TroyDen Lure Factory, NuGet Supply Chain & Remus Stealer v2: OTX Pulse Analysis — Enterprise Detection Pack

title: Suspicious NuGet Package Child Process Execution
id: 4e8f9a1b-2c3d-4f5e-8g9h-1i2j3k4l5m6n
description: Detects child processes spawned by NuGet or MSBuild that exhibit malicious behavior, such as PowerShell spawning from a build context or connections to non-Microsoft domains.
status: experimental
date: 2026/05/11
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66000000
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\nuget.exe'
            - '\msbuild.exe'
            - '\devenv.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
    selection_network:
        NetworkEvent: true
        DestinationHostname|contains:
            - '.com'
            - '.net'
    filter_legit:
        DestinationHostname|contains:
            - 'microsoft.com'
            - 'nuget.org'
            - 'visualstudio.com'
            - 'github.com'
    condition: selection_parent and selection_child and selection_network and not filter_legit
falsepositives:
    - Legitimate build scripts that download dependencies from unofficial internal sources
level: high
tags:
    - attack.execution
    - attack.supply_chain
    - nuget

---
title: Potential Lumma Stealer Remus Variant C2 Activity
description: Detects processes attempting to connect to domains associated with the Remus/Lumma 64-bit variant C2 infrastructure, specifically observing connections to suspicious TLDs like .pics, .biz, .live from user-land processes.
status: experimental
date: 2026/05/11
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66000004
logsource:
    category: network_connection
    product: windows
detection:
    selection_suspicious_tlds:
        DestinationHostname|endswith:
            - '.pics'
            - '.biz'
            - '.live'
            - '.online'
    selection_process:
        Image|contains:
            - 'AppData'
            - 'Temp'
            - 'Downloads'
    condition: selection_suspicious_tlds and selection_process
falsepositives:
    - Legitimate adware or rare benign software utilizing similar CDNs
level: high
tags:
    - attack.command_and_control
    - attack.exfiltration
    - stealer

---
title: cPanel CVE-2026-41940 Exploitation and Webshell Activity
description: Detects potential exploitation of cPanel auth bypass and subsequent webshell or SSH key manipulation activity on Linux servers.
status: experimental
date: 2026/05/11
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66000003
logsource:
    product: linux
    category: process
detection:
    selection_cpanel_access:
    Image|endswith:
        - '/usr/local/cpanel/bin/cpdavd'
        - '/usr/local/cpanel/cpsrvd'
    selection_webshell_creation:
    TargetFilename|contains:
        - '/var/www/html'
        - '/usr/local/cpanel/base'
    selection_ssh_mod:
    CommandLine|contains:
        - 'ssh-keygen'
        - 'authorized_keys'
    condition: 1 of selection_*
falsepositives:
    - Legitimate cPanel administration tasks
level: critical
tags:
    - attack.initial_access
    - attack.persistence
    - cpanel
    - cve-2026-41940


kql
// Hunt for connections to known IOCs from Pulse data
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ ("dns-providersa2.com", "forestoaker.com", "krondez.com", "baxe.pics", "vinte.online", "coox.live", "remnane.biz", "wrned.com", "wpsock.com") or 
  RemoteIP in~ ("89.169.12.241", "213.176.73.80", "213.176.73.130", "217.119.129.121", "217.119.129.76", "94.156.154.6", "213.176.73.159", "217.119.129.118", "130.12.180.135")
| extend DeviceCustom = pack_all()
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, DeviceCustom

// Hunt for process creation related to AI-Lures and LuaJIT
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (ProcessVersionInfoProductName contains "LuaJIT" or FileName =~ "luajit.exe" or FolderPath contains "\\AppData\\Local\\Temp\\") and 
  (InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "mshta.exe") or ProcessCommandLine contains "-e" )
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256


powershell
# PowerShell Hunt Script for Stealer File Hashes
# Checks specific file hashes provided in OTX pulses against system drives.

$targetHashes = @( 
    "efb675de4b3af3dac3c9cae91075fd7cc2f4f98e", 
    "019e6c2cf58386039133981f3377b085fbd70c98ae8613c7c6a4f10a9f2d9824", 
    "34e2d63b5db7e24c808711c2ca0c0a42afde97a0086d7d81609110c002d18d7c", 
    "596c453c9dbb7240f1ce05cc025496524ce7c538c23a9b2171174bf32b5691a1", 
    "02a5990b11293236e01f174f5999df20", 
    "22613c952459e65ce09fb6b5c1c03d47", 
    "2286f126ab4740ccf2595ad1fa0c615c", 
    "29222f5e73dd10088fcf1204aa21f87f", 
    "2de27ca8d97124adaf604b18161a441e", 
    "b037fa1dd769891b538d9ca26131890c93e3458eec96c5354bdebe50d04a5b3d", 
    "0d681bd160db1b1df5db321a6d2dd9ae81b2609b" 
)

Write-Host "[+] Starting scan for known stealer IOCs..."

$drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($hash in $targetHashes) {
    foreach ($drive in $drives) {
        Write-Host "[*] Scanning $drive for hash $hash..."
        Get-ChildItem -Path $drive -Recurse -ErrorAction SilentlyContinue | 
        ForEach-Object {
            $fileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($fileHash -eq $hash) {
                Write-Host "[!] MATCH FOUND: $($_.FullName)" -ForegroundColor Red
            }
            # Also checking MD5 for the specific Mr_Rot13 indicators
            $fileHashMD5 = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($fileHashMD5 -eq $hash) {
                Write-Host "[!] MATCH FOUND (MD5): $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}
Write-Host "[+] Scan complete."