Rise of AI-Themed Credential Theft & Sophisticated Infostealers: Gremlin, Lumma, SilabRAT Analysis — Enterprise Detection Pack

---
title: Potential Gremlin Stealer Execution via Resource Access
id: 42f8c1c2-1e0b-4b3a-8f9d-1a2b3c4d5e6f
description: Detects suspicious processes accessing resources in other executables, a technique used by Gremlin Stealer to hide payloads.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/
tags:
    - attack.defense_evasion
    - attack.t1027
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\rundll32.exe'
            - '\powershell.exe'
            - '\cmd.exe'
            - '\regsvr32.exe'
    filter_legit:
        CommandLine|contains:
            - 'windows'
            - 'system32'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate software installers
level: high
---
title: AI-Themed Malware Distribution Suspicious Process Chain
id: 51f9d2d3-2f1c-5c4b-0g0e-2b3c4d5e6f7a
description: Detects process chains often associated with malvertising leading to AI-themed malware drops, involving specific loaders like HijackLoader.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/
tags:
    - attack.initial_access
    - attack.t1566
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        Image|endswith:
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
    selection_keyword:
        CommandLine|contains:
            - 'ChatGPT'
            - 'DeepSeek'
            - 'Claude'
            - 'AI'
            - 'Copilot'
    condition: all of selection_*
falsepositives:
    - Legitimate AI software installation (rare via these vectors)
level: critical
---
title: SilabRAT HVNC or Browser Profile Cloning Activity
id: 62g0e3e4-3g2d-6d5c-1h0f-3c4d5e6f7g8b
description: Detects potential Remote Access Trojan activity associated with browser profile cloning or HVNC used by SilabRAT.
status: experimental
date: 2026/06/15
author: Security Arsenal
references:
    - https://otx.alienvault.com/
tags:
    - attack.credential_access
    - attack.t1056
    - attack.t1219
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Run'
            - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
        Details|contains:
            - '-hvnc'
            - '-clone'
            - 'browser'
    condition: selection
falsepositives:
    - Unknown
level: high

// Hunt for AI-themed malvertising and potential Stealer execution
// Focus on processes spawned by common scripting hosts or downloaders
letSuspiciousProcesses = materialize(
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName in~ ("mshta.exe", "wscript.exe", "cscript.exe", "powershell.exe", "cmd.exe", "regsvr32.exe")
    | where ProcessCommandLine has_any ("ChatGPT", "DeepSeek", "Claude", "Copilot", "AI", "discord", "telegram", "steam") 
    | project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, SHA256
);
// Correlate with network connections to known C2 infrastructure or suspicious domains
let NetworkConnections = 
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where RemoteUrl in~ ("brokeapt.com", "rongtv.xyz", "ssffaa19.xyz") or RemoteIP == "91.199.163.124"
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessSHA256;
// Join process creation with network connections
SuspiciousProcesses
| join kind=inner (NetworkConnections) on $left.DeviceName == $right.DeviceName
| project Timestamp, DeviceName, AccountName, ProcessFileName, ProcessCommandLine, SHA256, RemoteUrl, RemoteIP
| order by Timestamp desc

# SilabRAT & Stealer IOC Hunt Script
# Scans for file presence, suspicious registry run keys, and network connections

Write-Host "Starting SilabRAT & Stealer IOC Hunt..." -ForegroundColor Cyan

# 1. Check for specific File Hashes (Gremlin Stealer, SilabRAT samples)
$TargetHashes = @(
    "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "79f8da9f9fb4ac7c16d9c210f1f6ef418357a3e7bf602b1dd03a490596fa58c5",
    "fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623",
    "fbce30a0c852972fdc24f1b6a7c270512a50ef1a7c6c88c88b92a2dcbdfdd023"
)

$FoundFiles = @()
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    if ($_.Length -gt 0) {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hash -in $TargetHashes) {
            $FoundFiles += $_.FullName
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) (Hash: $hash)" -ForegroundColor Red
        }
    }
}

if ($FoundFiles.Count -eq 0) { Write-Host "No files with known malicious hashes found." -ForegroundColor Green }

# 2. Check for suspicious persistence in Registry (Run keys for SilabRAT/Stealers)
$RunPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

Write-Host "Checking Registry Run Keys for suspicious persistence..." -ForegroundColor Cyan
foreach ($Path in $RunPaths) {
    if (Test-Path $Path) {
        Get-Item -Path $Path -ErrorAction SilentlyContinue | ForEach-Object {
            $_.Property | ForEach-Object {
                $Value = (Get-ItemProperty -Path $Path -ErrorAction SilentlyContinue).$_
                # Basic heuristics for suspicious entries (e.g., powershell, cmd, obscure paths)
                if ($Value -match "powershell|cmd.exe|/c| -enc| -w hidden|discord|steam|telegram") {
                    Write-Host "[!] SUSPICIOUS REGISTRY VALUE: $Path - Property: $_ - Value: $Value" -ForegroundColor Yellow
                }
            }
        }
    }
}

# 3. Check for active network connections to known bad IPs/domains
$BadDomains = @("brokeapt.com", "rongtv.xyz", "ssffaa19.xyz")
$BadIP = "91.199.163.124"

Write-Host "Checking active network connections to known C2 infrastructure..." -ForegroundColor Cyan
$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | 
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess

foreach ($Conn in $Connections) {
    $ProcessName = (Get-Process -Id $Conn.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $RemoteHostName = Resolve-DnsName -Name $Conn.RemoteAddress -DnsOnly -ErrorAction SilentlyContinue | Select-Object -ExpandProperty NameHost -ErrorAction SilentlyContinue
    
    if ($BadDomains -contains $RemoteHostName -or $Conn.RemoteAddress -eq $BadIP) {
        Write-Host "[!] C2 CONNECTION DETECTED: Remote IP: $($Conn.RemoteAddress) ($RemoteHostName), Process: $ProcessName" -ForegroundColor Red
    }
}

Write-Host "Hunt complete." -ForegroundColor Cyan