The Gentlemen RaaS, Webworm APT, & AI Impersonation Infostealers: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential The Gentlemen Ransomware Defense Evasion - Log Clearing
id: 4c8b6d12-1c5a-4a5f-9b8c-1d2e3f4a5b6c
description: Detects attempts to clear Security, System, or Application event logs, a tactic observed in The Gentlemen RaaS incidents.
status: experimental
date: 2026/05/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66522a13f2b9e7d6e3a8b9c7
tags:
    - attack.defense_evasion
    - attack.t1070.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\wevtutil.exe'
        CommandLine|contains:
            - 'cl Security'
            - 'cl System'
            - 'cl Application'
    condition: selection
falsepositives:
    - Administrator maintenance
level: high
---
title: Webworm APT - Discord C2 Traffic via PowerShell
date: 2026/05/22
id: 5d9c7e23-2d6b-5b6g-0c9d-2e3f4a5b6c7d
description: Detects PowerShell processes initiating network connections to Discord endpoints, indicative of EchoCreep malware C2.
status: experimental
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66522b24f3c0e8d7f4b9c0d8
tags:
    - attack.command_and_control
    - attack.t1102.001
logsource:
    product: windows
    category: network_connection
detection:
    selection_img:
        Initiated: 'true'
        Image|endswith: '\powershell.exe'
    selection_dest:
        DestinationHostname|contains: 'discord.com'
    condition: all of selection_*
falsepositives:
    - Legitimate developer use of Discord APIs
level: medium
---
title: AI Impersonation - PowerShell Download from Typosquatted Domains
id: 6e0d8f34-3e7c-6c7h-1d0e-3f4a5b6c7d8e
date: 2026/05/22
description: Detects PowerShell downloading payloads from domains mimicking legitimate AI tools (Gemini, Claude).
status: experimental
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66522c35g4d1f9e8g5c0d1e9
tags:
    - attack.initial_access
    - attack.t1566.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
    selection_flags:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'IEX'
            - 'DownloadString'
    selection_domains:
        CommandLine|contains:
            - 'gemini-setup.com'
            - 'claude-setup.com'
    condition: all of selection_*
falsepositives:
    - Unknown
level: critical

// Hunt for Webworm Discord C2 and SEO Poisoning domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("discord.com", "gemini-setup.com", "claude-setup.com") 
       or RemoteIP in ("193.233.202.17", "77.110.122.137")
| extend FullProcess = InitiatingProcessFileName, CommandLine = InitiatingProcessCommandLine
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, FullProcess, CommandLine
| where not(FullProcess in ~("chrome.exe", "msedge.exe", "firefox.exe")) and RemoteUrl has "discord"
| summarize count() by DeviceName, RemoteUrl, FullProcess

<#
.SYNOPSIS
    Hunt for The Gentlemen persistence and Webworm artifacts.
.DESCRIPTION
    Checks for Scheduled Tasks created by attackers and suspicious network connections.
#>

# Check for Scheduled Tasks created recently (last 7 days) that run PowerShell or Cmd
$schtasks =schtasks /query /fo LIST /v
Write-Host "Checking for recently created suspicious Scheduled Tasks..."

Get-ScheduledTask | Where-Object {$_.Date -gt (Get-Date).AddDays(-7)} | 
ForEach-Object {
    $task = $_
    $action = $task.Actions.Execute
    if ($action -match "powershell" -or $action -match "cmd") {
        Write-Host "[!] Suspicious Task Found: $($task.TaskName)" -ForegroundColor Yellow
        Write-Host "    Action: $action"
        Write-Host "    Args: $($task.Actions.Arguments)"
    }
}

# Check for the specific file hashes (The Gentlemen)
$targetHashes = @(
    "f918535f974591ef031bd0f30a8171e3da27a6754e6426a8ba095f83195661c8",
    "9c87e8162b39fbb773c416006b16f8e34aca53372d1b2d4a584df0ffc69ad333"
)

Write-Host "\nScanning for malware hashes..."
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
ForEach-Object {
    $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($targetHashes -contains $hash) {
        Write-Host "[!] MALWARE DETECTED: $($_.FullName)" -ForegroundColor Red
    }
}