The Gentlemen RaaS, Webworm APT, and AI SEO Poisoning: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential The Gentlemen Ransomware Activity - Event Log Clearing
id: 4c8f3d2a-1e9b-4a5f-9c2d-3e6f7a8b9c0d
description: Detects attempts to clear Security, System, or Application event logs, a TTP observed in The Gentlemen ransomware incidents.
status: experimental
date: 2026/05/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/664f3a9f2b3f9c0d1e2a3b4c
tags:
    - attack.defense_evasion
    - attack.t1070.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 517
    condition: selection
falsepositives:
    - Legitimate administrative activity (rare)
level: high
---
title: Webworm APT - Suspicious Discord Process Connection
id: 5d9e4e3b-2f0a-5b6g-0d3e-4f7g8b9c0d1e
description: Detects processes establishing connections to Discord endpoints, indicative of EchoCreep C2 activity observed in Webworm campaigns.
status: experimental
date: 2026/05/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/664f3d9f2b3f9c0d1e2a3b4d
tags:
    - attack.command_and_control
    - attack.t1102.002
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains: '.discord.com'
    filter_main_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
    condition: selection and not filter_main_browsers
falsepositives:
    - Legitimate Discord client usage (non-browser)
level: medium
---
title: AI Impersonation Infostealer - Suspicious PowerShell CLI
id: 6e0f5f4c-3g1b-6c7h-1e4f-5g8h9c0d1e2f
description: Detects PowerShell execution patterns often associated with fileless infostealers delivered via SEO poisoning campaigns targeting developers.
status: experimental
date: 2026/05/22
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/664f4e9f2b3f9c0d1e2a3b4e
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    service: process_creation
detection:
    selection_hidden:
        CommandLine|contains: '-windowstyle hidden'
    selection_encoded:
        CommandLine|contains:
            'FromBase64String'
            'IEX'
    selection_obfu:
        CommandLine|contains:
            'Invoke-Expression'
    condition: all of selection_*
falsepositives:
    - System administration scripts
level: high


kql
// Hunt for The Gentlemen RaaS and Webworm Indicators
// Look for network connections to known malicious IPs and domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("193.233.202.17", "77.110.122.137") 
   or RemoteUrl has_any ("gemini-setup.com", "claude-setup.com", "chocolatey.net", "events.msft23.com")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort

// Hunt for Event Log Clearing (The Gentlemen TTP)
SecurityEvent
| where Timestamp > ago(7d)
| where EventID == 517 // Event log cleared
| project Timestamp, Computer, Account, SubjectUserName

// Hunt for processes connecting to Discord (Webworm EchoCreep)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl contains "discord"
| where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "firefox.exe", "discord.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl


powershell
# IOC Hunt Script for The Gentlemen and SEO Poisoning Campaigns
# Checks for file presence of known malicious hashes and suspicious scheduled tasks.

$MaliciousHashes = @(
    "f918535f974591ef031bd0f30a8171e3da27a6754e6426a8ba095f83195661c8",
    "9c87e8162b39fbb773c416006b16f8e34aca53372d1b2d4a584df0ffc69ad333",
    "89d634c8471382ff9c6fd966008ad5c376d7a0edae8f799eb569837170f2373d"
)

Write-Host "[+] Hunting for malicious file hashes..." -ForegroundColor Cyan

# Get files on C: drive (adjust scope as necessary)
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($MaliciousHashes -contains $hash) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }

Write-Host "[+] Checking for Suspicious Scheduled Tasks (The Gentlemen TTP)..." -ForegroundColor Cyan

# Look for tasks running PowerShell with encoded commands or hidden windows
Get-ScheduledTask | Where-Object {$_.Actions.Execute -like "*powershell*"} | ForEach-Object {
    $task = $_
    $task.Actions | ForEach-Object {
        if ($_.Arguments -match "windowstyle hidden" -or $_.Arguments -match "EncodedCommand") {
            Write-Host "[!] SUSPICIOUS TASK FOUND: $($task.TaskName)" -ForegroundColor Yellow
            Write-Host "    Action: $($_.Execute) $($_.Arguments)"
        }
    }
}

Write-Host "[+] Hunt complete." -ForegroundColor Green