title: Potential Infostealer.Speagle C2 Communication
id: 1a2b3c4d-5e6f-7890-1234-567890abcdef
description: Detects network connections to known Cobra DocGuard infrastructure hijacked by Infostealer.Speagle or the specific URL pattern used for exfiltration.
status: experimental
date: 2026/04/19
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6123456789abcdef
tags:
    - attack.exfiltration
    - attack.credential_access
logsource:
    category: proxy
detection:
    selection:
      c-uri|contains: 'CDGClientDiagnostics'
      c-uri|contains: 'flag=syn_user_policy'
    filter:
      c-host|endswith: '.cobradocguard.com' # Fallback if internal domain structure is different
    condition: selection and not filter
falsepositives:
    - Legitimate Cobra DocGuard diagnostics (verify internal IPs)
level: critical
---
title: Suspicious macOS DMG Execution (notnullOSX Indicator)
id: b4c5d6e7-f8a9-1011-1213-141516171819
description: Detects execution of applications from mounted DMG images or temporary directories often associated with macOS stealers like notnullOSX.
status: experimental
date: 2026/04/19
author: Security Arsenal
tags:
    - attack.execution
    - attack.initial_access
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    ParentImage|endswith:
      - '/Disk Utility.app/Contents/MacOS/Disk Utility'
      - '/Installer.app/Contents/MacOS/Installer'
    Image|endswith:
      - '.app/Contents/MacOS/'
  filter_legit:
    Image|contains:
      - '/Applications/'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate software installation
level: high
---
title: Fake Proton VPN Site Access (NWHStealer)
id: c0d1e2f3-4a5b-6c7d-8e9f-0a1b2c3d4e5f
description: Detects DNS queries or HTTP connections to known fake VPN domains associated with NWHStealer distribution.
status: experimental
date: 2026/04/19
author: Security Arsenal
tags:
    - attack.initial_access
    - attack.social_engineering
logsource:
  category: dns
detection:
  selection:
    query|contains:
      - 'get-proton-vpn.com'
      - 'vpn-proton-setup.com'
  condition: selection
falsepositives:
  - None
level: critical

// Hunt for NWHStealer and Speagle Network Indicators
let IOCs_Domains = dynamic(['get-proton-vpn.com', 'vpn-proton-setup.com', 'newworld-helloworld.icu', 'coockie.pro']);
let IOCs_IPs = dynamic(['222.222.254.165', '60.30.147.18', '83.217.209.88', '111.90.145.139']);
let IOCs_SHA256 = dynamic(['3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235', 
                           '03298f85eaf8880222cf8a83b8ed75d90712c34a8a5299a60f47927ad044b43b', 
                           '2494709b8a2646640b08b1d5d75b6bfb3167540ed4acdb55ded050f6df9c53b3']);
// Check Network Connections
DeviceNetworkEvents
| where RemoteUrl in IOCs_Domains or RemoteIP in IOCs_IPs
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| summarize Count=count() by DeviceName, RemoteUrl
| order by Count desc;
// Check File Hashes
DeviceFileEvents
| where SHA256 in IOCs_SHA256
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| order by Timestamp desc

# Hunt for NWHStealer and Speagle Artifacts
# Requires Admin privileges for registry checks

Write-Host "Starting Hunt for Infostealer Artifacts..." -ForegroundColor Cyan

# 1. Check for Suspicious File Hashes in common temp/download paths
$TargetHashes = @(
    "3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c9235",
    "03298f85eaf8880222cf8a83b8ed75d90712c34a8a5299a60f47927ad044b43b",
    "2494709b8a2646640b08b1d5d75b6bfb3167540ed4acdb55ded050f6df9c53b3",
    "e97cb6cbcf2583fe4d8dcabd70d3f67f6cc977fc9a8cbb42f8a2284efe24a1e3"
)

$PathsToScan = @("C:\Users\*\Downloads\", "C:\ProgramData\", "C:\Temp\", "C:\Windows\Temp\")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Write-Host "Scanning $Path..." -ForegroundColor Yellow
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $_.Length -gt 0kb -and $_.Length -lt 50mb } | 
        ForEach-Object {
            $hash = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
            if ($TargetHashes -contains $hash.Hash) {
                Write-Host "[MALICIOUS] Match found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# 2. Check for Speagle related persistence (Hypothetical Registry Run Key based on Infostealer TTPs)
$RegPaths = @("HKLM:\Software\Microsoft\Windows\CurrentVersion\Run", "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run")
$SuspiciousNames = @("DocGuard", "CobraClient", "ProtonVPN", "VPNSetup")

foreach ($RegPath in $RegPaths) {
    if (Test-Path $RegPath) {
        Get-ItemProperty -Path $RegPath -ErrorAction SilentlyContinue | 
        Get-Member -MemberType NoteProperty | 
        Where-Object { $SuspiciousNames -match $_.Name } | 
        ForEach-Object {
            $val = Get-ItemProperty -Path $RegPath | Select-Object -ExpandProperty $_.Name
            Write-Host "[SUSPICIOUS] Registry Run Key: $($_.Name) -> $val" -ForegroundColor Yellow
        }
    }
}

Write-Host "Hunt Complete." -ForegroundColor Green


---

# Response Priorities

*   **Immediate (0-4h)**:
    *   Block all listed domains (IOCs) and IPs at the firewall/proxy level.
    *   Quarantine endpoints matching the provided SHA256 hashes.
    *   Isolate devices showing signs of **Speagle** C2 communication (port 8090/8091 traffic to non-internal IPs).

*   **24 Hours**:
    *   **Credential Reset**: Force password resets for users on affected machines, specifically targeting credentials stored in browsers (NWHStealer/notnullOSX targets).
    *   Verify the integrity of **Cobra DocGuard** installations; check for unauthorized modifications or strange outbound connections.
    *   Patch **FortiOS** gateways against CVE-2025-32463 and CVE-2024-37085 immediately.

*   **1 Week**:
    *   **Architecture Hardening**: Review segmentation for FortiOS devices and HuggingFace/marimo server access.
    *   Implement application whitelisting to prevent execution of unsigned DMGs/ISOs (mitigates macOS and Windows droppers).
    *   Conduct a supply chain audit for all third-party security software similar to Cobra DocGuard.