KREMLIN Banking Extension, SysGoRAT Espionage & ARMORY CASTLE BeyondTrust Zero-Day: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Chrome Secure Preferences Tampering - KREMLIN Extension Forgery
id: 9f1c2a44-7b3e-4d21-9a8f-kremlin0001
description: Detects modification of Chromium Secure Preferences or Preferences files by non-browser processes, consistent with REF9334 KREMLIN forging browser integrity HMACs to install malicious extensions.
status: experimental
date: 2026/10/16
author: Security Arsenal Threat Intelligence
references:
    - https://www.elastic.co/security-labs/threat-command/malicious-browser-extension-kremlin-banking-malware
logsource:
    category: file_event
    product: windows
detection:
    selection_path:
        TargetFilename|contains:
            - '\AppData\Local\Google\Chrome\User Data\'
            - '\AppData\Local\Chromium\User Data\'
            - '\AppData\Local\Microsoft\Edge\User Data\'
        TargetFilename|endswith:
            - '\Secure Preferences'
            - '\Preferences'
    filter_browser:
        Image|contains:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\GoogleUpdate.exe'
            - '\MicrosoftEdgeUpdate.exe'
    condition: selection_path and not filter_browser
fields:
    - Image
    - TargetFilename
    - User
falsepositives:
    - Enterprise policy deployment tools modifying browser preferences
level: high
tags:
    - attack.persistence
    - attack.defense_evasion
    - attack.t1176
---
title: PwnKit pkexec Privilege Escalation on Linux - CL-UNK-1211
id: 3b7d91e2-5c4a-4f18-8d2a-sysgorat002
description: Detects anomalous pkexec execution patterns consistent with CVE-2021-4034 (PwnKit) exploitation used by CL-UNK-1211 to escalate privileges on government Linux systems.
status: experimental
date: 2026/10/16
author: Security Arsenal Threat Intelligence
references:
    - https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/
logsource:
    category: process_creation
    product: linux
detection:
    selection_pkexec:
        Image|endswith: '/pkexec'
    selection_suspicious_parent:
        ParentImage|endswith:
            - '/bash'
            - '/sh'
            - '/python'
            - '/python3'
            - '/perl'
            - '/php'
    selection_env_abuse:
        CommandLine|contains:
            - 'GCONV_PATH'
            - 'CHARSET'
    condition: selection_pkexec and (selection_suspicious_parent or selection_env_abuse)
fields:
    - Image
    - ParentImage
    - CommandLine
    - User
falsepositives:
    - Legitimate administrative pkexec usage (rare from script interpreters)
level: critical
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2021.4034
---
title: Webshell Drop and Tunneler Execution on Remote Access Appliances - ARMORY CASTLE
id: 7e2a5c19-1d8b-4c33-a6f4-armorycastle003
description: Detects web server processes spawning shells or tunneling binaries, consistent with SAWFLY webshell and BARECLAW tunneler deployment following BeyondTrust CVE-2026-102764 exploitation. Also detects suspicious SUID bit modification.
status: experimental
date: 2026/10/16
author: Security Arsenal Threat Intelligence
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
logsource:
    category: process_creation
    product: linux
detection:
    selection_web_parent:
        ParentImage|contains:
            - 'nginx'
            - 'apache'
            - 'httpd'
            - 'tomcat'
            - 'lighttpd'
    selection_shell_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
    selection_suid:
        Image|endswith: '/chmod'
        CommandLine|contains:
            - 'u+s'
            - '4755'
            - '4711'
    condition: (selection_web_parent and selection_shell_child) or selection_suid
fields:
    - Image
    - ParentImage
    - CommandLine
    - User
falsepositives:
    - Appliance vendor update scripts (verify against BeyondTrust maintenance windows)
level: critical
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.privilege_escalation
    - attack.t1548.001
    - cve.2026.102764

// Security Arsenal Hunt: KREMLIN extension forgery, SysGoRAT C2, ARMORY CASTLE appliance exploitation
// Scope: last 30 days across endpoint and network telemetry
let KremlinDomains = dynamic(["codecaudiog.site", "codecvideowin.online"]);
let SysGoRAT_IP = "88.119.167.57";
let KnownHashes = dynamic([
    "44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879",
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "1f19b9a27d79c11bda00a1e8faf74a7fdd683d38ccef1b60df2fd0307e3aa462",
    "dc14e215269a93fdbc4c1a80b984c23faf7af0911c6dbb85309796a6f2ae95fb"
]);
// 1. Network indicators: KREMLIN staging domains + SysGoRAT C2
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl in (KremlinDomains) or RemoteIP == SysGoRAT_IP
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ActionType
| extend HuntType = "NetworkIOC";
// 2. File hash hits across all three campaigns
let HashHits = DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 in (KnownHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| extend HuntType = "HashMatch";
// 3. Behavioral: non-browser process writing Chrome Secure Preferences (KREMLIN forgery)
let SecurePrefTamper = DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FolderPath has_any ("Chrome\\User Data", "Chromium\\User Data", "Edge\\User Data")
| where FileName in ("Secure Preferences", "Preferences")
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "GoogleUpdate.exe", "MicrosoftEdgeUpdate.exe", "msedgeupdate.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName
| extend HuntType = "SecurePreferencesTamper";
// 4. Behavioral: pkexec / SUID abuse (SysGoRAT PwnKit + ARMORY CASTLE escalation) via imported Linux logs
let PrivEsc = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("pkexec", "chmod")
| where ProcessCommandLine has_any ("GCONV_PATH", "u+s", "4755", "4711")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| extend HuntType = "LinuxPrivEsc";
union NetHits, HashHits, SecurePrefTamper, PrivEsc
| sort by TimeGenerated desc

# Security Arsenal IOC Hunt - REF9334 KREMLIN / ARMORY CASTLE artifacts
# Run elevated on Windows endpoints; outputs findings to CSV
$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# --- 1. KREMLIN: Chrome extensions present on disk but absent from Secure Preferences master list ---
$chromePaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data",
    "$env:LOCALAPPDATA\Chromium\User Data",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data"
)
foreach ($base in $chromePaths) {
    $profiles = Get-ChildItem -Path $base -Directory | Where-Object { $_.Name -match '^(Default|Profile)' }
    foreach ($profile in $profiles) {
        $securePref = Join-Path $profile.FullName 'Secure Preferences'
        $extDir = Join-Path $profile.FullName 'Extensions'
        if ((Test-Path $securePref) -and (Test-Path $extDir)) {
            $prefContent = Get-Content $securePref -Raw | ConvertFrom-Json
            $registered = $prefContent.extensions.settings.PSObject.Properties.Name
            $onDisk = Get-ChildItem $extDir -Directory | Select-Object -ExpandProperty Name
            foreach ($ext in $onDisk) {
                if ($registered -notcontains $ext) {
                    $findings += [PSCustomObject]@{
                        Hostname  = $env:COMPUTERNAME
                        Check     = 'UnregisteredExtension-KREMLIN'
                        Detail    = "Extension $ext on disk but not in Secure Preferences: $extDir"
                        Severity  = 'CRITICAL'
                        Timestamp = (Get-Date).ToString('o')
                    }
                }
            }
        }
    }
}

# --- 2. KREMLIN: Secure Preferences modified by non-browser process (file timestamp anomaly) ---
foreach ($base in $chromePaths) {
    Get-ChildItem -Path $base -Recurse -Filter 'Secure Preferences' | ForEach-Object {
        $age = (New-TimeSpan -Start $_.LastWriteTime -End (Get-Date)).TotalHours
        $browserRunning = Get-Process -Name chrome, msedge
        if ($age -lt 1 -and -not $browserRunning) {
            $findings += [PSCustomObject]@{
                Hostname  = $env:COMPUTERNAME
                Check     = 'SecurePrefsModifiedNoBrowser'
                Detail    = "$($_.FullName) modified $($_.LastWriteTime) with no browser process running"
                Severity  = 'HIGH'
                Timestamp = (Get-Date).ToString('o')
            }
        }
    }
}

# --- 3. Network: active/recent connections to SysGoRAT C2 and KREMLIN staging ---
$badIPs = @('88.119.167.57')
$conns = Get-NetTCPConnection | Where-Object { $badIPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess
    $findings += [PSCustomObject]@{
        Hostname  = $env:COMPUTERNAME
        Check     = 'MaliciousC2Connection'
        Detail    = "$($proc.ProcessName) (PID $($c.OwningProcess)) -> $($c.RemoteAddress):$($c.RemotePort) [$($c.State)]"
        Severity  = 'CRITICAL'
        Timestamp = (Get-Date).ToString('o')
    }
}

# --- 4. DNS cache retro-check for KREMLIN staging domains ---
$badDomains = @('codecaudiog.site', 'codecvideowin.online')
$dnsCache = Get-DnsClientCache | Where-Object { $d = $_.Entry; $badDomains | Where-Object { $d -like "*$_*" } }
foreach ($d in $dnsCache) {
    $findings += [PSCustomObject]@{
        Hostname  = $env:COMPUTERNAME
        Check     = 'DNSCache-KremlinDomain'
        Detail    = "$($d.Entry) resolved to $($d.Data)"
        Severity  = 'HIGH'
        Timestamp = (Get-Date).ToString('o')
    }
}

# --- 5. Scheduled tasks / Run keys with suspicious script-interpreter persistence ---
$susTasks = Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match '(mshta|wscript|cscript|powershell|rundll32|regsvr32)' -and
    $_.Actions.Arguments -match '(http|\.ps1|\.js|\.vbs|temp|appdata)'
}
foreach ($t in $susTasks) {
    $findings += [PSCustomObject]@{
        Hostname  = $env:COMPUTERNAME
        Check     = 'SuspiciousScheduledTask'
        Detail    = "$($t.TaskName): $($t.Actions.Execute) $($t.Actions.Arguments)"
        Severity  = 'MEDIUM'
        Timestamp = (Get-Date).ToString('o')
    }
}

if ($findings.Count -gt 0) {
    $out = "$env:TEMP\arsenal_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
    $findings | Export-Csv -Path $out -NoTypeInformation
    Write-Host "[ALERT] $($findings.Count) findings written to $out" -ForegroundColor Red
    $findings | Format-Table -AutoSize
} else {
    Write-Host '[CLEAN] No indicators of KREMLIN, SysGoRAT, or ARMORY CASTLE artifacts found.' -ForegroundColor Green
}