.10"' -or
        $content -match 'name = "internment"[\s\S]{0,80}version = "0\.8\.7"' -or
        $content -match 'name = "append-only-vec"[\s\S]{0,80}version = "0\.1\.9"') {
        $findings += [pscustomobject]@{Type='Poisoned-Dependency'; Detail="$($_.FullName) references malicious crate version"}
    }
}

Write-Host '[*] Hash-sweeping TrueConf install directories and common staging paths...'
$scanPaths = @('C:\Program Files\TrueConf', 'C:\Program Files (x86)\TrueConf', "$env:TEMP", "$env:APPDATA\TrueConf")
foreach ($sp in $scanPaths) {
    if (Test-Path $sp) {
        Get-ChildItem -Path $sp -Recurse -File | ForEach-Object {
            $h = Get-FileHash $_.FullName -Algorithm MD5
            if ($BadMD5 -contains $h.Hash.ToLower()) {
                $findings += [pscustomobject]@{Type='IOC-MD5-Match'; Detail="$($_.FullName) [$($h.Hash)]"}
            }
        }
    }
}

Write-Host '[*] Checking persistence locations (Run keys, scheduled tasks)...'
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
    (Get-ItemProperty $rk).PSObject.Properties | Where-Object {
        $_.Value -match 'cargo|rustc|proc-macro|trueconf|hostwindsdns|194\.87\.239' } | ForEach-Object {
        $findings += [pscustomobject]@{Type='Persistence-RunKey'; Detail="$rk :: $($_.Name) = $($_.Value)"}
    }
}
Get-ScheduledTask | Where-Object { ($_.Actions.Execute + ($_.Actions.Arguments -join ' ')) -match 'cargo|proc-macro|hostwindsdns|trueconf.*\.ps1' } | ForEach-Object {
    $findings += [pscustomobject]@{Type='Persistence-Task'; Detail="$($_.TaskName): $($_.Actions.Execute) $($_.Actions.Arguments)"}
}

Write-Host "`n[+] Hunt complete. $($findings.Count) finding(s)."
$findings | Format-Table -AutoSize | Out-String -Width 300 | Write-Host
$findings | Export-Csv -Path ".\supplychain_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation