title: LokiBot JScript Dropper with Network Activity
id: 91a3e2c4-b7d1-4a5f-9e8d-2c3b4a5e6f7g
description: Detects potential LokiBot infection chain initiated by JScript files making network connections to known C2 infrastructure.
status: experimental
date: 2026/07/25
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/61019235/
tags:
    - attack.execution
    - attack.initial_access
    - attack.t1059.001
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
    selection_cli:
        CommandLine|contains: '.js'
    selection_network:
        InitiatingProcessCommandLine|contains: '.js'
    filter_legit:
        ParentImage|contains:
            - '\Program Files'
            - '\System32'
    condition: selection_img and selection_cli and selection_network and not filter_legit
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: GitHub Actions Runner Connecting to External Non-GitHub IP
id: 82b2f1a3-c6e0-4d5f-8f9e-1d2c3e4f5a6b
description: Detects GitHub Actions runners establishing outbound connections to known suspicious IP addresses or non-GitHub infrastructure, indicating potential abuse.
status: experimental
date: 2026/07/25
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/61019236/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: azure
detection:
    selection:
        InitiatingProcessUser|contains: 'runner'
    selection_ip:
        DestinationIp|startswith:
            - '43.228.'
            - '192.168.' # Example private, adjust based on known infrastructure
    condition: selection and selection_ip
falsepositives:
    - Legitimate CI/CD testing against external staging servers
level: critical
---
title: Suspicious Linux Payload Download via cPanel Exploit
id: 73c1e0b2-a5d9-3c4e-7e8d-0c1b2d3e4f5a
description: Identifies the download of payloads associated with the CVE-2026-41940 cPanel exploitation campaign from the observed C2 IP.
status: experimental
date: 2026/07/25
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/61019236/
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        DestinationIp: '43.228.157.68'
        DestinationPort: 80
    condition: selection
falsepositives:
    - None
level: critical


kql
// Hunt for LokiBot C2 Domains and GitHub Abuse IP
let IoC_Domains = dynamic(['alphastand.trade', 'alphastand.win', 'alphastand.top', 'kbfvzoboss.bid', 'baccarat.com.au']);
let IoC_IPs = dynamic(['43.228.157.68']);
let IoC_Hashes = dynamic(['c099f965144bccd0b590f946659fc3c0747c54aef505b6caaca9078712f455fb', '22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1']);
// Network Connections
DeviceNetworkEvents
| where RemoteUrl in (IoC_Domains) or RemoteIP in (IoC_IPs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| union (
    DeviceProcessEvents
    | where SHA256 in (IoC_Hashes) or ProcessCommandLine has ".js" and InitiatingProcessFileName in ("wscript.exe", "cscript.exe")
    | project Timestamp, DeviceName, AccountName, ProcessCommandLine, SHA256, FolderPath
)
| order by Timestamp desc


powershell
# IOC Hunter for LokiBot and GitHub Exploit Payloads
# Requires Administrative Privileges

$IoCHashes = @(
    "c099f965144bccd0b590f946659fc3c0747c54aef505b6caaca9078712f455fb", # LokiBot
    "22f721fd3a81d2e27cbf90a122bb977f630c50b79daa98350f0e57b04dfa81f1"  # Linux Payload (if running on Windows Subsystem)
)

$IoCDomains = @(
    "alphastand.trade",
    "alphastand.win",
    "alphastand.top",
    "kbfvzoboss.bid"
)

function Get-FileHashRecursive {
    param (
        [string]$Path,
        [string[]]$Hashes
    )
    
    Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($Hashes -contains $hash) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }
}

function Check-HostsFile {
    $hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
    if (Test-Path $hostsPath) {
        $content = Get-Content $hostsPath
        foreach ($domain in $IoCDomains) {
            if ($content -match $domain) {
                Write-Host "[!] SUSPICIOUS HOSTS ENTRY DETECTED for $domain in $hostsPath" -ForegroundColor Yellow
            }
        }
    }
}

Write-Host "[*] Starting IOC Hunt..." -ForegroundColor Cyan

# Check C:\ and common user profiles
Get-FileHashRecursive -Path "C:\" -Hashes $IoCHashes
Check-HostsFile

Write-Host "[*] Hunt Complete." -ForegroundColor Cyan


# Response Priorities

**Immediate (0-4h):**
*   Block all listed domains (`alphastand.*`, `kbfvzoboss.bid`) and IP addresses (`43.228.157.68`) at the perimeter firewall and proxy.
*   Scan all endpoints for the specific SHA256 file hashes provided in the IOCs.
*   Isolate any systems showing signs of wscript.exe connecting to non-corporate infrastructure.

**24h:**
*   Initiate credential reset procedures for accounts that may have been compromised by the LokiBot infostealer (prioritize admin and database access).
*   Revoke and rotate OAuth tokens associated with third-party integrations (specifically Klue/Salesforce/Gong) and enforce "least privilege" access for connected apps.
*   Audit all GitHub repositories for unauthorized workflow files or commits from unknown contributors.

**1 Week:**
*   Patch cPanel/WHM servers against CVE-2026-41940.
*   Implement strict controls on GitHub Actions usage (e.g., requiring approval for fork pull requests, pinning actions to specific SHAs).
*   Conduct a review of email filtering rules to block JScript attachments and malspam patterns associated with LokiBot.