Trigona Exfiltration Tooling, OceanLotus PyPI Supply Chain & QUIC RAT in DAEMON Tools: OTX Pulse Analysis — Enterprise Detection Pack

title: Trigona Custom Exfiltration Tool Execution
id: 8a4f1c32-2026-5000-8000-000000000001
description: Detects execution of Trigona ransomware affiliate custom exfiltration tool uploader_client.exe or related tooling.
status: experimental
date: 2026/05/08
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66521c02285f5f7e4e555555
tags:
    - attack.exfiltration
    - attack.t1041
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\uploader_client.exe'
            - '\malextractor.exe'
            - '\HRSword.exe'
            - '\PCHunter.exe'
    condition: selection
falsepositives:
    - Unknown
level: critical

---
title: OceanLotus PyPI Malicious Package Installation
id: 8b4f1c32-2026-5000-8000-000000000002
description: Detects installation of suspected malicious PyPI packages used by OceanLotus to distribute ZiChatBot.
status: experimental
date: 2026/05/08
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66521c02285f5f7e4e666666
tags:
    - attack.initial_access
    - attack.t1195
logsource:
    category: process_creation
    product: windows
detection:
    selection_cli:
        CommandLine|contains:
            - 'pip install uuid32-utils'
            - 'pip install colorinal'
            - 'pip install termncolor'
    selection_img:
        Image|endswith:
            - '\python.exe'
            - '\pip.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate developer installing these specific (fake) packages manually (unlikely)
level: high

---
title: DAEMON Tools Compromise - QUIC RAT
id: 8c4f1c32-2026-5000-8000-000000000003
description: Detects execution of trojaned binaries in compromised DAEMON Tools installer versions.
status: experimental
date: 2026/05/08
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66521c02285f5f7e4e777777
tags:
    - attack.persistence
    - attack.t1543
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\DTShellHlp.exe'
            - '\DTHelper.exe'
            - '\DiscSoftBusServiceLite.exe'
    filter_legit:
        Hashes|contains:
            - 'SHA256=816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019' # Example malicious hash from pulse
            - 'SHA256=a916e56121212613d17932e124b68752c9312e73bde8f2351054bd64394257df'
    condition: selection and filter_legit
falsepositives:
    - Legitimate DAEMON Tools update (verify hash against vendor site)
level: critical

// Hunt for Trigona tools and OceanLotus PyPI indicators
let TrigonaFiles = dynamic(["uploader_client.exe", "malextractor.exe", "HRSword.exe"]);
let OceanLotusPackages = dynamic(["uuid32-utils", "colorinal", "termncolor"]);
let DaemonToolsFiles = dynamic(["DTShellHlp.exe", "DTHelper.exe", "DiscSoftBusServiceLite.exe"]);
DeviceProcessEvents
| where FileName in~ TrigonaFiles or 
      ProcessCommandLine has_any (OceanLotusPackages) or 
      FileName in~ DaemonToolsFiles
| extend Timestamp = TimeGenerated, HostName = DeviceName, Account = InitiatingProcessAccountName
| project Timestamp, HostName, Account, FileName, ProcessCommandLine, FolderPath, SHA256, InitiatingProcessParentFileName
| order by Timestamp desc

<#
.SYNOPSIS
    IOC Scanner for Trigona, OceanLotus, and DAEMON Tools Compromise.
.DESCRIPTION
    Scans for specific file hashes and filenames associated with the OTX Pulse data.
#>

$MaliciousHashes = @(
    "e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173", # Trigona uploader
    "a916e56121212613d17932e124b68752c9312e73bde8f2351054bd64394257df", # QUIC RAT Daemon Tools
    "08a75a092e9793b6d3eb473c246d3c5e4750cd525342276d8bf1ab7d1fe45112"  # OceanLotus/ZiChatBot
)

$TargetPaths = @("C:\Program Files (x86)", "C:\Program Files", "$env:USERPROFILE\AppData\Local", "$env:TEMP")

Write-Host "[+] Starting Dark Web IOC Hunt..." -ForegroundColor Cyan

foreach ($Path in $TargetPaths) {
    if (Test-Path $Path) {
        Write-Host "[*] Scanning $Path..." -ForegroundColor Gray
        
        # Hunt for Trigona/Daemon Tools specific filenames
        $SuspectFiles = Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | 
                        Where-Object { $_.Name -match "uploader_client|DTShellHlp|DTHelper" }
                        
        foreach ($File in $SuspectFiles) {
            Write-Host "[!] Suspicious Filename Found: $($File.FullName)" -ForegroundColor Yellow
            $Hash = Get-FileHash -Path $File.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
            if ($Hash.Hash -in $MaliciousHashes) {
                Write-Host "[!!!] CONFIRMED MALICIOUS HASH: $($File.FullName)" -ForegroundColor Red
            }
        }
    }
}

# Check for Python packages (OceanLotus) - checks site-packages directories
$PythonPaths = @("C:\Python*", "$env:LOCALAPPDATA\Programs\Python*")
foreach ($PPath in $PythonPaths) {
    $Resolved = Resolve-Path $PPath -ErrorAction SilentlyContinue
    if ($Resolved) {
        $LibPath = Join-Path $Resolved "Lib\site-packages"
        if (Test-Path $LibPath) {
            Write-Host "[*] Checking Python Site-Packages for OceanLotus IOCs..." -ForegroundColor Gray
            Get-ChildItem -Path $LibPath -Directory -ErrorAction SilentlyContinue | 
            Where-Object { $_.Name -match "uuid32-utils|colorinal|termncolor" } | 
            ForEach-Object { Write-Host "[!] Malicious Package Found: $($_.FullName)" -ForegroundColor Red }
        }
    }
}
Write-Host "[+] Hunt Complete." -ForegroundColor Green