SectopRAT & StealC: Claude AI Malvertising and Supply Chain CRM Theft

---
title: Potential SectopRAT/StealC C2 Traffic
description: Detects network connections to known malicious IP addresses associated with the FakeAgent SectopRAT campaign (Frantech/QuickPacket).
references:
  - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/07/23
status: stable
logsource:
  product: zeek
  service: conn
detection:
  selection:
    id.resp_h:
      - '104.194.133.210'
      - '107.189.24.67'
      - '107.189.26.86'
      - '107.189.21.86'
      - '45.59.124.17'
      - '107.189.17.143'
      - '45.59.125.228'
      - '45.59.122.134'
  condition: selection
falsepositives:
  - Legitimate traffic to these IPs (unlikely given hosting provider)
level: high
tags:
  - attack.command_and_control
  - attack.t1071
---
title: Suspicious Browser Spawned Process (Malvertising)
description: Detects suspicious processes spawned by browsers, commonly associated with malvertising droppers executing payloads.
references:
  - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/07/23
status: stable
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\brave.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter:
    CommandLine|contains:
      - 'Code --enable-features' # Filter legitimate VS Code usage if applicable
      - 'C:\Program Files'
  condition: selection and not filter
falsepositives:
  - Administrators launching tools from browser downloads
level: medium
tags:
  - attack.initial_access
  - attack.t1204
---
title: Suspicious Salesforce Access via OAuth
author: Security Arsenal
description: Detects potential unauthorized access to Salesforce CRM leveraging OAuth tokens, often seen in supply chain compromises.
references:
  - https://otx.alienvault.com/
date: 2026/07/23
status: experimental
logsource:
  product: azure
  service: auditlogs
detection:
  selection:
    LoggedByService: 'Salesforce'
    OperationName|contains:
      - 'Add delegated permissions grant'
      - 'Add member to role'
      - 'Update application'
  condition: selection
falsepositives:
  - legitimate admin configuration
level: medium
tags:
  - attack.credential_access
  - attack.t1552

// Hunt for connections to SectopRAT/StealC C2 Infrastructure
DeviceNetworkEvents
| where RemoteIP in ("104.194.133.210", "107.189.24.67", "107.189.26.86", "107.189.21.86", "45.59.124.17", "107.189.17.143", "45.59.125.228", "45.59.122.134")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteIP, RemotePort
| extend Info = "C2 Connection Detected"

// Hunt for browser spawned suspicious processes (Malvertising context)
DeviceProcessEvents
| where InitiatingProcessFileName in ("chrome.exe", "msedge.exe", "firefox.exe")
| where FileName in ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend Info = "Suspicious Browser Spawn"

# IOC Hunter: SectopRAT/StealC Campaign
# Checks for active network connections to known malicious IPs

$maliciousIPs = @(
    "104.194.133.210",
    "107.189.24.67",
    "107.189.26.86",
    "107.189.21.86",
    "45.59.124.17",
    "107.189.17.143",
    "45.59.125.228",
    "45.59.122.134"
)

Write-Host "Checking for active network connections to known C2 IPs..." -ForegroundColor Yellow

$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

foreach ($conn in $connections) {
    $remoteIP = $conn.RemoteAddress
    if ($maliciousIPs -contains $remoteIP) {
        $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[ALERT] Connection to $remoteIP found!" -ForegroundColor Red
        Write-Host "   Local Address: $($conn.LocalAddress):$($conn.LocalPort)"
        Write-Host "   Process: $($process.ProcessName) (PID: $($conn.OwningProcess))"
        Write-Host "   Path: $($process.Path)"
    }
}

Write-Host "Check complete."