TeamPCP Supply Chain Attack & GachiLoader AI Lures: OTX Pulse Analysis — Enterprise Detection Pack

title: Suspicious Process Spawn via Compromised Security Tools (TeamPCP)
id: 3e1a5c0a-8f4b-4b2a-9c1d-5e6f7a8b9c0d
description: Detects suspicious child processes spawned by known compromised security tools Trivy or KICS, indicative of supply chain exploitation.
status: experimental
date: 2026/05/02
author: Security Arsenal
references:
    - https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\trivy.exe'
            - '\kics.exe'
    selection_suspicious:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative scripting initiated by the tools
level: high

---
title: CHM File Spawning Python Interpreter (Telegram RAT)
id: 7b8d9e1a-2c3f-4a5b-8e9d-1a2b3c4d5e6f
description: Detects compiled HTML help files (hh.exe) executing python.exe, a common pattern in recent Rebex-based Telegram RAT campaigns.
status: experimental
date: 2026/05/02
author: Security Arsenal
references:
    - https://dmpdump.github.io/posts/TelegramRat/
tags:
    - attack.initial_access
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\hh.exe'
    selection_child:
        Image|endswith: '\python.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate documentation accessed by developers
level: critical

---
title: GachiLoader Node.js Spawning Windows Binaries
id: 9a0b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d
description: Detects Node.js or Electron processes spawning suspicious Windows binaries, potentially indicative of GachiLoader activity utilizing AI skill lures.
status: experimental
date: 2026/05/02
author: Security Arsenal
references:
    - https://www.threatdown.com/blog/gachiloader-adopts-ai-skill-lure/
tags:
    - attack.defense_evasion
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\electron.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\regsvr32.exe'
            - '\mshta.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate Node.js development toolchains
level: medium


kql
// Hunt for TeamPCP C2 Infrastructure and CVE exploitation
DeviceNetworkEvents
| where RemoteUrl has "trycloudflare.com" or RemoteUrl has "icp0.io"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| union (
    DeviceProcessEvents
    | where InitiatingProcessFileName has "trivy" or InitiatingProcessFileName has "kics"
    | where FileName has "powershell" or FileName has "cmd"
)


powershell
# PowerShell Hunt Script for Telegram RAT Persistence and TeamPCP Artifacts

# Check for Shell Hijacking Persistence (User Shell Folders)
$RegistryPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
if (Test-Path $RegistryPath) {
    Get-Item $RegistryPath | ForEach-Object {
        $values = Get-ItemProperty $_.PSPath
        foreach ($prop in $values.PSObject.Properties) {
            if ($prop.Value -match ".(exe|bat|cmd|dll)$" -and $prop.Value -notmatch "%SystemRoot%" -and $prop.Value -notmatch "C:\Windows") {
                Write-Host "[ALERT] Suspicious Shell Hijack detected in: $($prop.Name) -> $($prop.Value)" -ForegroundColor Red
            }
        }
    }
}

# Scan for specific IOCs (File Hashes example)
$TargetHashes = @(
    "ced7fe9c5ec508216e6dd9a59d2d5193a58bdbac5f41a38ea97dd5c7fceef7a5",
    "18a24f83e807479438dcab7a1804c51a00dafc1d526698a66e0640d1e5dd671a",
    "076ba40e7fbf2910dff87f0c25862a70001d8ad81d23d8beae9fb9b29b603829"
)

Write-Host "Scanning C:\ for known malicious IOCs (This may take time)..."
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object { !$_.PSIsContainer } | ForEach-Object {
    $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($TargetHashes -contains $hash) {
        Write-Host "[MALWARE] Found malicious file: $($_.FullName)" -ForegroundColor Red
    }
}