Miasma/Shai-Hulud Descendant 'strutil-core' Ruby Gem + Booking.com Hospitality Phishing Cluster: OTX Pulse Analysis — Credential Theft Detection Pack

---
title: Malicious Ruby Gem Install Hook Execution - Shai-Hulud/Miasma Lineage
id: 7f3a1c2e-9d4b-4e5a-a1c3-otxstrutil0001
status: experimental
description: Detects gem/bundler package managers spawning shells or script interpreters during install, consistent with the strutil-core malicious gem (testmetest/Miasma worm) executing a payload at install time.
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
    definition: Linux equivalent via auditd/Sysmon for Linux process_creation events
detection:
    selection_parent:
        ParentImage|endswith:
            - '\gem.exe'
            - '\ruby.exe'
            - '\bundle.exe'
            - '/gem'
            - '/bundle'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\curl.exe'
            - '\wget.exe'
            - '/bin/sh'
            - '/bin/bash'
            - '/usr/bin/curl'
            - '/usr/bin/wget'
            - '/usr/bin/python3'
    condition: selection_parent and selection_child
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Legitimate native gem compilation (rare; typically spawns compiler toolchains, not shells)
level: high
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.t1059
---
title: Network Connection to Miasma/testmetest C2 or Booking.com Phishing Cluster Domains
id: 7f3a1c2e-9d4b-4e5a-a1c3-otxstrutil0002
status: experimental
description: Detects DNS resolution or network connections to OTX-listed infrastructure for the strutil-core gem worm C2 (paleasbest.top, aiarmor.website) and the hospitality phishing cluster domains.
author: Security Arsenal Threat Intel
logsource:
    category: dns
detection:
    selection_exact:
        query:
            - 'paleasbest.top'
            - 'aiarmor.website'
            - 'homesdowttups.com'
            - 'gardenstokyjp.com'
            - 'reserv-advanced67746202.com'
            - 'advanced-reserv882689.com'
            - 'confirmation-advanced-reserv203684.com'
            - 'hotelchecckrsrv-krwo.world'
            - 'goldeshoms.com'
            - 'guestnooks-homeset.com'
    selection_pattern:
        query|contains:
            - 'reserv-advanced'
            - 'advanced-reserv'
            - 'confirmation-advanced-reserv'
    condition: 1 of selection_*
fields:
    - query
    - ClientIP
falsepositives:
    - Unlikely; templated reservation-themed domains have no legitimate enterprise use
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.exfiltration
    - attack.t1041
---
title: Credential Store Access Following Ruby/Gem Process Execution
id: 7f3a1c2e-9d4b-4e5a-a1c3-otxstrutil0003
status: experimental
description: Detects access to cloud credential files, SSH keys, or environment secret files by Ruby-related processes, matching testmetest/Miasma credential theft behavior.
author: Security Arsenal Threat Intel
logsource:
    category: file_event
    product: windows
detection:
    selection_image:
        Image|endswith:
            - '\ruby.exe'
            - '\gem.exe'
            - '\bundle.exe'
    selection_target:
        TargetFilename|contains:
            - '\.aws\credentials'
            - '\.azure\'
            - '\.config\gcloud\'
            - '\.ssh\'
            - '\.env'
            - '\.npmrc'
            - '\.gem\credentials'
    condition: selection_image and selection_target
fields:
    - TargetFilename
    - CommandLine
falsepositives:
    - Legitimate Ruby cloud SDK usage (rare on endpoints; common on build agents - tune by host role)
level: high
tags:
    - attack.credential_access
    - attack.t1552.001
    - attack.t1552.004

// Hunt: strutil-core gem install + C2 egress + phishing cluster contact (last 14 days)
let gemC2 = dynamic(["paleasbest.top", "aiarmor.website"]);
let phishDomains = dynamic(["homesdowttups.com","gardenstokyjp.com","reserv-advanced67746202.com","advanced-reserv882689.com","confirmation-advanced-reserv203684.com","hotelchecckrsrv-krwo.world","goldeshoms.com","guestnooks-homeset.com"]);
let GemInstalls = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("gem.exe","bundle.exe","ruby.exe","gem","bundle")
   or ProcessCommandLine has_any ("gem install strutil-core","strutil-core")
| project DeviceName, GemInstallTime=TimeGenerated, ProcessCommandLine, InitiatingProcessCommandLine, AccountName;
let C2Hits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (gemC2)
   or RemoteUrl has_any (phishDomains)
   or RemoteUrl matches regex @"(?i)(reserv-advanced|advanced-reserv|confirmation-advanced-reserv)\d*\."
| project DeviceName, C2Time=TimeGenerated, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine;
C2Hits
| join kind=leftouter GemInstalls on DeviceName
| extend CompromiseType = case(
    isnotempty(GemInstallTime), "SUPPLY-CHAIN: gem install + C2 egress",
    RemoteUrl has_any (phishDomains), "PHISHING: hospitality lure click",
    "C2 egress"),
    Severity = case(isnotempty(GemInstallTime), "CRITICAL", "HIGH")
| project Severity, CompromiseType, DeviceName, AccountName, RemoteUrl, RemoteIP, C2Time, GemInstallTime, InitiatingProcessCommandLine, ProcessCommandLine
| order by Severity asc, C2Time desc

# Security Arsenal - OTX Hunt Script: strutil-core/Miasma gem worm + hospitality phishing artifacts
# Run elevated on endpoints, developer workstations, and build agents. Read-only.

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# 1. Malicious gem presence: local gem cache + Gemfile.lock references
$gemPaths = @("$env:USERPROFILE\.gem","$env:ProgramData\gem","C:\Ruby*\lib\ruby\gems","$env:HOME/.gem","/var/lib/gems","/usr/local/lib/ruby/gems")
foreach ($p in $gemPaths) {
    Get-ChildItem -Path $p -Recurse -Filter "*strutil-core*" -ErrorAction SilentlyContinue | ForEach-Object {
        $findings += [pscustomobject]@{Type="MALICIOUS GEM INSTALLED"; Path=$_.FullName; Detail="strutil-core artifact present"}
    }
}
Get-ChildItem -Path "C:\","$env:USERPROFILE" -Recurse -Include "Gemfile.lock","*.gemspec" -Depth 5 -ErrorAction SilentlyContinue | ForEach-Object {
    if ((Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue) -match "strutil-core") {
        $findings += [pscustomobject]@{Type="GEMFILE REFERENCE"; Path=$_.FullName; Detail="strutil-core pinned in dependency file"}
    }
}

# 2. Payload file hashes on disk (EDR-independent sweep of common staging dirs)
$badHashes = @(
  "3b3f6e1bde0b28b015030a81a6d805b5b5306dc3f021e1102123971cfd83acc0",
  "306c1deec402e8b4a6478e7f0fe02194bcd224d37d8fc6ba61ad1951e8abd7a9",
  "c5264f3b9cf2f95c83a70b7dd7430aab8abc262b853dbbcd5386c3a8a9c74769",
  "66c1c6b6b2c47e96fa5fd328338b939e1360511ab5eb2dda6d9112f592259d6b",
  "c7ef186aa59b67d9b198a14f6dc8aaee6dd86510ac7c37d28f65d310cd846411"
)
foreach ($dir in @("$env:TEMP","$env:LOCALAPPDATA\Temp","$env:USERPROFILE\Downloads","C:\Windows\Temp")) {
    Get-ChildItem -Path $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($badHashes -contains $h.ToLower()) {
            $findings += [pscustomobject]@{Type="PAYLOAD HASH MATCH"; Path=$_.FullName; Detail=$h}
        }
    }
}

# 3. Persistence: shell profile / registry run-key injection referencing ruby/gem
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
    (Get-ItemProperty $k -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object { $_.Value -match "(?i)ruby|gem|strutil" } | ForEach-Object {
        $findings += [pscustomobject]@{Type="RUN KEY PERSISTENCE"; Path="$k\$($_.Name)"; Detail=$_.Value}
    }
}
Get-Content "$env:USERPROFILE\.bashrc","$env:USERPROFILE\.zshrc","$env:USERPROFILE\.bash_profile" -ErrorAction SilentlyContinue | Select-String -Pattern "strutil|paleasbest|aiarmor|gem " | ForEach-Object {
    $findings += [pscustomobject]@{Type="SHELL PROFILE INJECTION"; Path=$_.Path; Detail=$_.Line.Trim()}
}

# 4. Live network connections to C2/phishing infrastructure
$badDomains = "paleasbest.top","aiarmor.website","homesdowttups.com","gardenstokyjp.com","reserv-advanced67746202.com","advanced-reserv882689.com","confirmation-advanced-reserv203684.com","hotelchecckrsrv-krwo.world","goldeshoms.com","guestnooks-homeset.com"
foreach ($d in $badDomains) {
    $r = Resolve-DnsName $d -ErrorAction SilentlyContinue
    if ($r) { $findings += [pscustomobject]@{Type="DNS RESOLVES (sinkhole check)"; Path=$d; Detail=($r.IPAddress -join ",")} }
}
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    try { $name = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress)).HostName } catch { $name = "" }
    foreach ($d in $badDomains) { if ($name -like "*$d*") {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        $findings += [pscustomobject]@{Type="ACTIVE C2 CONNECTION"; Path=$name; Detail="$($_.RemoteAddress):$($_.RemotePort) via $($proc.ProcessName)"}
    }}
}

# 5. DNS cache evidence of phishing lure clicks
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match "(?i)reserv-advanced|advanced-reserv|goldeshoms|guestnooks|homesdowttups|gardenstokyjp|hotelchecckrsrv" } | ForEach-Object {
    $findings += [pscustomobject]@{Type="DNS CACHE: PHISHING CONTACT"; Path=$_.Entry; Detail=$_.Data}
}

if ($findings.Count -gt 0) { $findings | Format-Table -AutoSize; $findings | Export-Csv ".\otx_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation; Write-Host "[ALERT] $($findings.Count) finding(s) - escalate to IR." -ForegroundColor Red }
else { Write-Host "[CLEAN] No OTX pulse artifacts found on $env:COMPUTERNAME." -ForegroundColor Green }