title: Potential Lumma Stealer or Vidar Loader Activity
id: c4a5e1b0-88f5-4b4e-9d2f-1a2b3c4d5e6f
status: experimental
description: Detects suspicious process execution patterns associated with Lumma Stealer and Vidar distribution campaigns, often involving PowerShell downloading content from suspicious domains or executing signed binaries masquerading as AI tools.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/06/10
tags:
    - attack.execution
    - attack.initial_access
    - attack.t1204
    - attack.t1566
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
        Image|endswith:
            - '\mshta.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
    filter_legit:
        CommandLine|contains:
            - 'Windows'
            - 'System32'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: SilabRAT MaaS C2 Traffic Pattern
id: d5b6f2c1-99g6-5c5f-0e3g-2b3c4d5e6f7g
status: experimental
description: Detects potential network connections to known SilabRAT infrastructure or characteristics of its C2 communication, often involving high-entropy data or specific user-agents.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/06/10
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp|contains:
            - '91.199.163.124'
    selection_domain:
        DestinationHostname|contains:
            - 'brokeapt.com'
            - 'rongtv.xyz'
    selection_behavior:
        Initiated: 'true'
        DestinationPort:
            - 80
            - 443
    condition: 1 of selection_*
falsepositives:
    - Rare, unless specific corporate traffic uses these domains/IPs
level: critical
---
title: Suspicious Python Package Execution (Miasma/Mini Shai-Hulud)
id: e6c7g3d2-00h7-6d6g-1f4h-3c4d5e6f7g8h
status: experimental
description: Detects execution of Python processes loading suspicious paths or modules associated with the malicious PyPI campaign targeting developers (Miasma, Hades).
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/06/10
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_python:
        Image|endswith:
            - '\python.exe'
            - '\python3.exe'
    selection_cli:
        CommandLine|contains:
            - 'site-packages'
            - '.pth'
            - '.abi3.so'
    condition: all of selection_*
falsepositives:
    - Legitimate developer builds or testing environments
level: medium


kql
// Hunt for SilabRAT and Vidar/Lumma IOCs in DeviceNetworkEvents
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("brokeapt.com", "rongtv.xyz", "ssffaa19.xyz") 
   or RemoteIP == "91.199.163.124"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort

// Hunt for process execution of known file hashes (SHA256)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "79f8da9f9fb4ac7c16d9c210f1f6ef418357a3e7bf602b1dd03a490596fa58c5",
    "6506d31707a39949f89534bf9705bcf889f1ecae3dbc6f4ff88d67a8be3d01b2"
)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath, SHA256


powershell
# PowerShell Script to Hunt for SilabRAT and Infostealer Artifacts
# Requires Administrative Privileges

Write-Host "Starting Hunt for SilabRAT, Lumma, and Vidar Artifacts..." -ForegroundColor Cyan

# 1. Check for Suspicious Scheduled Tasks (Common Loader Persistence)
Write-Host "\n[+] Checking Scheduled Tasks for suspicious patterns..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -like "*powershell*" -or 
    $_.Actions.Execute -like "*rundll32*" -or 
    $_.Actions.Execute -like "*regsvr32*" -and 
    $_.Actions.Arguments -match "http" 
} | Select-Object TaskName, TaskPath, State, Actions

# 2. Check for File Hashes in Common Drop Paths (AppData, Temp)
Write-Host "\n[+] Scanning common drop directories for known IOCs..." -ForegroundColor Yellow
$targetHashes = @(
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b"
)

$paths = @("$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:TEMP")

foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | Where-Object { $targetHashes -contains $_.Hash } | Select-Object Path, Hash
    }
}

# 3. Check for Suspicious Network Connections (SilabRAT IP)
Write-Host "\n[+] Checking for active connections to C2 infrastructure..." -ForegroundColor Yellow
$maliciousIP = "91.199.163.124"
Get-NetTCPConnection -RemoteAddress $maliciousIP -ErrorAction SilentlyContinue | Select-Object LocalAddress, RemoteAddress, State, OwningProcess

Write-Host "\n[*] Hunt Complete." -ForegroundColor Green


# Response Priorities

*   **Immediate:**
    *   Block all identified domains (`brokeapt.com`, `*.rongtv.xyz`) and IPs (`91.199.163.124`) at the firewall and proxy level.
    *   Isolate endpoints with matches on the provided file hashes (SilabRAT, Vidar, Lumma).

*   **24 Hours:**
    *   Initiate credential reset procedures for accounts accessed from infected endpoints, focusing on financial systems and cryptocurrency wallets.
    *   Review browser extension logs for unauthorized additions related to crypto-wallets (Needle campaign).

*   **1 Week:**
    *   Implement strict allow-listing for Python/Package repositories (PyPI, npm) for developer workstations to mitigate supply chain risks.
    *   Conduct security awareness training focusing on AI-themed social engineering and malvertising.
    *   Review EDR policies to enhance detection of loaders like Hijack Loader and AsmCrypt obfuscation.