The Crown Prince, Nezha: China Chopper, AntSword & Ghost RAT Web Shell Campaign

title: Potential AntSword Web Shell Management
id: 84c5f8a9-2c5f-4820-9b5d-7f5a6d3c3b2d
description: Detects HTTP requests containing the AntSword web shell manager user-agent or specific header patterns used in the "Crown Prince" campaign.
status: experimental
date: 2026/08/02
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/622c45f1e3a6a8e8a8e8a8e8
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: webserver
detection:
    selection:
        cs-user-agent|contains: 'antSword'
    condition: selection
falsepositives:
    - Legitimate administration tools (unlikely given specific UA)
level: critical
---
title: Nezha Agent Process Execution
id: 92e4f7b0-3d6e-4a12-9c8e-1f0a9b8c7d6e
description: Detects the execution of Nezha agent binaries or processes connecting to non-standard ports, indicative of the abused monitoring tool in the Nezha campaign.
status: experimental
date: 2026/08/02
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/622c45f1e3a6a8e8a8e8a8e8
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\nezha-agent.exe'
        - OriginalFileName: 'nezha-agent'
    selection_cli:
        CommandLine|contains: '-s' # Nezha often uses -s for server address
    condition: 1 of selection*
falsepositives:
    - Legitimate Nezha monitoring deployments (verify server destination)
level: high
---
title: China Chopper Web Shell Activity
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects common patterns associated with China Chopper web shell execution, specifically base64 encoded POST requests and specific parameter names.
status: experimental
date: 2026/08/02
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/622c45f1e3a6a8e8a8e8a8e8
tags:
    - attack.web_shell
    - attack.t1505.003
logsource:
    category: webserver
detection:
    selection_post:
        cs-method: 'POST'
    selection_keywords:
        cs-uri-query|contains:
            - 'eval('
            - 'base64_decode'
    selection_chopper_param:
        cs-uri-query|contains: 'z'
    condition: selection_post and (selection_keywords or selection_chopper_param)
falsepositives:
    - Rare, legitimate web applications using eval
level: high

// Hunt for connections to identified Nezha/Ghost RAT C2 domains
DeviceNetworkEvents
| where RemoteUrl in ("gd.bj2.xyz", "c.mid.al")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| order by Timestamp desc

// Hunt for execution of suspicious file hashes from the pulse
DeviceProcessEvents
| where SHA256 in ("7b2599ed54b72daec0acfd32744c7a9a77b19e6cf4e1651837175e4606dbc958", 
                      "35e0b22139fb27d2c9721aedf5770d893423bf029e1f56be92485ff8fce210f3",
                      "9f33095a24471bed55ce11803e4ebbed5118bfb5d3861baf1c8214efcd9e7de6",
                      "f3570bb6e0f9c695d48f89f043380b43831dd0f6fe79b16eda2a3ffd9fd7ad16")
| project Timestamp, DeviceName, AccountName, FolderPath, SHA256, InitiatingProcessAccountName

// Hunt for Log Poisoning / Web Shell precursors (PHP processes spawning cmd)
DeviceProcessEvents
| where InitiatingProcessFileName has "php" and ProcessFileName in ("cmd.exe", "powershell.exe", "bash")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, ProcessCommandLine, AccountName

# Check for the presence of Nezha or Ghost RAT artifacts on Windows Endpoints

$TargetHashes = @(
    "d757ec4d5350843c44dd34a95dcb3a50",
    "ad5e5b00f58396f5a518680e7084dc7dd5f2cc2b",
    "7b2599ed54b72daec0acfd32744c7a9a77b19e6cf4e1651837175e4606dbc958",
    "35e0b22139fb27d2c9721aedf5770d893423bf029e1f56be92485ff8fce210f3",
    "9f33095a24471bed55ce11803e4ebbed5118bfb5d3861baf1c8214efcd9e7de6",
    "f3570bb6e0f9c695d48f89f043380b43831dd0f6fe79b16eda2a3ffd9fd7ad16"
)

Write-Host "[*] Hunting for Crown Prince / Nezha IOCs..." -ForegroundColor Cyan

# 1. Scan C: drive for file hashes
Write-Host "[*] Scanning common writeable directories for matching file hashes..." -ForegroundColor Yellow
$PathsToScan = @("C:\\Windows\\Temp", "C:\\Users\\Public", "C:\\inetpub", "C:\\\xampp\\")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Get-FileHash -ErrorAction SilentlyContinue | Where-Object { $TargetHashes -contains $_.Hash } | ForEach-Object {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.Path) | Hash: $($_.Hash)" -ForegroundColor Red
        }
    }
}

# 2. Check for Nezha related processes or services
Write-Host "[*] Checking for Nezha agent processes..." -ForegroundColor Yellow
$Processes = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.ProcessName -like "*nezha*" -or $_.MainWindowTitle -like "*nezha*" }
if ($Processes) {
    Write-Host "[!] SUSPICIOUS PROCESS FOUND: $($Processes.ProcessName) (PID: $($Processes.Id))" -ForegroundColor Red
}

# 3. Check Network Connections to known C2
$C2Domains = @("gd.bj2.xyz", "c.mid.al")
$Connections = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.State -eq "Established" }
$ProcessMap = @{}
Get-Process | ForEach-Object { $ProcessMap[$_.Id] = $_ }

foreach ($Conn in $Connections) {
    try {
        $RemoteIP = (Get-NetIPAddress -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress -eq $Conn.RemoteAddress }).IPAddress
        # Attempt to resolve hostname
        $HostName = [System.Net.Dns]::GetHostEntry($Conn.RemoteAddress).HostName
        if ($C2Domains -contains $HostName) {
            $Proc = $ProcessMap[$Conn.OwningProcess]
            Write-Host "[!] C2 CONNECTION DETECTED: $HostName ($($Conn.RemoteAddress)) by Process: $($Proc.ProcessName) ($($Proc.Path))" -ForegroundColor Red
        }
    } catch {
        # Ignore resolution failures
    }
}

Write-Host "[*] Hunt complete." -ForegroundColor Green