Red Heron 'Kapibala' WordPress Exploitation Wave + BUGSTER AI-Enabled Credential Theft: OTX Pulse Analysis — Enterprise Detection Pack

---
title: PHP Webshell Spawned From Web Server Process (Kapibala / Red Heron)
id: 8f3a2c1e-9d4b-4e7a-b6c1-kapibala0001
status: experimental
description: Detects suspicious child processes spawned by web server or PHP processes, consistent with PHP webshell command execution following WordPress exploitation as observed in the Red Heron Kapibala campaign.
author: Security Arsenal Threat Intelligence
references:
    - https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation
date: 2026/10/23
logsource:
    category: process_creation
    product: windows
    definition: windows_web
    service: null
detection:
    selection_parent:
        ParentImage|endswith:
            - '\httpd.exe'
            - '\php-cgi.exe'
            - '\php.exe'
            - '\w3wp.exe'
            - '\nginx.exe'
        ParentCommandLine|contains:
            - 'wordpress'
            - 'wp-content'
            - 'htdocs'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\whoami.exe'
            - '\certutil.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate WordPress plugin updates invoking system commands (rare)
level: high
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.execution
    - attack.t1059
---
title: Dirty Pipe CVE-2022-0847 Privilege Escalation Artifacts
id: 7b1e9f4a-2c8d-4a3f-9e2b-dirtpipe0002
status: experimental
description: Detects post-exploitation artifacts associated with CVE-2022-0847 (Dirty Pipe) privilege escalation as used by Red Heron to escalate from web server context to root following WordPress compromise.
author: Security Arsenal Threat Intelligence
date: 2026/10/23
logsource:
    category: process_creation
    product: linux
    service: auditd
detection:
    selection_execution:
        type: 'EXECVE'
        argc|contains:
            - '/usr/bin/passwd'
            - '/etc/passwd'
            - '/etc/shadow'
    selection_suid_mod:
        type: 'PATH'
        nametype: 'NORMAL'
        name|endswith:
            - '/usr/bin/su'
            - '/usr/bin/sudo'
            - '/usr/bin/passwd'
        mode|contains: '4755'
    selection_pipe_write:
        syscall: 'splice'
        success: 'yes'
    condition: 1 of selection_*
falsepositives:
    - Legitimate package management and SUID binary updates
level: critical
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2022.0847
---
title: AI-Generated Attack Script Execution Indicators (BUGSTER Profile)
id: 4c8d2f1a-6e3b-4d9c-a7f2-bugster0003
status: experimental
description: Detects execution patterns characteristic of AI-generated attack scripts — encoded/obfuscated script content with verbose AI-style commenting patterns and hardcoded target parameters, as observed in BUGSTER operations leveraging Hermes Agent with DeepSeek.
author: Security Arsenal Threat Intelligence
date: 2026/10/23
logsource:
    category: process_creation
    product: windows
detection:
    selection_download_cradle:
        CommandLine|contains:
            - 'DownloadString'
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'curl.exe http'
            - 'wget http'
    selection_target_params:
        CommandLine|contains:
            - '104.238.38.202'
            - '104.225.153.141'
            - 'exfil'
            - 'records'
            - 'dump'
    selection_encoded:
        CommandLine|contains:
            - ' -enc '
            - ' -ec '
            - 'FromBase64String'
    condition: selection_download_cradle and (selection_target_params or selection_encoded)
falsepositives:
    - Administrative automation scripts downloading tooling
    - Software deployment frameworks
level: medium
tags:
    - attack.execution
    - attack.t1059.001
    - attack.command_and_control
    - attack.t1071.001

// Red Heron (Kapibala) + BUGSTER infrastructure hunt — retro and real-time
// Lookback extended to campaign start (May 2026) for Red Heron retro-hunting
let ThreatIPs = dynamic(["104.225.153.141", "104.238.38.202"]);
let LookbackStart = datetime(2026-05-01);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated >= LookbackStart
    | where RemoteIP in (ThreatIPs)
    | project TimeGenerated, DeviceName, InitiatingProcessName, InitiatingProcessCommandLine,
              RemoteIP, RemotePort, RemoteUrl, ActionType, Source = "DeviceNetworkEvents"),
    (CommonSecurityLog
    | where TimeGenerated >= LookbackStart
    | where DestinationIP in (ThreatIPs) or SourceIP in (ThreatIPs)
    | project TimeGenerated, DeviceName = DeviceName, InitiatingProcessName = ApplicationProtocol,
              InitiatingProcessCommandLine = "", RemoteIP = DestinationIP,
              RemotePort = DestinationPort, RemoteUrl = RequestURL, ActionType = DeviceAction,
              Source = "Firewall/Proxy"),
    (SigninLogs
    | where TimeGenerated >= LookbackStart
    | where IPAddress in (ThreatIPs)
    | project TimeGenerated, DeviceName = UserPrincipalName, InitiatingProcessName = AppDisplayName,
              InitiatingProcessCommandLine = "", RemoteIP = IPAddress, RemotePort = 0,
              RemoteUrl = "", ActionType = Status, Source = "SigninLogs")
| sort by TimeGenerated asc
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            HitCount = count(), Sources = make_set(Source),
            Processes = make_set(InitiatingProcessName)
            by DeviceName, RemoteIP
| extend Verdict = case(
    HitCount > 100, "Likely bulk exfiltration — escalate to IR",
    FirstSeen < datetime(2026-10-01), "Historical compromise window — full host triage required",
    "Investigate — confirm business justification");
// Secondary hunt: webshell-style process lineage on web-tier hosts
DeviceProcessEvents
| where TimeGenerated > ago(180d)
| where InitiatingProcessFileName has_any ("httpd", "nginx", "php", "w3wp", "apache")
| where FileName in~ ("cmd.exe", "powershell.exe", "whoami.exe", "net.exe", "bash", "sh", "curl", "wget")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| order by TimeGenerated desc;

# Security Arsenal — Red Heron / BUGSTER IOC & Artifact Hunt
# Run elevated on web-tier and Linux-adjacent Windows hosts; adapt paths for your CMS layout.

$ThreatIPs = @("104.225.153.141", "104.238.38.202")
$Report = @{ Host = $env:COMPUTERNAME; Timestamp = (Get-Date -Format o); Findings = @() }

# 1. Active and historical network connections to threat infrastructure
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $ThreatIPs -contains $_.RemoteAddress }
if ($conns) { $Report.Findings += "[CRITICAL] Active connection to threat IP: $($conns | Out-String)" }

# 2. DNS cache evidence
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Data -match "104.225.153.141|104.238.38.202" }
if ($dns) { $Report.Findings += "[HIGH] DNS cache hit for threat infrastructure: $($dns | Out-String)" }

# 3. Webshell sweep — PHP files in WordPress upload/theme dirs modified recently or containing classic webshell functions
$wpPaths = @("C:\inetpub\wwwroot\wp-content\uploads", "C:\inetpub\wwwroot\wp-content\themes", "D:\websites\*\wp-content\uploads")
$shellPatterns = "eval\(","assert\(","base64_decode","gzinflate","shell_exec","passthru","system\(","preg_replace.*\/e"
foreach ($p in $wpPaths) {
    Get-ChildItem -Path $p -Recurse -Filter *.php -ErrorAction SilentlyContinue | ForEach-Object {
        $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
        if ($content -match ($shellPatterns -join "|")) {
            $Report.Findings += "[CRITICAL] Suspected webshell: $($_.FullName) (Modified: $($_.LastWriteTime))"
        }
    }
}

# 4. WordPress credential file exposure — check wp-config.php for unexpected access timestamps
Get-ChildItem -Path "C:\inetpub\wwwroot\wp-config.php","D:\websites\*\wp-config.php" -ErrorAction SilentlyContinue | ForEach-Object {
    if ($_.LastAccessTime -gt (Get-Date).AddDays(-30) -and $_.LastAccessTime -ne $_.LastWriteTime) {
        $Report.Findings += "[HIGH] wp-config.php recently accessed without modification — possible credential harvesting: $($_.FullName)"
    }
}

# 5. Rogue scheduled tasks / persistence
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match "powershell|cmd|certutil|mshta" -and
    $_.Actions.Arguments -match "104.225.153.141|104.238.38.202|base64|-enc"
} | ForEach-Object { $Report.Findings += "[CRITICAL] Suspicious scheduled task: $($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" }

# 6. Rogue local admin accounts (post-Dirty-Pipe / post-exploitation persistence)
Get-LocalGroupMember -Group "Administrators" -ErrorAction SilentlyContinue | Where-Object {
    $_.Name -notmatch "Administrator|Domain Admins|Enterprise Admins"
} | ForEach-Object { $Report.Findings += "[MEDIUM] Non-standard admin account: $($_.Name)" }

if ($Report.Findings.Count -eq 0) { $Report.Findings += "[CLEAN] No indicators found" }
$Report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\otx_hunt_$env:COMPUTERNAME.json"
$Report.Findings | ForEach-Object { Write-Output $_ }