SysGoRAT + CL-UNK-1211: AI-Generated Espionage Campaign Targets Government Linux Infrastructure — OTX Detection Pack

---
title: SysGoRAT Go Binary Execution on Linux Server
id: a1b2c3d4-1111-4000-a000-sysgorat00001
status: experimental
description: Detects execution of Go-compiled binaries consistent with SysGoRAT deployment on Linux infrastructure. CL-UNK-1211 deploys SysGoRAT as a cross-platform Go backdoor on compromised government Linux servers.
author: Security Arsenal Threat Intelligence
date: 2026/11/15
references:
    - https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/
logsource:
    product: linux
    category: process_creation
detection:
    selection_go_binary:
        - Image|endswith:
            - '/tmp/*'
            - '/var/tmp/*'
            - '/dev/shm/*'
            - '/var/www/html/*'
        - CommandLine|contains:
            - 'main.go'
            - 'GOROOT'
            - 'GOPATH'
    selection_suspicious_exec:
        - Image|endswith:
            - '.elf'
        - ParentImage|endswith:
            - 'bash'
            - 'sh'
            - 'zsh'
            - 'python*'
            - 'perl'
    condition: 1 of selection_go_binary or all of selection_suspicious_exec
falsepositives:
    - Legitimate Go applications deployed by development teams
    - System administration scripts
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.t1204
---
title: PwnKit CVE-2021-4034 Privilege Escalation Attempt
id: a1b2c3d4-2222-4000-a000-pwnkit00002
status: experimental
description: Detects exploitation attempts of CVE-2021-4034 (PwnKit) polkit pkexec local privilege escalation vulnerability. CL-UNK-1211 uses this CVE to escalate privileges on compromised Linux hosts before deploying SysGoRAT.
author: Security Arsenal Threat Intelligence
date: 2026/11/15
references:
    - https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/
logsource:
    product: linux
    category: process_creation
detection:
    selection_pkexec:
        Image|endswith: '/pkexec'
    selection_env_abuse:
        CommandLine|contains:
            - 'GCONV_PATH'
            - 'CHARSET'
            - 'SHELL'
            - 'PATH='
    selection_suspicious_context:
        ParentImage|endswith:
            - 'bash'
            - 'sh'
            - 'dash'
            - 'zsh'
            - 'python*'
    condition: selection_pkexec and (selection_env_abuse or selection_suspicious_context)
falsepositives:
    - Legitimate pkexec usage by system administrators
    - PolicyKit-authorized privilege escalation
level: critical
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2021.4034
---
title: Web Shell Deployment on Linux Web Server
id: a1b2c3d4-3333-4000-a000-webshell0003
status: experimental
description: Detects creation of suspicious files in web server directories and subsequent execution consistent with web shell deployment. CL-UNK-1211 deploys web shells on compromised government Linux web servers as an initial persistence mechanism.
author: Security Arsenal Threat Intelligence
date: 2026/11/15
references:
    - https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/
logsource:
    product: linux
    category: file_event
detection:
    selection_web_dirs:
        TargetFilename|startswith:
            - '/var/www/html/'
            - '/var/www/'
            - '/srv/www/'
            - '/usr/share/nginx/'
            - '/opt/lampp/htdocs/'
    selection_shell_extensions:
        TargetFilename|endswith:
            - '.php'
            - '.jsp'
            - '.jspx'
            - '.asp'
            - '.aspx'
            - '.py'
            - '.pl'
            - '.cgi'
    selection_suspicious_names:
        TargetFilename|contains:
            - 'shell'
            - 'cmd'
            - 'exec'
            - 'backdoor'
            - 'upload'
            - 'c99'
            - 'r57'
            - 'b374k'
            - 'wso'
            - 'mini'
            - 'bypass'
            - 'conf'
            - '.cache'
    condition: selection_web_dirs and selection_shell_extensions and selection_suspicious_names
falsepositives:
    - Legitimate web application files
    - CMS plugin/theme updates
level: high
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.t1100

// CL-UNK-1211 / SysGoRAT Hunt Query
// Hunts for SysGoRAT indicators, PwnKit exploitation, web shell deployment, and associated network activity
// Time range: Last 30 days

let SysGoRATHashes = dynamic([
    "44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879",
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
    "a63eb43c6c694570f4aca391b8111439",
    "d75cb9920d1d3d280518ddccfe4789d2",
    "869e68253bb602144b3750c277eda1ed0b08534a"
]);

// Part 1: File hash matches
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 in~ (SysGoRATHashes) or MD5 in~ (SysGoRATHashes) or SHA1 in~ (SysGoRATHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, MD5, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend DetectionType = "SysGoRAT_Hash_Match"

| union (
    // Part 2: PwnKit exploitation (pkexec abuse)
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where FileName =~ "pkexec" or ProcessCommandLine has "pkexec"
    | where ProcessCommandLine has_any ("GCONV_PATH", "CHARSET", "SHELL")
        or InitiatingProcessFileName in~ ("bash", "sh", "dash", "zsh", "python", "python3", "perl")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
    | extend DetectionType = "PwnKit_CVE-2021-4034"
)

| union (
    // Part 3: Web shell file creation in web directories
    DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where FolderPath has_any ("/var/www/", "/srv/www/", "/usr/share/nginx/", "/opt/lampp/htdocs/")
    | where FileName endswith ".php" or FileName endswith ".jsp" or FileName endswith ".py" or FileName endswith ".pl" or FileName endswith ".cgi"
    | where FileName has_any ("shell", "cmd", "exec", "backdoor", "upload", "c99", "r57", "b374k", "wso", "mini", "bypass")
        or InitiatingProcessFileName in~ ("bash", "sh", "wget", "curl", "python", "python3", "perl")
    | project TimeGenerated, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend DetectionType = "WebShell_Deployment"
)

| union (
    // Part 4: Suspicious Go binary execution from temp directories
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where FolderPath has_any ("/tmp/", "/var/tmp/", "/dev/shm/")
    | where FileName !in~ ("gcc", "ld", "as", "objdump", "make", "cmake")
    | where InitiatingProcessFileName in~ ("bash", "sh", "dash", "zsh")
    | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
    | extend DetectionType = "Suspicious_Temp_Execution"
)

| union (
    // Part 5: Network connections from Go binaries or suspicious processes
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where InitiatingProcessFolderPath has_any ("/tmp/", "/var/tmp/", "/dev/shm/")
    | where RemotePort in (80, 443, 8080, 8443, 4444, 5555, 6666, 7777, 8888, 9999)
    | where RemoteIPType == "Public"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteIP, RemotePort, RemoteUrl
    | extend DetectionType = "Suspicious_C2_Beacon"
)

| sort by TimeGenerated desc
| summarize arg_max(TimeGenerated, *) by DeviceName, DetectionType
| project TimeGenerated, DeviceName, DetectionType, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, RemoteIP, RemotePort, SHA256

#!/bin/bash
# CL-UNK-1211 / SysGoRAT IOC Hunt Script
# Searches for SysGoRAT hashes, PwnKit artifacts, web shells, and suspicious Go binaries
# Usage: sudo ./cl-unk-1211-hunt.sh [output_dir]
# Requires: root privileges for full filesystem scan

OUTPUT_DIR="${1:-./cl-unk-1211-hunt-$(date +%Y%m%d-%H%M%S)}"
mkdir -p "$OUTPUT_DIR"

RED='\033[0;31m'
YELLOW='\033[1;33m'
GREEN='\033[0;32m'
NC='\033[0m'

log() { echo -e "${GREEN}[$(date '+%Y-%m-%d %H:%M:%S')]${NC} $1" | tee -a "$OUTPUT_DIR/hunt.log"; }
alert() { echo -e "${RED}[ALERT]${NC} $1" | tee -a "$OUTPUT_DIR/hunt.log" "$OUTPUT_DIR/ALERTS.txt"; }
warn() { echo -e "${YELLOW}[WARN]${NC} $1" | tee -a "$OUTPUT_DIR/hunt.log"; }

log "=== CL-UNK-1211 / SysGoRAT IOC Hunt Starting ==="
log "Output directory: $OUTPUT_DIR"

# ── Known SysGoRAT Hashes ──
SHA256_HASHES=(
    "44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879"
    "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa"
)
MD5_HASHES=(
    "a63eb43c6c694570f4aca391b8111439"
    "d75cb9920d1d3d280518ddccfe4789d2"
)
SHA1_HASHES=(
    "869e68253bb602144b3750c277eda1ed0b08534a"
)

# ── 1. Hash-based file search ──
log "[1/7] Scanning for known SysGoRAT file hashes..."
find / -type f \( -path "/proc" -o -path "/sys" -o -path "/run" \) -prune -o -type f -print 2>/dev/null | while read -r file; do
    if [ -r "$file" ] && [ -f "$file" ]; then
        sha256=$(sha256sum "$file" 2>/dev/null | awk '{print $1}')
        md5=$(md5sum "$file" 2>/dev/null | awk '{print $1}')
        for hash in "${SHA256_HASHES[@]}"; do
            if [ "$sha256" == "$hash" ]; then
                alert "SysGoRAT SHA256 match: $file (SHA256: $sha256)"
            fi
        done
        for hash in "${MD5_HASHES[@]}"; do
            if [ "$md5" == "$hash" ]; then
                alert "SysGoRAT MD5 match: $file (MD5: $md5)"
            fi
        done
    fi
done > "$OUTPUT_DIR/hash_scan_results.txt" 2>&1

# ── 2. PwnKit (CVE-2021-4034) vulnerability check ──
log "[2/7] Checking for PwnKit (CVE-2021-4034) vulnerability..."
if command -v pkexec &>/dev/null; then
    PKEXEC_VERSION=$(pkexec --version 2>/dev/null | grep -oP '[0-9]+\.[0-9]+' | head -1)
    POLKIT_VERSION=$(dpkg -l policykit-1 2>/dev/null | grep '^ii' | awk '{print $3}' || rpm -q polkit 2>/dev/null)
    echo "pkexec version: $PKEXEC_VERSION" | tee -a "$OUTPUT_DIR/pwnkit_check.txt"
    echo "polkit package: $POLKIT_VERSION" | tee -a "$OUTPUT_DIR/pwnkit_check.txt"
    warn "Verify polkit version is patched against CVE-2021-4034"
else
    log "pkexec not found on this system"
fi

# ── 3. Web shell detection in web directories ──
log "[3/7] Scanning web directories for web shells..."
WEB_DIRS=("/var/www" "/srv/www" "/usr/share/nginx" "/opt/lampp/htdocs" "/home/*/public_html")
for dir in "${WEB_DIRS[@]}"; do
    if [ -d "$dir" ]; then
        find "$dir" -type f \( -name "*.php" -o -name "*.jsp" -o -name "*.py" -o -name "*.pl" -o -name "*.cgi" \) -newer /etc/hostname 2>/dev/null | while read -r shell_file; do
            if grep -lE '(eval|exec|system|passthru|shell_exec|base64_decode|gzinflate|str_rot13|assert|preg_replace.*\/e|create_function)' "$shell_file" 2>/dev/null; then
                alert "Potential web shell: $shell_file"
                stat "$shell_file" >> "$OUTPUT_DIR/webshell_details.txt" 2>/dev/null
            fi
        done
    fi
done

# ── 4. Suspicious binaries in temp directories ──
log "[4/7] Checking temp directories for suspicious executables..."
for tmpdir in /tmp /var/tmp /dev/shm; do
    find "$tmpdir" -type f -executable 2>/dev/null | while read -r binfile; do
        file_type=$(file "$binfile" 2>/dev/null)
        if echo "$file_type" | grep -qi "ELF"; then
            go_strings=$(strings "$binfile" 2>/dev/null | grep -c "runtime\." || true)
            if [ "$go_strings" -gt 5 ]; then
                alert "Suspicious Go binary in temp: $binfile ($file_type)"
            else
                warn "ELF executable in temp: $binfile ($file_type)"
            fi
        fi
    done
done > "$OUTPUT_DIR/temp_executables.txt" 2>&1

# ── 5. Suspicious systemd services and cron jobs ──
log "[5/7] Checking for malicious persistence mechanisms..."
systemctl list-units --type=service --state=running 2>/dev/null | grep -iE '(tmp|var/tmp|dev/shm|update|cache|system-)' | tee -a "$OUTPUT_DIR/suspicious_services.txt"
crontab -l 2>/dev/null | tee -a "$OUTPUT_DIR/root_crontab.txt"
for user in $(cut -d: -f1 /etc/passwd); do
    crontab -u "$user" -l 2>/dev/null | grep -vE '^#|^$' | while read -r cron_line; do
        echo "[$user] $cron_line" >> "$OUTPUT_DIR/all_crontabs.txt"
        if echo "$cron_line" | grep -qE '(curl|wget|/tmp/|/dev/shm/|base64|eval|python|perl|bash -c)'; then
            alert "Suspicious cron entry for $user: $cron_line"
        fi
    done
done
ls -la /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/ 2>/dev/null | tee -a "$OUTPUT_DIR/cron_dirs.txt"

# ── 6. Active network connections ──
log "[6/7] Checking for suspicious network connections..."
ss -tlnp 2>/dev/null | tee -a "$OUTPUT_DIR/listening_ports.txt"
ss -tnp 2>/dev/null | grep -E 'ESTAB|SYN-SENT' | while read -r conn; do
    remote_ip=$(echo "$conn" | awk '{print $5}' | cut -d: -f1)
    process=$(echo "$conn" | grep -oP 'users:\(\("\K[^"]+')
    if [ -n "$process" ]; then
        proc_path=$(readlink -f "/proc/$(pgrep -f "$process" | head -1)/exe" 2>/dev/null)
        if echo "$proc_path" | grep -qE '(/tmp/|/var/tmp/|/dev/shm/)'; then
            alert "Suspicious outbound connection from temp binary: $process -> $remote_ip ($conn)"
        fi
    fi
done

# ── 7. AI-generated payload indicators ──
log "[7/7] Scanning for AI-generated payload artifacts..."
find /var/www /tmp /var/tmp /dev/shm /opt -type f \( -name "*.py" -o -name "*.sh" -o -name "*.pl" -o -name "*.elf" \) 2>/dev/null | while read -r script_file; do
    if grep -liE '(As an AI|I apologize|Here is the code|Sure, here|Certainly! Here|```python|```bash|def main\(\):.*# TODO|# This script|# Note: This is)' "$script_file" 2>/dev/null; then
        alert "Possible AI-generated payload (conversational annotations): $script_file"
    fi
done

log "=== Hunt Complete ==="
log "Results saved to: $OUTPUT_DIR"
if [ -f "$OUTPUT_DIR/ALERTS.txt" ]; then
    ALERT_COUNT=$(wc -l < "$OUTPUT_DIR/ALERTS.txt")
    alert "TOTAL ALERTS: $ALERT_COUNT — Review $OUTPUT_DIR/ALERTS.txt immediately"
else
    log "No alerts generated. System appears clean based on available IOCs."
fi