Qubole Cross-Account AWS Breach & Contagious Interview npm Poisoning: OTX Pulse Analysis — Cloud + Supply Chain Detection Pack

---
title: Qubole Cross-Account IAM Role Assumption From Suspicious VPN
id: 1f3a8b2e-9c4d-4e6f-9a1b-3e5f7a9c2d1e
status: experimental
description: Detects AWS AssumeRole calls originating from known Qubole breach VPN IPs or unusual geographies for the Qubole integration role.
logsource:
  product: aws
  service: cloudtrail
  category: iam
detection:
  selection:
    eventSource: iam.amazonaws.com
    eventName: AssumeRole
    sourceIPAddress:
      - '45.83.220.211'
      - '57.129.54.120'
      - '185.209.199.73'
      - '89.37.63.175'
  condition: selection
falsepositives:
  - Qubole support engineers using VPN (verify with change management)
level: high
tags:
  - attack.t1078
  - attack.t1550
  - attack.t1098
---
title: Malicious npm Post-Install Script Execution - Contagious Interview
id: 4c7d9e1a-5b3f-4a8e-8c6d-2e1f9b7a4c8d
status: experimental
description: Detects execution of suspicious npm post-install scripts or child processes spawned by node/npm that match Contagious Interview TTPs.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npm.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wget.exe'
    CommandLine|contains:
      - 'camera-driver'
      - 'notification-settings'
      - 'accurasofthire'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build scripts (rarely spawn network tools)
level: critical
tags:
  - attack.t1195
  - attack.t1059
  - attack.t1071
---
title: Contagious Interview C2 Communication - BeaverTail / InvisibleFerret
id: 8e2f6a9c-1d3b-4e5f-9a7c-6b8d1e3f5a2c
status: experimental
description: Detects DNS or HTTPS requests to AccuraSoftHire C2 infrastructure or fallback IP.
logsource:
  category: dns
detection:
  selection_domain:
    query|contains:
      - 'accurasofthire.com'
  selection_ip:
    answer|contains:
      - '103.179.142.155'
  condition: selection_domain or selection_ip
falsepositives:
  - Security researchers investigating domain (allowlist SOC IPs)
level: high
tags:
  - attack.t1071.001
  - attack.t1102

let QuboleVPNIPs = dynamic(["45.83.220.211","57.129.54.120","185.209.199.73","89.37.63.175"]);
let InterviewC2 = dynamic(["accurasofthire.com","103.179.142.155"]);
// Hunt 1: AWS API calls from Qubole breach VPNs (requires AWS CloudTrail ingestion)
CloudTrail
| where SourceIP in (QuboleVPNIPs)
| where EventName in ("AssumeRole","ListBuckets","GetObject","DescribeDBInstances")
| summarize Count=count() by SourceIP, UserIdentityArn, EventName, bin(TimeGenerated, 1h)
| order by Count desc;
// Hunt 2: Network connections to Contagious Interview C2
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (InterviewC2) or RemoteIP == "103.179.142.155"
| where InitiatingProcessFileName in~ ("node.exe","npm.exe","python.exe","powershell.exe")
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessCommandLine, FileHash = InitiatingProcessSHA256;
// Hunt 3: Malicious file hash execution
DeviceProcessEvents
| where SHA256 in ("65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4")
   or MD5 in ("086d4a83181971e883c53a4c44f46da2")
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, AccountName;

# Security Arsenal — Contagious Interview + Qubole Artifact Hunt
# Run as Administrator on developer workstations & build servers
$ErrorActionPreference = 'SilentlyContinue'
Write-Host "[+] Starting hunt for Contagious Interview & Qubole abuse artifacts..." -ForegroundColor Cyan

# 1. Check for persistence in Registry Run keys
$RunKeys = @(
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($Key in $RunKeys) {
    Get-ItemProperty $Key | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Name -notlike 'PS*' -and
            ($_.Value -match 'CameraHelper|npm|node|accurasoft')
        } | Select-Object @{N='Key';E={$Key}}, Name, Value
    }
}

# 2. Hunt for malicious file hashes in common staging dirs
$MaliciousHashes = @{
    'MD5'    = '086d4a83181971e883c53a4c44f46da2'
    'SHA1'   = '1c7437dac21630f53c0b888b50662c6487e23fd7'
    'SHA256' = '65f061281c9a712e9502793dc4c5035cae490b84da05f7d4223cefa65ad396e4'
}
$SearchPaths = @("$env:TEMP","$env:APPDATA\npm-cache","$env:LOCALAPPDATA\Temp","C:\Windows\Temp")
foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Get-ChildItem $Path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $File = $_
            foreach ($Algo in $MaliciousHashes.Keys) {
                $Hash = (Get-FileHash $File.FullName -Algorithm $Algo).Hash
                if ($Hash -eq $MaliciousHashes[$Algo]) {
                    Write-Warning "[!] Malicious file detected: $($File.FullName) [$Algo]"
                    $File | Select-Object FullName, Length, LastWriteTime
                }
            }
        }
    }
}

# 3. Check active network connections to C2 IPs
$C2IPs = @('103.179.142.155','45.83.220.211','57.129.54.120','185.209.199.73','89.37.63.175')
Get-NetTCPConnection | Where-Object {$_.RemoteAddress -in $C2IPs} | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess,@{N='ProcessName';E={(Get-Process -Id $_.OwningProcess).ProcessName}}

# 4. Scan npm global cache for suspicious packages
$NpmCache = "$env:APPDATA\npm-cache"
if (Test-Path $NpmCache) {
    Get-ChildItem $NpmCache -Recurse -Filter package.json | ForEach-Object {
        $Content = Get-Content $_.FullName -Raw
        if ($Content -match 'postinstall|preinstall' -and $Content -match 'camera-driver|accurasoft') {
            Write-Warning "[!] Suspicious npm package: $($_.Directory.Name)"
        }
    }
}
Write-Host "[+] Hunt complete. Review warnings above and isolate affected hosts." -ForegroundColor Green