Mistic Backdoor, Autonomous AI Agents, and GitHub Actions Abuse: OTX Pulse Analysis — Enterprise Detection Pack

title: Potential Mistic Backdoor or ModeloRAT Sideloading Activity
id: 8a7b8c9d-0e1f-2a3b-4c5d-6e7f8a9b0c1d
description: Detects potential sideloading behavior associated with Mistic backdoor or ModeloRAT based on suspicious DLL loads by legitimate Windows binaries.
status: experimental
date: 2026/07/24
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66a1c5b8e7b2d
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|contains:
            - '\AppData\Local\Temp\'
            - '\ProgramData\'
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\svchost.exe'
    filter_legitimate:
        Signed: 'true'
        SignatureStatus: 'Valid'
    condition: selection and not filter_legitimate
falsepositives:
    - Legitimate software installers
level: high
tags:
    - attack.defense_evasion
    - attack.t1574.002
---
title: GitHub Actions Abuse Downloading Linux Payloads
date: 2026/07/24
author: Security Arsenal
status: experimental
description: Detects processes associated with GitHub Actions runners downloading suspicious payloads from external IPs resembling the cPanel exploitation campaign.
references:
    - https://otx.alienvault.com/pulse/66a1c5b8e7b2d
logsource:
    category: process_creation
    product: linux
detection:
    selection_cli:
        CommandLine|contains:
            - 'curl'
            - 'wget'
    selection_target:
        CommandLine|contains:
            - '43.228.157.68'
            - 'api/dl'
    condition: all of selection_*
falsepositives:
    - Legitimate CI/CD workflows pulling known artifacts
level: critical
tags:
    - attack.initial_access
    - attack.t1190
---
title: Hades Implant or Go-Based Backdoor Network Traffic
date: 2026/07/24
author: Security Arsenal
status: experimental
description: Identifies suspicious network connections to known Hades C2 infrastructure or high-entropy Go binaries connecting to non-standard ports.
references:
    - https://otx.alienvault.com/pulse/66a1c5b8e7b2d
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp|contains:
            - '43.246.208.207'
    selection_port:
        DestinationPort:
            - 80
            - 443
            - 8080
    condition: selection_ip
falsepositives:
    - Low
level: high
tags:
    - attack.command_and_control
    - attack.t1071

// Hunt for Mistic and Hades related IPs and Hashes
let IoC_IPs = pack_array("43.246.208.207", "43.228.157.68");
let IoC_Hashes = pack_array("3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be", "818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7");
DeviceNetworkEvents
| where RemoteIP in (IoC_IPs) or RemoteUrl has_any("authorized-logins.net", "mueleer.com", "grande-luna.top")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort
| union (
    DeviceProcessEvents
    | where SHA256 in (IoC_Hashes) or ProcessCommandLine has_any("curl", "wget") and ProcessCommandLine has "api/dl"
    | project Timestamp, DeviceName, AccountName, FolderPath, SHA256, ProcessCommandLine
)

# IOC Hunt for Mistic, Hades, and Supply Chain Malware
# Checks for file presence and Hosts file modifications

$MaliciousHashes = @(
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be",
    "818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7",
    "881ce5cb124c4d2e814783724cc1388f6a1cbf6eee274c3f3366e77ba3503ad7"
)

$MaliciousDomains = @(
    "authorized-logins.net",
    "mueleer.com",
    "grande-luna.top",
    "laosji.net"
)

Write-Host "[+] Scanning for Malicious Files..." -ForegroundColor Cyan
$DrivesToScan = @("C:\")

foreach ($Hash in $MaliciousHashes) {
    $Result = Get-ChildItem -Path $DrivesToScan -Recurse -ErrorAction SilentlyContinue | 
              Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | 
              Where-Object { $_.Hash -eq $Hash }
    
    if ($Result) {
        Write-Host "[!] MALICIOUS FILE FOUND: " $Result.Path -ForegroundColor Red
    }
}

Write-Host "[+] Checking Hosts File for C2 Domains..." -ForegroundColor Cyan
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($Domain in $MaliciousDomains) {
        if ($HostsContent -match $Domain) {
            Write-Host "[!] SUSPICIOUS ENTRY IN HOSTS FILE: $Domain" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Scan Complete." -ForegroundColor Green