title: Potential ShinyHunters MeshCentral C2 Activity
id: d8f8e9a0-6b1a-4a9c-9f5e-1a2b3c4d5e6f
status: experimental
description: Detects network connections to known ShinyHunters C2 infrastructure associated with Oracle PeopleSoft exploitation.
references:
    - https://otx.alienvault.com/pulse/660000000000
author: Security Arsenal Research
date: 2026/06/16
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'azurenetfiles.net'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Suspicious Cisco SD-WAN Webshell Process Creation
date: 2026/06/16
author: Security Arsenal Research
status: experimental
description: Detects potential webshell activity on Cisco SD-WAN devices via suspicious Java process arguments or file creation.
references:
    - https://otx.alienvault.com/pulse/660000000001
logsource:
    category: process_creation
product: linux
detection:
    selection_java:
        Image|endswith: '/java'
        CommandLine|contains:
            - 'godzilla'
            - 'behinder'
            - 'memshell'
    selection_webshell:
        TargetFilename|contains:
            - '.jsp'
            - '.jspx'
        CommandLine|contains:
            - 'curl'
            - 'wget'
    condition: 1 of selection*
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: InterlockRAT NodeSnake Linux Persistence
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects persistence mechanisms used by NodeSnake or InterlockRAT on Linux endpoints.
references:
    - https://otx.alienvault.com/pulse/660000000002
author: Security Arsenal Research
date: 2026/06/16
logsource:
    product: linux
    category: process_creation
detection:
    selection_cron:
        Image|endswith: '/crontab'
        CommandLine|contains:
            - '/tmp/'
            - '/var/tmp/'
    selection_node:
        Image|endswith: '/node'
        CommandLine|contains:
            - 'base64'
            - 'eval'
    condition: 1 of selection*
falsepositives:
    - Developer activity
level: medium


kql
// Hunt for ShinyHunters and Interlock Network IOCs
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "azurenetfiles.net" 
   or RemoteUrl has "leadslaw.com"
   or RemoteIP in ("185.196.9.234", "176.120.22.24")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| extend IOCPulse = iif(RemoteUrl has "azurenetfiles", "UNC6240_ShinyHunters", "Hive0163_Interlock")


powershell
# IOC Hunter for Interlock and ShinyHunters File Hashes
$TargetHashes = @(
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c",
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f",
    "2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35"
)

Write-Host "Scanning for OTX Pulse IOCs (Interlock/Rhysida/ShinyHunters)..." -ForegroundColor Cyan

# Check common download directories
$PathsToScan = @("C:\Users\*\Downloads\", "C:\Windows\Temp\", "C:\ProgramData\")

foreach ($path in $PathsToScan) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $file = $_
            if ($file.Length -gt 0) {
                try {
                    $hash = (Get-FileHash -Path $file.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
                    if ($TargetHashes -contains $hash) {
                        Write-Host "[ALERT] Malicious file found: $($file.FullName) | Hash: $hash" -ForegroundColor Red
                    }
                } catch {
                    # Ignore access errors
                }
            }
        }
    }
}

# Check for MeshCentral Agent Artifacts
$MeshPath = "C:\Windows\MeshAgent"
if (Test-Path $MeshPath) {
    Write-Host "[WARNING] MeshCentral Agent directory detected: $MeshPath. Verify legitimate usage (UNC6240 activity)." -ForegroundColor Yellow
}


# Response Priorities

*   **Immediate:** 
    *   Block all listed domains (`azurenetfiles.net`, `leadslaw.com`) and IPs at the firewall/proxy.
    *   Patch **CVE-2026-35273** (Oracle PeopleSoft) and **CVE-2026-20182** (Cisco SD-WAN) immediately.
    *   Isolate devices matching the file hash IOCs.
*   **24 Hours:**
    *   Initiate credential reset for accounts active on endpoints where `MintLoader` or `Vidar` (information stealers) may have executed (Pulse 1).
    *   Audit Oracle PeopleSoft servers for unauthorized `MeshCentral` installations or `agent.ashx` files.
*   **1 Week:**
    *   Review external attack surface for exposed SD-WAN management interfaces.
    *   Implement application control to block execution of unsigned installers and LOLBins (Living Off The Land) abused by `JunkFiction`.