title: Potential Malicious NuGet Supply Chain Execution
id: c9f89b21-7a3b-4c9d-9e1f-1234567890ab
description: Detects suspicious child processes spawned by NuGet or development tools, indicative of malicious package execution such as the Quantum or AgentRacoon campaigns.
status: experimental
date: 2026/05/12
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66012a12b45f78
tags:
    - attack.supply_chain
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\nuget.exe'
            - '\msbuild.exe'
            - '\devenv.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\csc.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate build scripts invoking command line tools
level: high
---
title: Suspicious AutoIt Loader Leading to Vidar Stealer
id: a1b2c3d4-5678-90ef-ghij-klmnopqrstuv
description: Detects AutoIt execution chains often associated with Vidar/Arkei stealers, specifically looking for MicrosoftToolkit or similar crack tools spawning shells.
status: experimental
date: 2026/05/12
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66012a12b45f80
tags:
    - attack.defense_evasion
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\autoit3.exe'
    selection_cmd:
        CommandLine|contains:
            - '.bat'
            - '.cmd'
    selection_parent:
        ParentImage|contains:
            - 'MicrosoftToolkit'
            - 'KMSpico'
    selection_suspicious_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
    condition: 1 of selection*
falsepositives:
    - Legitimate AutoIt scripts used by IT admins
level: medium
---
title: Suspicious Cloudflare Tunnel C2 Activity
id: e5f6g7h8-9012-34ij-klmn-opqrstuvwxy
description: Detects processes establishing network connections to suspicious Cloudflare tunnel domains often used by EtherRat and TukTuk for C2 communication.
status: experimental
date: 2026/05/12
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66012a12b45f78
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection_domains:
        DestinationHostname|endswith:
            - '.trycloudflare.com'
            - 'g8way.io'
    selection_process:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\mshta.exe'
            - '\wscript.exe'
    condition: selection_domains and selection_process
falsepositives:
    - Legitimate developer usage of Cloudflare tunnels
level: high


kql
// Hunt for connections to known C2 domains and IPs from OTX Pulses
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in (
    "dns-providersa2.com",
    "g8way.io",
    "git.justdotrip.com",
    "wrned.com",
    "wpsock.com"
    )
    or RemoteIP in (
    "89.169.12.241",
    "213.176.73.80",
    "213.176.73.130",
    "217.119.129.121",
    "94.156.154.6"
    )
| summarize count(), Timestamp=arg_max(Timestamp, *) by DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine


powershell
# IOC Hunt Script for Malicious File Hashes
$targetHashes = @(
    "efb675de4b3af3dac3c9cae91075fd7cc2f4f98e",
    "019e6c2cf58386039133981f3377b085fbd70c98ae8613c7c6a4f10a9f2d9824",
    "34e2d63b5db7e24c808711c2ca0c0a42afde97a0086d7d81609110c002d18d7c",
    "596c453c9dbb7240f1ce05cc025496524ce7c538c23a9b2171174bf32b5691a1",
    "73ce2438d4ed475e03727b7b000d2794", # MD5 for EtherRat MSI
    "02a5990b11293236e01f174f5999df20"  # MD5 for Mr_Rot13 Payload
)

$pathsToScan = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp")

Write-Host "Starting IOC Hunt for Infostealer Hashes..." -ForegroundColor Cyan

foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        Write-Host "Scanning $path..." -ForegroundColor Yellow
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $fileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($targetHashes -contains $fileHash) {
                Write-Host "[!] MATCH FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}
Write-Host "Hunt Complete." -ForegroundColor Green


# Response Priorities

*   **Immediate:** Block all identified IPv4 addresses and domains at the firewall and proxy. Terminate any processes matching the malicious file hashes (MD5/SHA256).
*   **24h:** Conduct an audit of developer workstations for the presence of the identified NuGet packages (`bmrxntfj` account) and suspicious GitHub clones. If credential theft is confirmed (Vidar/Lumma), force a password reset for affected accounts and invalidate session tokens.
*   **1 Week:** Patch cPanel servers against CVE-2026-41940. Implement strict allow-listing for NuGet package sources and GitHub repository access. Review EDR alerts for AutoIT and LuaJIT execution context.