SmartLoader NodeJS Infostealer + SecFlow AI-Orchestrated Intrusions: OTX Pulse Analysis — Enterprise Detection Pack

---
title: SmartLoader NodeJS Infostealer Execution via Script Interpreter
id: 7a3f1c2e-9b4d-4e6a-8c1f-2d5b7a9e3f01
status: experimental
description: Detects NodeJS infostealer execution patterns where node.exe, wscript.exe, or cscript.exe run obfuscated JavaScript from user-writable or temp paths, consistent with SmartLoader two-stage delivery from weaponized GitHub repos.
author: Security Arsenal Threat Intelligence
references:
    - https://www.netskope.com/blog/developers-in-the-crosshairs-fake-ai-tools-deliver-infostealer
date: 2026/09/04
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\node.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    selection_cli:
        CommandLine|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Users\Public\'
            - '\ProgramData\'
    selection_ext:
        CommandLine|contains:
            - '.js'
            - '.jse'
            - '.lua'
    filter_git:
        CommandLine|contains:
            - 'node_modules'
            - 'npm'
            - '\Program Files\nodejs\'
    condition: selection_img and selection_cli and selection_ext and not filter_git
falsepositives:
    - Legitimate NodeJS development workflows running scripts from temp paths
level: high
tags:
    - attack.execution
    - attack.t1059.007
    - attack.t1027
---
title: Etherhiding Blockchain C2 and Known SmartLoader Infrastructure
id: 8b4e2d3f-0c5e-5f7b-9d2e-3e6c8b0f4e12
status: experimental
description: Detects DNS/network connections to known SmartLoader/NodeJS infostealer C2 (reviewassignment.in), Tor .onion resolution attempts, and public blockchain RPC endpoints abused for etherhiding C2 config retrieval.
author: Security Arsenal Threat Intelligence
date: 2026/09/04
logsource:
    category: dns
    product: windows
detection:
    selection_c2:
        query|contains:
            - 'reviewassignment.in'
    selection_onion:
        query|endswith: '.onion'
    selection_chain_rpc:
        query|contains:
            - 'eth-mainnet'
            - 'bsc-dataseed'
            - 'mainnet.infura.io'
            - 'rpc.ankr.com'
    condition: selection_c2 or selection_onion or selection_chain_rpc
falsepositives:
    - Legitimate Web3/blockchain development (chain RPC selection) - baseline developer hosts and exclude
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1090.003
---
title: GLUTTON Webshell Deployment and Exploitation of SecFlow CVE Set
id: 9c5f3e4a-1d6f-6a8c-0e3f-4f7d9c1a5f23
status: experimental
description: Detects web server processes spawning shells or writing script files to webroot directories, consistent with GLUTTON webshell deployment following exploitation of Struts/Log4Shell/Spring4Shell/Ghostcat in the SecFlow campaign.
author: Security Arsenal Threat Intelligence
references:
    - https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia
date: 2026/09/04
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains:
            - '\tomcat'
            - '\java.exe'
            - '\w3wp.exe'
            - 'nginx'
            - 'httpd'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\certutil.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Rare legitimate application server management scripts
level: critical
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.initial_access
    - attack.t1190

// Hunt: SmartLoader/NodeJS infostealer + SecFlow webshell behaviors (7-day lookback)
let lookback = 7d;
// Part 1: Known C2 + suspicious script-interpreter network activity
let NetHunt = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has_any ("reviewassignment.in")
   or RemoteUrl endswith ".onion"
   or (InitiatingProcessFileName in~ ("node.exe","wscript.exe","cscript.exe")
       and InitiatingProcessCommandLine has_any ("\\Temp\\","\\Roaming\\","\\Public\\"));
// Part 2: Script interpreter executing obfuscated JS/Lua from user-writable paths
let ProcHunt = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("node.exe","wscript.exe","cscript.exe")
| where ProcessCommandLine has_any ("\\AppData\\Local\\Temp\\","\\Users\\Public\\","\\AppData\\Roaming\\")
| where ProcessCommandLine has_any (".js",".jse",".lua")
| where ProcessCommandLine !has_any ("node_modules","npm","yarn","pnpm");
// Part 3: Web server spawning shells (GLUTTON webshell indicator)
let WebshellHunt = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where InitiatingProcessFileName has_any ("tomcat","java","w3wp","nginx","httpd")
| where FileName in~ ("cmd.exe","powershell.exe","wscript.exe","net.exe","whoami.exe","certutil.exe");
NetHunt
| union ProcHunt, WebshellHunt
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP, InitiatingProcessFileName
| order by TimeGenerated desc

# SmartLoader / NodeJS Infostealer + GLUTTON Webshell Host Hunt
# Run elevated on suspect endpoints. Outputs findings to console + CSV.
$findings = @()

# 1) Persistence: Run keys invoking script interpreters from user paths
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
             "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).$($_.Name)
            if ($val -match "node\.exe|wscript\.exe|cscript\.exe" -and $val -match "AppData|Public|Temp") {
                $findings += [PSCustomObject]@{Type="RunKey Persistence"; Path=$key; Detail="$($_.Name) = $val"}
            }
        }
    }
}

# 2) Scheduled tasks running JS/Lua via script interpreters
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match "node\.exe|wscript\.exe|cscript\.exe" -and $actions -match "\.js|\.jse|\.lua") {
        $findings += [PSCustomObject]@{Type="Scheduled Task"; Path=$_.TaskPath + $_.TaskName; Detail=$actions.Trim()}
    }
}

# 3) Rogue NodeJS runtimes / JS payloads in user-writable dirs
$searchPaths = @("$env:TEMP","$env:APPDATA","C:\Users\Public","C:\ProgramData")
foreach ($p in $searchPaths) {
    Get-ChildItem $p -Recurse -Include node.exe,*.jse,*.lua -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-45) } |
        ForEach-Object { $findings += [PSCustomObject]@{Type="Suspicious File"; Path=$_.FullName; Detail="Modified $($_.LastWriteTime)"} }
}

# 4) Known infostealer sample hashes (OTX pulse)
$badHashes = @("673570abcb54b368b9521bdff8f331d4","6f2e3a9ec6914209bf85be0677aadf9e",
               "82e81158366a953c33d0720dfe34b95b","ab5cdef0cde09c4bb0cab33ab0d2f92e",
               "c2a7f19ba96dc460d591d37d664fe6aa")
foreach ($p in $searchPaths) {
    Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($badHashes -contains $h.ToLower()) {
            $findings += [PSCustomObject]@{Type="KNOWN MALWARE HASH"; Path=$_.FullName; Detail="MD5 $h"}
        }
    }
}

# 5) Active network connections to C2 / Tor / blockchain RPC
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.ProcessName -match "node|wscript|cscript|tor") {
        $findings += [PSCustomObject]@{Type="Suspicious Connection"; Path=$proc.Path; Detail="$($proc.ProcessName) -> $($_.RemoteAddress):$($_.RemotePort)"}
    }
}

# 6) Webshell hunt: script files recently written to IIS/Tomcat webroots
$webroots = @("C:\inetpub\wwwroot","C:\Program Files\Apache Software Foundation","C:\tomcat")
foreach ($w in $webroots) {
    Get-ChildItem $w -Recurse -Include *.aspx,*.ashx,*.jsp,*.jspx,*.php -ErrorAction SilentlyContinue |
        Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-60) } |
        ForEach-Object { $findings += [PSCustomObject]@{Type="Possible Webshell (GLUTTON)"; Path=$_.FullName; Detail="Created $($_.CreationTime)"} }
}

$findings | Format-Table -AutoSize
$findings | Export-Csv "$env:TEMP\otx_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "`n[+] Hunt complete. $($findings.Count) findings. Review DNS logs for 'reviewassignment.in' and .onion resolution." -ForegroundColor Yellow