Transparent Tribe (APT36) Deploys RUSTYSHADE Rust Implant via GitHub C2: Detection and Defense Guide

---
title: Unsigned Binary in User-Writable Path Spawning Shell - Suspected Rust Implant Behavior
id: 3f8a2c41-7b1e-4d9a-b6c2-9e5f0a1d3c4b
status: experimental
description: Detects unsigned executables running from user-profile or ProgramData paths spawning cmd.exe or powershell.exe, consistent with Rust-based implants (RUSTYSHADE/RUSTYMOVE) executing tasking retrieved from dead-drop C2.
references:
  - https://thehackernews.com/2026/09/transparent-tribe-deploys-new-rust.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    ParentImage|contains:
      - '\AppData\Roaming\'
      - '\AppData\Local\'
      - '\ProgramData\'
      - '\Users\Public\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  filter_known:
    ParentImage|contains:
      - '\Microsoft\Teams\'
      - '\slack\'
      - '\discord\'
      - '\Code\'
      - '\JetBrains\'
  condition: selection_path and selection_child and not filter_known
falsepositives:
  - Electron-based chat/collaboration apps spawning shells for updates
  - Developer tooling installed in user scope
level: high
---
title: Non-Developer Process Network Connection to GitHub API
id: 8c1d4e72-5a3b-4f6c-9d2e-1b7a0c3e5f68
status: experimental
description: Detects processes outside an expected developer/tooling baseline initiating connections to GitHub API or raw content endpoints, consistent with implants using private GitHub repositories as a dead-drop C2 channel as reported for Transparent Tribe.
references:
  - https://thehackernews.com/2026/09/transparent-tribe-deploys-new-rust.html
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.command_and_control
  - attack.t1102.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_dest:
    DestinationHostname|endswith:
      - 'api.github.com'
      - 'raw.githubusercontent.com'
      - 'uploads.github.com'
      - 'objects.githubusercontent.com'
  filter_tools:
    Image|endswith:
      - '\git.exe'
      - '\git-remote-https.exe'
      - '\gh.exe'
      - '\Code.exe'
      - '\devenv.exe'
      - '\idea64.exe'
      - '\cursor.exe'
      - '\node.exe'
      - '\python.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  filter_path:
    Image|contains:
      - '\GitHub Desktop\'
      - '\GitHubDesktop\'
  condition: selection_dest and not filter_tools and not filter_path
falsepositives:
  - Package managers and auto-updaters fetching from GitHub (tune per environment baseline)
  - CI/CD agents - scope out build server subnets in your SIEM layer
level: high
---
title: Encoded or Download-Cradle PowerShell Consistent with PSNATCH-Style Staging
id: 5e2b9a18-4c7d-4e1a-8f3b-6d0c2a9b1e47
status: experimental
description: Detects PowerShell execution patterns typical of script-based payloads such as PSNATCH - encoded commands, download cradles, and hidden window execution from non-standard parent processes.
references:
  - https://thehackernews.com/2026/09/transparent-tribe-deploys-new-rust.html
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_flags:
    CommandLine|contains:
      - ' -enc '
      - ' -encodedcommand'
      - ' -ec '
      - ' -w hidden'
      - ' -windowstyle hidden'
      - 'iex('
      - 'invoke-expression'
      - 'downloadstring'
      - 'invoke-webrequest'
      - 'invoke-restmethod'
  filter_admin:
    ParentImage|endswith:
      - '\sccm\ccmexec.exe'
      - '\svchost.exe'
  condition: selection_img and selection_flags and not filter_admin
falsepositives:
  - Enterprise software deployment tooling using encoded PowerShell
  - Administrative automation - baseline and allowlist known management parent processes
level: medium

// Hunt: Processes outside a developer baseline talking to GitHub C2-capable endpoints,
// correlated with periodic (beacon-like) connection cadence - Transparent Tribe GitHub dead-drop C2 pattern.
let Lookback = 7d;
let GitHubEndpoints = dynamic(["api.github.com", "raw.githubusercontent.com", "objects.githubusercontent.com", "uploads.github.com"]);
let DevTools = dynamic(["git.exe", "git-remote-https.exe", "gh.exe", "Code.exe", "devenv.exe", "node.exe",
    "python.exe", "chrome.exe", "msedge.exe", "firefox.exe", "idea64.exe", "cursor.exe", "GitHubDesktop.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl in (GitHubEndpoints) or RemoteUrl endswith ".githubusercontent.com"
| where not (InitiatingProcessFileName in (DevTools))
| summarize ConnectionCount = count(),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            DistinctRemoteIPs = dcount(RemoteIP),
            CommandLines = make_set(InitiatingProcessCommandLine, 5)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteUrl
| where ConnectionCount >= 10  // periodic polling over the lookback window
| extend SuspiciousPath = InitiatingProcessFolderPath has_any ("\\AppData\\", "\\ProgramData\\", "\\Users\\Public\\", "\\Temp\\")
| project FirstSeen, LastSeen, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath,
          RemoteUrl, ConnectionCount, SuspiciousPath, CommandLines
| order by SuspiciousPath desc, ConnectionCount desc;

-- Hunt: Unsigned/odd executables in user-writable paths with active or recent
-- network connections to GitHub infrastructure - RUSTYSHADE/RUSTYMOVE endpoint sweep.
LET conns <= SELECT Pid, Name, Path, Status,
       Laddr.IP AS LocalIP, Laddr.Port AS LocalPort,
       Raddr.IP AS RemoteIP, Raddr.Port AS RemotePort
FROM netstat()
WHERE RemotePort = 443
  AND (Path =~ '(?i)AppData|ProgramData|Users\\\\Public|Temp')

SELECT Pid, Name, Path, Status, LocalIP, LocalPort, RemoteIP, RemotePort,
       timestamp(epoch=now()) AS CollectionTime
FROM conns
ORDER BY Name

-- Companion artifact: enumerate recently created executables in staging directories
-- LET drops <= SELECT FullPath, Size, Mtime, Btime
-- FROM glob(globs=['C:/Users/*/AppData/Roaming/**/*.exe',
--                  'C:/Users/*/AppData/Local/**/*.exe',
--                  'C:/ProgramData/**/*.exe'])
-- WHERE Mtime > now() - 1209600   -- last 14 days
--   AND Size > 2000000            -- Rust static binaries are typically multi-MB
-- SELECT FullPath, Size, Mtime FROM drops ORDER BY Mtime DESC

# Transparent Tribe / GitHub-C2 exposure audit and hardening - run elevated on Windows endpoints.
# Purpose: (1) find non-developer processes holding GitHub sessions, (2) audit staging dirs for
# recent large unsigned binaries, (3) verify Script Block Logging for PSNATCH-style payloads.

$ghCidrs = @("140.82.112.0/20","185.199.108.0/22","4.237.0.0/16","20.26.0.0/16")  # core GitHub ranges - refresh from https://api.github.com/meta

# 1. Live connections to GitHub from unexpected processes
$ghIPs = (Invoke-RestMethod -Uri "https://api.github.com/meta" -UseBasicParsing).web +
         (Invoke-RestMethod -Uri "https://api.github.com/meta" -UseBasicParsing).api |
         Where-Object { $_ -match '^\d' } | ForEach-Object { ($_ -split '/')[0] }
Get-NetTCPConnection -State Established -RemotePort 443 -ErrorAction SilentlyContinue |
  Where-Object { $ghIPs -contains $_.RemoteAddress } |
  ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Time=Get-Date; Process=$p.ProcessName; Path=$p.Path; Remote=$_.RemoteAddress }
  } | Format-Table -AutoSize

# 2. Recent (>2MB) unsigned executables in common implant staging paths (Rust binaries are large)
$staging = "$env:APPDATA","$env:LOCALAPPDATA","C:\ProgramData","C:\Users\Public"
Get-ChildItem -Path $staging -Recurse -Filter *.exe -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and $_.Length -gt 2MB } |
  ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -ne 'Valid') {
      [PSCustomObject]@{ Path=$_.FullName; SizeMB=[math]::Round($_.Length/1MB,1); Modified=$_.LastWriteTime; Signature=$sig.Status }
    }
  } | Sort-Object Modified -Descending | Format-Table -AutoSize

# 3. Verify PowerShell Script Block Logging is enabled (critical for PSNATCH detection)
$sbl = Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -ErrorAction SilentlyContinue
if (-not $sbl -or $sbl.EnableScriptBlockLogging -ne 1) {
  Write-Warning "Script Block Logging DISABLED - enabling"
  New-Item "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force | Out-Null
  Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
}

# 4. Confirm Sysmon/audit coverage: process creation with command line (Event 4688 cmdline)
$audit = (auditpol /get /subcategory:"Process Creation" 2>$null) -join ' '
if ($audit -notmatch 'Success') { Write-Warning "Process Creation auditing not capturing Success events - remediate via GPO" }

#!/bin/bash
# Linux-side hunt for BASHNATCH-style staging and GitHub C2 beacons. Run via your EDR remote shell or cron.
# 1. Bash processes holding outbound 443 sessions (scripts should rarely hold sockets directly)
ss -tnp state established '( dport = :443 )' 2>/dev/null | grep -E 'bash|sh,' || echo "[+] No shell-held 443 sessions"

# 2. Cron/systemd persistence dropped in the last 14 days (common for script implants)
find /etc/cron* /var/spool/cron /etc/systemd/system ~/.config/systemd 2>/dev/null -type f -mtime -14 -ls

# 3. Recent ELF binaries in world-writable or home staging paths (BASHNATCH fetch-and-run targets)
find /tmp /var/tmp /dev/shm /home -type f -executable -mtime -7 2>/dev/null -exec file {} \; | grep -i elf

# 4. Shell history artifacts showing GitHub API token usage or curl to raw.githubusercontent
grep -rE 'api\.github\.com|raw\.githubusercontent\.com|Authorization: token|GITHUB_TOKEN' /home/*/.bash_history /root/.bash_history 2>/dev/null