SilabRAT MaaS & Storm-3075 AI Phishing: OTX Pulse Analysis — Enterprise Detection Pack

title: Potential SilabRAT or Stealer Browser Data Access
id: 52c7a3e8-8842-4b1e-9e3f-a9b1c2d3e4f5
description: Detects suspicious processes accessing browser credential databases, common to Vidar, Lumma, and SilabRAT.
status: experimental
date: 2026/06/12
author: Security Arsenal
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\AppData\Local\Google\Chrome\User Data\Default\Login Data'
            - '\AppData\Local\Microsoft\Edge\User Data\Default\Login Data'
            - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
            - '\AppData\Local\Opera Software\Opera Stable\Login Data'
    filter:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\opera.exe'
    condition: selection and not filter
falsepositives:
    - Legitimate backup software
    - Password managers
level: high
tags:
    - attack.credential_access
    - attack.t1003
    - malware.storm-3075
    - malware.silabrat
---
title: ProxyShell Webshell Activity Indicator
description: Detects the creation or access of fd.aspx web shells associated with 4BID hacktivist ProxyShell exploitation.
id: 88a1b2c3-d4e5-4f6a-9b8c-1d2e3f4a5b6c
status: experimental
date: 2026/06/12
author: Security Arsenal
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5140
        ShareName|contains: 'C$\inetpub\wwwroot'
        RelativeTargetName|contains: 'fd.aspx'
    condition: selection
falsepositives:
    - Administrative file maintenance
level: critical
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2023.44976
    - actor.4bid
---
title: Hijack Loader Shellcode Execution Pattern
description: Detects process hollowing or suspicious rundll32 execution patterns typical of Hijack Loader used by Storm-3075.
id: 99b2c3d4-e5f6-4a7b-8c9d-2e3f4a5b6c7d
status: experimental
date: 2026/06/12
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
        CommandLine|contains:
            - 'javascript:'
            - 'SetupAPI'
    condition: selection
falsepositives:
    - Rare administrative scripts
level: medium
tags:
    - attack.defense_evasion
    - attack.t1055
    - malware.hijack-loader

// Hunt for SilabRAT and 4BID Network IOCs
let IOCs = pack_array("91.199.163.124", "185.221.153.121", "45.112.194.82", "138.226.236.52");
DeviceNetworkEvents
| where RemoteIP in (IOCs) or RemoteUrl has "brokeapt.com"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, Action
| extend ThreatIntel = "OTX Pulse Match: SilabRAT or 4BID"

<#
.SYNOPSIS
    Hunts for SilabRAT, Vidar, and 4BID artifacts on endpoints.
.DESCRIPTION
    Checks for specific file hashes, malicious IP connections, and ProxyShell webshell artifacts.
#>

$MaliciousHashes = @(
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623"
)

$MaliciousIPs = @("91.199.163.124", "185.221.153.121", "45.112.194.82")

Write-Host "[*] Scanning for known malicious file hashes..." -ForegroundColor Cyan
$PathsToScan = @("$env:TEMP", "$env:USERPROFILE\Downloads", "C:\ProgramData")

foreach ($path in $PathsToScan) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[*] Checking for active network connections to SilabRAT/4BID IPs..." -ForegroundColor Cyan
$connections = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.State -eq 'Established' }
foreach ($ip in $MaliciousIPs) {
    $match = $connections | Where-Object { $_.RemoteAddress -eq $ip }
    if ($match) {
        Write-Host "[!] ALERT: Active connection to $ip detected (PID: $($match.OwningProcess))" -ForegroundColor Red
        Get-Process -Id $match.OwningProcess | Select-Object ProcessName, Path
    }
}

Write-Host "[*] Scanning IIS directories for fd.aspx webshell..." -ForegroundColor Cyan
$inetpub = "C:\inetpub\wwwroot"
if (Test-Path $inetpub) {
    Get-ChildItem -Path $inetpub -Recurse -Filter "fd.aspx" -ErrorAction SilentlyContinue | ForEach-Object {
        Write-Host "[!] WEB SHELL INDICATOR FOUND: $($_.FullName)" -ForegroundColor Red
    }
}