T-SQL Abuse + SSH Brute-Force Campaigns: XMRig, Gh0st RAT, ShellBot & Credential Theft Tooling — OTX Pulse Analysis & Enterprise Detection Pack

---
title: Suspicious Process Spawned by SQL Server (T-SQL Abuse)
id: 9f2e1a4b-7c3d-4e5f-8a6b-2d1c9e0f4a71
status: production
description: Detects command shells, scripting engines, or download utilities spawned by SQL Server database engine processes, consistent with T-SQL abuse campaigns delivering XMRig, Gh0st RAT, and web shells via xp_cmdshell or OLE automation.
references:
    - https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers
author: Security Arsenal Threat Intel
date: 2026/11/14
tags:
    - attack.execution
    - attack.t1059
    - attack.t1190
    - attack.brute_force
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\sqlservr.exe'
            - '\mysqld.exe'
            - '\sqlagent.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\curl.exe'
            - '\wmic.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate SQL Server maintenance jobs or monitoring agents (rare on production DB hosts)
level: high
---
title: HackBrowserData Credential Theft Tool Execution
id: 4b8c2d6e-1f3a-4b5c-9d7e-6a0f2b8c3d51
status: production
description: Detects execution of HackBrowserData or command-line patterns consistent with browser credential/cookie extraction, observed in Q3 2026 campaigns against compromised Windows database servers.
references:
    - https://asec.ahnlab.com/en/95809/
author: Security Arsenal Threat Intel
date: 2026/11/14
tags:
    - attack.credential_access
    - attack.t1552
    - attack.t1539
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|contains:
            - 'hack-browser-data'
            - 'hackbrowserdata'
    selection_cmd:
        CommandLine|contains:
            - '--browser chrome'
            - '--browser edge'
            - 'Login Data'
            - '\Cookies'
            - 'Web Data'
    condition: 1 of selection_*
falsepositives:
    - Authorized red team or forensic acquisition tooling
level: critical
---
title: Outbound SSH or Database Connections from Server Processes (Linux/Windows Lateral Movement)
id: 7e5a1c3d-9b2f-4a8e-6c1d-3f7b9e2a4c83
status: production
description: Detects server-hosted processes initiating outbound SSH (22), MS SQL (1433), or MySQL (3306) connections, consistent with Fisieredoor self-propagation, Fscan internal scanning, Naabu port scanning, and botnet lateral movement observed in OTX pulses.
references:
    - https://asec.ahnlab.com/en/95808
    - https://asec.ahnlab.com/en/95809/
author: Security Arsenal Threat Intel
date: 2026/11/14
tags:
    - attack.lateral_movement
    - attack.t1021
    - attack.t1046
logsource:
    category: network_connection
    product: windows
detection:
    selection_port:
        DestinationPort:
            - 22
            - 1433
            - 3306
    selection_proc:
        Image|endswith:
            - '\sqlservr.exe'
            - '\perl.exe'
            - '\fscan.exe'
            - '\naabu.exe'
            - '\xmrig.exe'
    filter_internal:
        DestinationIp|startswith:
            - '10.'
            - '192.168.'
    condition: selection_port and selection_proc and not filter_internal
falsepositives:
    - Database replication or cluster heartbeat traffic (typically internal and filtered)
    - Backup solutions with SSH transport
level: high

// Hunt: Brute-force followed by suspicious server-side execution and credential-theft tooling
// Covers T-SQL abuse, SSH brute-force, HackBrowserData, and Fscan/Naabu scanning behaviors
let bruteForceSources = SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4625 and LogonType in (3, 10)
| where IpAddress !startswith "10." and IpAddress !startswith "192.168."
| summarize FailedAttempts = count(), TargetHosts = dcount(Computer) by IpAddress, Account
| where FailedAttempts > 25;
let suspiciousExec = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("sqlservr.exe", "mysqld.exe", "sqlagent.exe", "perl", "sshd")
| where FileName in~ ("cmd.exe", "powershell.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "wget", "bash", "sh")
   or ProcessCommandLine has_any ("hack-browser-data", "fscan", "naabu", "xmrig", "stratum+tcp", "Login Data")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;
let typosquatC2 = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("microsftapiedge.com", "update.microsftapiedge.com")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort;
let miningEgress = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (3333, 5555, 7777, 14444) or RemoteUrl has_any ("pool.", "stratum", "minexmr", "nanopool", "supportxmr")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort;
bruteForceSources
| join kind=inner (SecurityEvent | where EventID == 4624 and LogonType in (3, 10) | project Computer, Account, IpAddress, TimeGenerated) on IpAddress, Account
| summarize FirstSuccess = min(TimeGenerated) by Computer, Account, IpAddress, FailedAttempts
| extend Alert = "BruteForce-Success"
| union (suspiciousExec | extend Alert = "Server-Spawned-Shell", IpAddress = "", FailedAttempts = 0, FirstSuccess = TimeGenerated | project Computer = DeviceName, Account = AccountName, IpAddress, FailedAttempts, FirstSuccess, Alert)
| union (typosquatC2 | extend Alert = "Typosquat-C2-Beacon", Account = "", FailedAttempts = 0, FirstSuccess = TimeGenerated | project Computer = DeviceName, Account, IpAddress = RemoteIP, FailedAttempts, FirstSuccess, Alert)
| union (miningEgress | extend Alert = "Mining-Pool-Egress", Account = "", FailedAttempts = 0, FirstSuccess = TimeGenerated | project Computer = DeviceName, Account, IpAddress = RemoteIP, FailedAttempts, FirstSuccess, Alert)
| order by Computer, FirstSuccess asc

# Security Arsenal — IOC Hunt: T-SQL Abuse / SSH Botnet / Credential Theft Kit
# Run elevated on suspected Windows hosts. Outputs JSON findings to .\hunt_results.json

$findings = @()

# 1. Known malicious file hashes from OTX pulses (MD5/SHA256 sample set)
$badHashes = @(
    '8ce2cd98ef6ceeece8239936e4aea042c41807f632cd691d5091705bf6c0076d',
    '1404ae6367955cc65553f091985c2a8df7d3a3efc3c3ace741df1fd5e98447bb',
    'af280ff791163879d7a3135fbaf7c2789447ad7a4dd95527f470b07fa451532b',
    '2f8f7fc1859d7522bcb94854a704975d498f17c8e981eba966e75cebffc408f7',
    '001546787ee0f3bec75d57fda1d59b60',
    '500351506e1a1218b6b8f968b432b81f',
    '7fd491c23561b3332b0ae7dddda262ea',
    '8924b37f0a01a3fdf4bf228d0c0ef62c',
    '8d16f6a9ccfcbc8a6d6c764bfec8da09',
    'b3d08af95c2a2d086b4a776817b6f5b2',
    'be6ffaec9ea200aee3664047cfbbca9e',
    '5279c09bdabb12a3a28b0db8e838bf1b',
    '056ffa80af31d17e0cee037b44e0c7ef'
)

Write-Host '[*] Hash-sweeping common staging directories...' -ForegroundColor Cyan
$stagingPaths = @('C:\Windows\Temp','C:\Temp','C:\Users\Public','C:\ProgramData','C:\Windows\System32\config\systemprofile\AppData\Local\Temp')
foreach ($p in $stagingPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            try {
                $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
                $m = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction Stop).Hash.ToLower()
                if ($badHashes -contains $h -or $badHashes -contains $m) {
                    $findings += [pscustomobject]@{Type='MaliciousFile'; Path=$_.FullName; SHA256=$h; MD5=$m}
                }
            } catch {}
        }
    }
}

# 2. Persistence hunt: suspicious services, Run keys, scheduled tasks referencing miners/RATs
Write-Host '[*] Checking persistence mechanisms...' -ForegroundColor Cyan
$susPattern = 'xmrig|gh0st|mydoor|moudoor|hack-browser|fscan|naabu|gotohttp|vshell|ringq|softether'
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
                'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
                'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue |
    ForEach-Object { $_.PSObject.Properties } |
    Where-Object { $_.Value -match $susPattern } |
    ForEach-Object { $findings += [pscustomobject]@{Type='RegistryRunKey'; Path=$_.Name; SHA256=''; MD5=$_.Value} }

Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    ($_.Actions.Execute -match $susPattern) -or ($_.TaskName -match $susPattern)
} | ForEach-Object {
    $findings += [pscustomobject]@{Type='ScheduledTask'; Path=$_.TaskName; SHA256=''; MD5=$_.Actions.Execute}
}

Get-CimInstance Win32_Service -ErrorAction SilentlyContinue | Where-Object {
    $_.PathName -match $susPattern
} | ForEach-Object {
    $findings += [pscustomobject]@{Type='Service'; Path=$_.Name; SHA256=''; MD5=$_.PathName}
}

# 3. Network hunt: typosquat C2 DNS cache + mining/SSH egress connections
Write-Host '[*] Checking network artifacts...' -ForegroundColor Cyan
$dnsHits = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match 'microsftapiedge' }
foreach ($d in $dnsHits) {
    $findings += [pscustomobject]@{Type='DNSCache-C2'; Path=$d.Entry; SHA256=''; MD5=$d.Data}
}

Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in @(22,1433,3306,3333,5555,7777,14444) } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        $findings += [pscustomobject]@{Type='SuspiciousConnection'; Path="$($proc.ProcessName) -> $($_.RemoteAddress):$($_.RemotePort)"; SHA256=''; MD5=$proc.Path}
    }

# 4. SQL Server execution artifacts: check for recently enabled xp_cmdshell
Write-Host '[*] Checking SQL Server advanced options (xp_cmdshell)...' -ForegroundColor Cyan
$sqlSvc = Get-Service -Name 'MSSQL*' -ErrorAction SilentlyContinue | Where-Object Status -eq 'Running'
if ($sqlSvc) {
    $findings += [pscustomobject]@{Type='SQLServerRunning'; Path=($sqlSvc.Name -join ','); SHA256=''; MD5='Review: run sp_configure xp_cmdshell and audit recent T-SQL for xp_cmdshell/OLE/CMDEXEC usage'}
}

$findings | ConvertTo-Json -Depth 4 | Out-File .\hunt_results.json -Encoding utf8
Write-Host ("[+] Hunt complete. {0} finding(s) written to .\hunt_results.json" -f $findings.Count) -ForegroundColor Green
$findings | Format-Table -AutoSize