title: Suspicious PowerShell GitHub Download - AI Lure Factory
description: Detects PowerShell scripts downloading potentially malicious files from GitHub, often associated with AI-generated lure campaigns like TroyDen or Claude Code leaks.
status: experimental
date: 2026/05/14
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6641e5a50d983e42b23d87f8/
tags:
    - attack.initial_access
    - attack.execution
logsource:
    product: windows
    category: process_creation
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
    selection_cmd:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'IWR'
            - 'DownloadString'
    selection_github:
        CommandLine|contains:
            - 'github.com'
            - 'raw.githubusercontent.com'
    selection_params:
        CommandLine|contains:
            - 'OutFile'
            - 'o '
            - 'move'
    condition: all of selection_*
falsepositives:
    - Legitimate developer scripts
level: high
---
title: Trojanized Sysinternals or MSI Installer Execution
status: experimental
description: Detects execution of MSI installers with names or behaviors resembling Sysinternals tools, a tactic used by EtherRAT operators to deploy TukTuk and The Gentlemen ransomware.
date: 2026/05/14
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66420bf00d983e42b23d8a78/
tags:
    - attack.defense_evasion
    - attack.initial_access
logsource:
    product: windows
    category: process_creation
detection:
    selection_msi:
        Image|endswith: '\msiexec.exe'
    selection_suspicious:
        CommandLine|contains:
            - '/i'
            - '/package'
    selection_keywords:
        CommandLine|contains:
            - 'Sysinternals'
            - 'psexec'
            - 'autoruns'
    condition: all of selection_*
falsepositives:
    - Legitimate installation of Sysinternals Suite (rarely via MSI)
level: critical
---
title: Npm Process Spawning Shell or Network Tools - OtterCookie
description: Detects npm or node.exe processes spawning cmd, powershell, or making network connections, indicative of malicious npm packages like OtterCookie executing payloads.
date: 2026/05/14
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6643b39c0d983e42b23d8f49/
tags:
    - attack.execution
    - attack.persistence
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\bash.exe'
            - '\curl.exe'
            - '\wget.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate build scripts
level: medium


kql
// Hunt for connections to known TroyDen C2 IPs and GhostSocks infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("89.169.12.241", "213.176.73.80", "213.176.73.130", "217.119.129.121", "217.119.129.76", "94.156.154.6", "213.176.73.159", "217.119.129.118", "147.45.197.92", "94.228.161.88")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemotePort
| extend IOCPulse = "TroyDen / GhostSocks"


powershell
# IOC Hunt Script for The Gentlemen / EtherRAT related hashes
$TargetHashes = @(
    "adf675ffc1acb357f2d9f1a94e016f52", # MD5
    "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235", # SHA256
    "51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd2", # SHA256
    "73ce2438d4ed475e03727b7b000d2794", # MD5 (EtherRAT MSI)
    "77fbe265fd65c7f7b6d323fb6de6a4fd", # MD5
    "b188fbc6ff5557767e73e4c883a553a3"  # MD5
)

Write-Host "Scanning for malicious IOCs related to The Gentlemen and Infostealers..."

# Check C:
$Drives = @("C:\")
foreach ($Drive in $Drives) {
    Write-Host "Scanning $Drive - this may take time..."
    Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | Where-Object { !$_.PSIsContainer } | ForEach-Object {
        $Hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash.ToLower()
        if ($TargetHashes -contains $Hash) {
            Write-Host "[MATCH] Malicious file found: $($_.FullName)" -ForegroundColor Red
        }
    }
}

# Check for Scheduled Tasks related to SystemBC (Common persistence for The Gentlemen)
Write-Host "Checking for Suspicious Scheduled Tasks..."
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*powershell*" -or $_.Actions.Execute -like "*cmd*" } | Select-Object TaskName, TaskPath, Actions | Format-Table


# Response Priorities

*   **Immediate:**
    *   Block all identified IPv4 C2 indicators at the firewall.
    *   Apply patches for **CVE-2024-55591** (Fortinet) and **CVE-2025-32433** (Cisco) on all edge appliances immediately.
    *   Hunt for MSI installers executing in the last 48 hours that do not have valid digital signatures.

*   **24 Hours:**
    *   Initiate credential resets for developer and service accounts if credential theft (Redline, Vidar, OtterCookie) is suspected.
    *   Audit GitHub and npm repositories used by the organization for typosquatting or unauthorized forks (specifically looking for "big.js" variants or AI-lure repositories).

*   **1 Week:**
    *   Implement strict allow-listing for build environments and developer workstations regarding script execution.
    *   Harden software supply chain pipelines to require package signing and dependency verification.
    *   Review perimeter logs for NTLM relay attempts associated with The Gentlemen activity.