PolinRider Supply-Chain Infostealer, Clop LEMURLOOT Implant & Settra Ransomware: OTX Pulse Analysis — Credential Theft Detection Pack

---
title: PolinRider Malicious Package Install and C2 Beaconing
id: a1f3c8d2-9e4b-4c7a-b6d1-2026091801
status: experimental
description: Detects developer workstation credential access followed by egress to known PolinRider C2 infrastructure after package manager execution.
author: Security Arsenal Threat Intel
references:
  - https://socket.dev/blog/polinrider-github-packagist
logsource:
  category: network_connection
  product: windows
detection:
  selection_ip:
    DestinationIp:
      - 166.88.134.62
      - 23.27.13.135
      - 166.88.73.46
      - 193.247.144.38
  filter_tools:
    Image|endswith:
      - '\svchost.exe'
      - '\explorer.exe'
  condition: selection_ip and not filter_tools
fields:
  - Image
  - DestinationIp
  - DestinationPort
  - User
falsepositives:
  - Legitimate hosting providers on shared IP space
level: high
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1195.002
---
title: MeshAgent RMM Install as Persistence Mechanism (Settra Ransomware TTP)
id: b2e4d9f1-7a3c-4d8b-c5e2-2026091802
status: experimental
description: Detects installation or execution of MeshAgent RMM tooling, observed as Settra ransomware persistence. Tune to known-good RMM deployments.
author: Security Arsenal Threat Intel
references:
  - https://www.huntress.com/blog/new-settra-ransomware-variant
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\MeshAgent.exe'
      - '\meshagent.exe'
  selection_service:
    CommandLine|contains:
      - 'meshagent'
      - 'meshcentral'
  condition: selection_img or selection_service
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Organizations legitimately using MeshCentral for remote management
level: medium
tags:
  - attack.persistence
  - attack.t1219
  - attack.t1543.003
---
title: Clop LEMURLOOT Web Shell Activity on PTC Windchill Server
id: c3f5e0a2-8b4d-4e9c-d6f3-2026091803
status: experimental
description: Detects web server process spawning shells or database clients consistent with the Clop custom Windchill web shell implant (CVE-2026-12569).
author: Security Arsenal Threat Intel
references:
  - https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\java.exe'
      - '\javaw.exe'
      - '\tomcat.exe'
      - '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sqlcmd.exe'
      - '\whoami.exe'
      - '\net.exe'
  condition: selection_parent and selection_child
fields:
  - ParentImage
  - Image
  - CommandLine
  - User
falsepositives:
  - Application server maintenance scripts
level: critical
tags:
  - attack.execution
  - attack.t1505.003
  - attack.t1190

// Multi-pulse hunt: PolinRider C2, Settra MeshAgent persistence, Clop web shell, smishing DNS
let PolinRiderC2 = dynamic(["166.88.134.62","23.27.13.135","166.88.73.46","193.247.144.38"]);
let SettraC2 = dynamic(["193.5.65.114"]);
let SmishingDomains = dynamic(["t-mobile.biktpw.top","t-mobile.cugbjl.top","t-mobile.cymfjd.top","t-mobile.gdikxv.top","t-mobile.hdzcnb.top","t-mobile.koxetp.top","t-mobile.nxdcfp.top","t-mobile.pkrbai.top"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (PolinRiderC2) or RemoteIP in (SettraC2) or RemoteUrl has_any (SmishingDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort;
let RMMHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "MeshAgent.exe" or ProcessCommandLine has_any ("meshagent","meshcentral")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName;
let WebShellHits = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("java.exe","javaw.exe","tomcat.exe","w3wp.exe")
| where FileName in~ ("cmd.exe","powershell.exe","sqlcmd.exe","whoami.exe","net.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine;
union NetworkHits, RMMHits, WebShellHits
| sort by TimeGenerated desc

# PolinRider / Settra / Clop host-hunt script — run via EDR live response or GPO
title = "Security Arsenal IOC Hunt - 2026-09-18"
$report = @()

# 1. Check active/recent connections to known C2 IPs
$c2 = @("166.88.134.62","23.27.13.135","166.88.73.46","193.247.144.38","193.5.65.114")
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $c2 -contains $_.RemoteAddress }
foreach ($c in $conns) { $report += "[C2-CONN] PID $($c.OwningProcess) -> $($c.RemoteAddress):$($c.RemotePort) state=$($c.State)" }

# 2. MeshAgent persistence: services, scheduled tasks, install dirs
$svc = Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | Where-Object { $_.PathName -match "meshagent|meshcentral" }
foreach ($s in $svc) { $report += "[RMM-SVC] $($s.Name): $($s.PathName)" }
$tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.Actions.Execute -match "meshagent" }
foreach ($t in $tasks) { $report += "[RMM-TASK] $($t.TaskName)" }
foreach ($p in @("$env:ProgramFiles\Mesh Agent","$env:ProgramData\MeshAgent","C:\Program Files (x86)\Mesh Agent")) {
    if (Test-Path $p) { $report += "[RMM-DIR] $p exists" }
}

# 3. PolinRider package artifact hashes in node_modules / vendor / build caches
$hashes = @("7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9",
            "b7ede935d4979146b55f12b9eec7c83b61962b478f5dc9b8db251e539ec2abd3",
            "ccb187dc9de0cc7477c9817ae53365d273e121407c0305f863e2ab67c35d6395",
            "139ea03dcddf4aa810d55740be3cf6c92ce7a9f3cbcbbb35440e25b769a87683",
            "321e1fb01eb3462b48ff6ccdef132acc1182e3f7456548439f0d4ead12fd98bf")
$searchRoots = @("$env:USERPROFILE\source","$env:USERPROFILE\projects","D:\builds")
foreach ($root in $searchRoots) {
    if (Test-Path $root) {
        Get-ChildItem $root -Recurse -File -Include *.js,*.php,*.py,*.go -ErrorAction SilentlyContinue |
          ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($hashes -contains $h.ToLower()) { $report += "[MAL-HASH] $($_.FullName) sha256=$h" }
          }
    }
}

# 4. Web shell artifacts in common webroots (Windchill/Tomcat/IIS)
foreach ($wr in @("C:\inetpub\wwwroot","C:\Program Files\Apache Software Foundation","C:\ptc\Windchill")) {
    if (Test-Path $wr) {
        $recent = Get-ChildItem $wr -Recurse -Include *.jsp,*.jspx,*.aspx,*.war -ErrorAction SilentlyContinue |
                  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) }
        foreach ($f in $recent) { $report += "[WEB-NEW] $($f.FullName) modified $($f.LastWriteTime)" }
    }
}

# 5. DNS cache check for smishing domains
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match "t-mobile\..*\.top" }
foreach ($d in $dns) { $report += "[PHISH-DNS] $($d.Entry) -> $($d.Data)" }

if ($report.Count -eq 0) { "No hits. Host appears clean for 2026-09-18 IOC set." }
else { $report | Sort-Object }