title: Potential Malicious NuGet Package Execution
id: 6c1b3f2a-8e4c-4b2f-9a1d-1e5f6a7b8c9d
description: Detects execution of processes from potentially malicious NuGet package paths or known suspicious file paths associated with typosquatting campaigns.
status: experimental
date: 2026/05/09
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6c1b3f2a/
tags:
    - attack.supply_chain
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|contains: '\.nuget\packages\'
        Image|contains:
            - 'bmrxntfj'
    condition: selection
falsepositives:
    - Legitimate NuGet package usage
level: high
---
title: PCPJack Cloud Worm and Sliver C2 Activity
id: 7d2c4g3b-9f5d-5c3e-0b2e-2f6a7b8c9d0e
description: Detects network connections or process execution indicative of PCPJack worm activity or Sliver C2 framework usage in cloud environments.
status: experimental
date: 2026/05/09
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/7d2c4g3b/
tags:
    - attack.credential_access
    - attack.command_and_control
logsource:
    category: network_connection
    product: linux
detection:
    selection_sliver:
        DestinationPort:
            - 8888
            - 8080
        Image|endswith:
            - 'sliver'
            - 'client'
    selection_pcjack:
        DestinationHostname|contains:
            - 'lastpass-login-help.com'
            - 'git.justdotrip.com'
    condition: 1 of selection*
falsepositives:
    - Legitimate developer tools
level: critical
---
title: Remus Lumma Stealer Process Injection
id: 8e3d5h4c-0g6e-6d4f-1c3f-3g7b8c9d0e1f
description: Detects suspicious behavior associated with Remus (Lumma 64-bit) including unauthorized browser data access or known C2 domain connections.
status: experimental
date: 2026/05/09
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/8e3d5h4c/
tags:
    - attack.credential_access
    - attack.defense_evasion
logsource:
    category: network_connection
    product: windows
detection:
    selection_c2:
        DestinationHostname|contains:
            - 'forestoaker.com'
            - 'krondez.com'
            - 'baxe.pics'
            - 'remnane.biz'
    selection_suspicious_path:
        Image|contains: '\AppData\Local\Temp'
        DestinationPort: 443
    condition: 1 of selection*
falsepositives:
    - Standard web browsing
level: high

// Hunt for malicious domains and file hashes associated with Remus, PCPJack, and NuGet attacks
let MaliciousDomains = dynamic(["dns-providersa2.com", "forestoaker.com", "krondez.com", "baxe.pics", "vinte.online", "coox.live", "remnane.biz", "parky.pics", "lastpass-login-help.com", "git.justdotrip.com", "www.whatsappcenter.com"]);
let MaliciousHashes = dynamic(["efb675de4b3af3dac3c9cae91075fd7cc2f4f98e", "019e6c2cf58386039133981f3377b085fbd70c98ae8613c7c6a4f10a9f2d9824", "34e2d63b5db7e24c808711c2ca0c0a42afde97a0086d7d81609110c002d18d7c", "596c453c9dbb7240f1ce05cc025496524ce7c538c23a9b2171174bf32b5691a1", "b037fa1dd769891b538d9ca26131890c93e3458eec96c5354bdebe50d04a5b3d", "e41c635e4c3514e266d143d544ad1abde5db3dcfe6cccdf9bb7a218003f8ab6a", "6c6cbed6aad96564ed87094785be07a1", "197f11a7b0003aa7da58a330c2fa2a96a670de91d39ddebc7a51ac1d9404a7e6"]);
// Network Connections to C2
DeviceNetworkEvents
| where RemoteUrl in (MaliciousDomains) or RemoteIP in ("149.104.66.84")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| union (
    // File Creation/Execution of known malicious hashes
    DeviceFileEvents
    | where SHA256 in (MaliciousHashes) or MD5 in ("6c6cbed6aad96564ed87094785be07a1", "b8e7288656eca9750a5490aa96d3594b")
    | project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
)

# IOC Hunt Script for Remus, PCPJack, and NuGet Supply Chain Malware
# Requires Admin Privileges

$MaliciousSHA256 = @(
    "019e6c2cf58386039133981f3377b085fbd70c98ae8613c7c6a4f10a9f2d9824",
    "34e2d63b5db7e24c808711c2ca0c0a42afde97a0086d7d81609110c002d18d7c",
    "596c453c9dbb7240f1ce05cc025496524ce7c538c23a9b2171174bf32b5691a1",
    "b037fa1dd769891b538d9ca26131890c93e3458eec96c5354bdebe50d04a5b3d",
    "e41c635e4c3514e266d143d544ad1abde5db3dcfe6cccdf9bb7a218003f8ab6a",
    "197f11a7b0003aa7da58a330c2fa2a96a670de91d39ddebc7a51ac1d9404a7e6",
    "35af2cf5494181920b8624c7b719d39590e2a5ff5eaa1a2fa1ba86b2b5aa9b43"
)

$MaliciousMD5 = @(
    "6c6cbed6aad96564ed87094785be07a1",
    "b8e7288656eca9750a5490aa96d3594b"
)

Write-Host "[!] Starting hunt for malicious files..." -ForegroundColor Cyan

# Search C: Drive for matching hashes
$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($Drive in $Drives) {
    Write-Host "Scanning $Drive..." -ForegroundColor Yellow
    try {
        Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
            if ($MaliciousSHA256 -contains $Hash.Hash) {
                Write-Host "[MALICIOUS] SHA256 Match Found: $($_.FullName)" -ForegroundColor Red
            }
            
            $HashMD5 = Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue
            if ($MaliciousMD5 -contains $HashMD5.Hash) {
                Write-Host "[MALICIOUS] MD5 Match Found: $($_.FullName)" -ForegroundColor Red
            }
        }
    } catch {
        # Ignore access errors
    }
}

# Check for suspicious NuGet packages path (User profile)
$NugetPath = "$env:USERPROFILE\.nuget\packages"
if (Test-Path $NugetPath) {
    Write-Host "[!] Checking NuGet packages for 'bmrxntfj' author..." -ForegroundColor Cyan
    $SuspiciousPackages = Get-ChildItem -Path $NugetPath -Recurse -Filter "*.nuspec" | Select-String -Pattern "bmrxntfj"
    if ($SuspiciousPackages) {
        Write-Host "[!] Suspicious NuGet package found from 'bmrxntfj': $($SuspiciousPackages.Path)" -ForegroundColor Red
    }
}

Write-Host "Hunt Complete." -ForegroundColor Green


# Response Priorities

*   **Immediate**:
    *   Block all domains and IPs listed in the IOC Analysis at the firewall/proxy level.
    *   Scan all endpoints for the SHA256 and MD5 hashes associated with Remus, PCPJack, and the malicious NuGet packages.
    *   Identify and isolate any devices communicating with `forestoaker.com`, `krondez.com`, or `dns-providersa2.com`.
    *   Apply the PAN-OS patch for CVE-2023-33538 immediately to prevent RCE.

*   **24 Hours**:
    *   Initiate credential resets for developer and cloud accounts if code repositories (NuGet) or cloud clusters (Kubernetes) are suspected to be compromised.
    *   Review firewall logs for signs of successful exploitation on PAN-OS devices (look for EarthWorm or ReverseSocks5 processes).
    *   Audit recent NuGet package installs for typosquatting indicators.

*   **1 Week**:
    *   Implement stricter supply chain security policies for internal NuGet repositories (code signing requirements).
    *   Harden Kubernetes clusters against PCPJack (restrict pod-to-pod communication, scan images for Sliver binaries).
    *   Update EDR signatures to detect the Remus 64-bit variant and its EtherHiding C2 mechanism.