Malicious Claude Code Extension in Cursor IDE + AD CS ESC1/ESC8 Exploitation: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Malicious Claude Code Extension - SSH Backdoor Persistence
id: 1
status: experimental
description: Detects creation of LaunchAgents for SSH persistence
date: 2026/11/03
author: Security Arsenal
logsource:
  product: macos
  service: auditd
detection:
  selection:
    Image: '/bin/launchctl'
    CommandLine|contains: 'load'
    CommandLine|contains: 'com.apple.launchd'
    CommandLine|contains: 'ssh'
  condition: selection
fields:
  - Image
  - CommandLine
falsepositives:
  - Legitimate SSH agent setup
level: high
---
title: AD CS ESC1 Certificate Abuse
id: 2
status: experimental
description: Detects ESC1 certificate enrollment attempts
date: 2026/11/03
author: Security Arsenal
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4886
    CertificateTemplate: 'User'
    SubjectAlternativeName: '*'
  condition: selection
fields:
  - EventID
  - CertificateTemplate
  - SubjectAlternativeName
falsepositives:
  - Legitimate certificate enrollment
level: medium
---
title: Rclone Exfiltration
id: 3
status: experimental
description: Detects Rclone usage for data exfiltration
date: 2026/11/03
author: Security Arsenal
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    Image: '*rclone.exe'
    CommandLine|contains: 'copy'
  condition: selection
fields:
  - Image
  - CommandLine
falsepositives:
  - Legitimate Rclone usage
level: medium

// Hunt for malicious Claude Code extension SSH backdoor
DeviceNetworkEvents
| where RemoteIP == "134.209.82.225"
| where InitiatingProcessFileName =~ "ssh" or InitiatingProcessFileName =~ "launchd"
| project TimeGenerated, DeviceName, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine

// Hunt for AD CS ESC1/ESC8 exploitation
SecurityEvent
| where EventID in (4886, 4887)
| where CertificateTemplate == "User" or CertificateTemplate == "WebServer"
| where SubjectAlternativeName contains "*"
| project TimeGenerated, Computer, Account, CertificateTemplate, SubjectAlternativeName

// Hunt for Rclone exfiltration
DeviceProcessEvents
| where FileName =~ "rclone.exe"
| where ProcessCommandLine contains "copy"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine

# PowerShell IOC Hunt Script
# Check for malicious SSH keys
$sshKeyPath = "$env:USERPROFILE\.ssh\authorized_keys"
if (Test-Path $sshKeyPath) {
    $content = Get-Content $sshKeyPath
    if ($content -match "ssh-rsa.*134\.209\.82\.225") {
        Write-Output "Malicious SSH key found in $sshKeyPath"
    }
}

# Check for LaunchAgents persistence
$launchAgents = Get-ChildItem "~/Library/LaunchAgents" -ErrorAction SilentlyContinue
foreach ($agent in $launchAgents) {
    $plist = plutil -p $agent.FullName
    if ($plist -match "ssh" -and $plist -match "134\.209\.82\.225") {
        Write-Output "Malicious LaunchAgent found: $($agent.FullName)"
    }
}

# Check for Rclone usage
$rclone = Get-Process -Name "rclone" -ErrorAction SilentlyContinue
if ($rclone) {
    Write-Output "Rclone process detected: $($rclone.Path)"
}

# Check for AD CS ESC1/ESC8 abuse
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4886,4887} -ErrorAction SilentlyContinue
foreach ($event in $events) {
    if ($event.Message -match "CertificateTemplate.*User" -or $event.Message -match "SubjectAlternativeName.*\*") {
        Write-Output "Potential AD CS abuse detected: $($event.Message)"
    }
}