The Gentlemen's EtherRAT & Shai-Hulud npm Supply Chain: OTX Pulse Analysis — Enterprise Detection Pack

title: Potential EtherRAT C2 via Ethereum RPC Node Access
id: 4a88e1b0-7f9c-4a2e-9e1f-1a2b3c4d5e6f
description: Detects processes making RPC connections to Ethereum public nodes, a behavior associated with EtherRAT C2 infrastructure resolving domains via smart contracts.
status: experimental
date: 2026/08/05
author: Security Arsenal
references:
    - https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
detection:
    selection:
        DestinationPort|startswith: '854'
        Initiated: 'true'
    filter:
        Image|endswith:
            - '\node.exe'
            - '\explorer.exe'
    condition: selection and not filter
falsepositives:
    - Legitimate Web3 or cryptocurrency applications
level: high
---
title: The Gentlemen Lateral Movement Tools Execution
id: b99f2c2a-8e1d-4f3a-9b0c-2d3e4f5a6b7c
description: Detects execution of known lateral movement and tunneling tools (Chisel, Ligolo-ng, Sliver) often used by The Gentlemen affiliates.
status: experimental
date: 2026/08/05
author: Security Arsenal
references:
    - https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2
tags:
    - attack.lateral_movement
    - attack.t1021.001
logsource:
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\chisel.exe'
            - '\ligolo-ng.exe'
            - '\sliver-client.exe'
            - '\sliver-server.exe'
    condition: selection
falsepositives:
    - Authorized administrator usage of tunneling tools
level: critical
---
title: Shai-Hulud NPM Supply Chain Malicious Process Spawn
id: c00g3d3b-9f2e-5g4c-0d1e-3f4g5h6i7j8k
description: Detects suspicious child processes spawned by Node.js or NPM after installing compromised keyv/cacheable packages, indicative of Shai-Hulud activity.
status: experimental
date: 2026/08/05
author: Security Arsenal
references:
    - https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack
tags:
    - attack.initial_access
    - attack.supply_chain
logsource:
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
    selection_child:
        Image|contains:
            - 'powershell'
            - 'cmd'
            - 'bash'
        CommandLine|contains:
            - 'npm-cache.com'
            - 'pypi-get.com'
    condition: all of selection_*
falsepositives:
    - Legitimate build scripts invoking shells
level: high

// Hunt for The Gentlemen C2 IP connections and Chisel/Ligolo processes
let GentlemenIOCs = dynamic(["193.233.202.17", "185.45.193.151", "38.110.228.43", "77.110.122.137", "77.110.126.46"]);
let ShaiHuludDomains = dynamic(["npm-cache.com", "pypi-get.com", "js-mirror.com"]);
// Network Connections
DeviceNetworkEvents
| where RemoteIP in (GentlemenIOCs) or RemoteUrl has_any (ShaiHuludDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl
| extend IoCType = iff(RemoteIP in (GentlemenIOCs), "Gentlemen_IP", "ShaiHulud_Domain")
| order by Timestamp desc
;
// Process Creation
DeviceProcessEvents
| where FileName in~ ("chisel.exe", "ligolo-ng.exe", "mimikatz.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
| order by Timestamp desc

# IOC Hunt for The Gentlemen and Shai-Hulud
# Requires Admin privileges for certain checks

$GentlemenIPs = @("193.233.202.17", "185.45.193.151", "38.110.228.43", "77.110.122.137", "77.110.126.46")
$ShaiHuludHashes = @("35a672cf34b996b91f3e1c28cbf3a05a37e036e4", "686aa40d0fc22c8d569494543a0f891f359f2f99", "f525d52ceb966516686b482d3dc0137028cc6a63")

Write-Host "[+] Checking for active network connections to Gentlemen C2 IPs..." -ForegroundColor Cyan
$ActiveConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($IP in $GentlemenIPs) {
    if ($ActiveConnections.RemoteAddress -eq $IP) {
        Write-Host "[ALERT] Active connection found to: $IP" -ForegroundColor Red
        Get-Process -Id (Get-NetTCPConnection -RemoteAddress $IP).OwningProcess | Select-Object ProcessName, Id, Path
    }
}

Write-Host "[+] Scanning for Shai-Hulud malicious file hashes (Node.js modules)..." -ForegroundColor Cyan
# Common NPM cache locations
$PathsToScan = @("$env:APPDATA\npm-cache", "$env:USERPROFILE\node_modules", "$env:APPDATA\npm")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA1).Hash
            if ($ShaiHuludHashes -contains $Hash) {
                Write-Host "[ALERT] Malicious file found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking for Suspicious Scheduled Tasks (Persistence)..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*powershell*" -or $_.Actions.Execute -like "*cmd*" } | 
    Select-Object TaskName, TaskPath, State, Actions