XenoRAT LNK Campaigns, pepesoft.exe Supply-Chain Implant & Aurora Ransomware Leak: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Suspicious DNS-over-HTTPS Usage and pepesoft Implant Execution
id: 7f3a1b2e-4c5d-4e6f-9a8b-1c2d3e4f5a01
status: experimental
description: Detects pepesoft.exe NuGet supply-chain implant execution, PyInstaller child process behavior, and DNS-over-HTTPS evasion to public DoH resolvers (dns.google, cloudflare-dns.com) consistent with OTX pulse of malicious NuGet game-cheat tools.
author: Security Arsenal Threat Intelligence
references:
    - https://socket.dev/blog/11-malicious-nuget-tools-pose-as-game-cheats
date: 2026/08/28
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1105
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_pepe:
        Image|endswith: '\pepesoft.exe'
    selection_nuget_child:
        ParentImage|endswith:
            - '\dotnet.exe'
            - '\nuget.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\curl.exe'
            - '\cmd.exe'
    selection_doh:
        CommandLine|contains:
            - 'dns.google'
            - 'cloudflare-dns.com'
            - 'dns-query'
            - 'application/dns-message'
    condition: 1 of selection_*
falsepositives:
    - Legitimate developer tooling invoking package managers; browsers with DoH enabled
level: high
---
title: Kimsuky XenoRAT LNK Spear-Phishing Execution Chain
id: 8b4c2d3f-5e6f-4a7b-8c9d-2e3f4a5b6c02
status: experimental
description: Detects LNK files spawning PowerShell, curl.exe, or AutoIt payloads and subsequent DLL side-loading, matching Kimsuky July 2026 XenoRAT spear-phishing tradecraft reported by AhnLab.
author: Security Arsenal Threat Intelligence
references:
    - https://asec.ahnlab.com/en/95171
date: 2026/08/28
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.t1204.002
    - attack.t1218
    - attack.t1574.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_lnk_parent:
        ParentImage|endswith: '\explorer.exe'
        CommandLine|contains: '.lnk'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\curl.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
    selection_download_cradle:
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - 'github.com'
            - 'drive.google.com'
            - 'dropbox.com'
    condition: selection_lnk_parent and selection_child and selection_download_cradle
falsepositives:
    - Enterprise software deployment shortcuts
level: high
---
title: Aurora Ransomware ESXi Encryption and AD Pre-Encryption Staging
id: 9d5e3f4a-6b7c-4d8e-9f0a-3b4c5d6e7f03
status: experimental
description: Detects Aurora ransomware affiliate behaviors including ESXi VM mass shutdown prior to encryption, SMBv1/EternalBlue-era lateral movement (CVE-2017-0144), vssadmin shadow deletion, and suspicious Zig-compiled encryptor execution patterns.
author: Security Arsenal Threat Intelligence
references:
    - https://www.cloudsek.com/blog/aurora-ransomware-affiliate-ai-attack-planning-crypto-payments
date: 2026/08/28
tags:
    - attack.impact
    - attack.t1486
    - attack.t1490
    - attack.t1210
logsource:
    category: process_creation
    product: windows
detection:
    selection_shadow_delete:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'recoveryenabled no'
    selection_esxi_staging:
        CommandLine|contains:
            - 'vim-cmd vmsvc/power.off'
            - 'esxcli vm process kill'
    selection_smbv1_probe:
        CommandLine|contains:
            - 'EnableSMB1Protocol'
            - 'mrxsmb10'
    condition: 1 of selection_*
falsepositives:
    - Legitimate hypervisor administration; backup maintenance windows
level: critical

// Kimsuky XenoRAT LNK phishing + pepesoft DoH surveillance + Aurora staging — unified hunt
let DoHResolvers = dynamic(["dns.google", "cloudflare-dns.com", "mozilla.cloudflare-dns.com", "doh.opendns.com"]);
let KnownHashes = dynamic([
  "d5385526f2f3e52c7d96087611c6cd4e479bf61828400efdb3ca09406d981609",
  "9a2091e6625fc11cfd8f39c17aa271604e66322ee045028946274b988103e35b",
  "900ddb81d27e03967209fee4d17d13deb68eef0e1f10936eb520ca10575cb49e",
  "ab58a90eb3682c6dc3389cd700a64f68a19c0dac3d0fa8e3df97ae041f96d4e1",
  "e6e1049158ceb1971c61388349c81fa6047a7aecb4ff2089ef54a50dcc35dbc0",
  "d9f7ca9f93a7d188d51db308877b15d0beae932ca0bf4705384fbedf54b454c1",
  "4d13f1136b13c871c65141b77ec7208488334ac4be511800196adcd328666305",
  "011926de3d0cc2b970627b9bf0de003e731f8576602dff756d2ab54a9de61972",
  "a4af136d159a8eb96b54924fa80355ca52874913301300f55af7d67ae97edcfe",
  "eb0aab1e892d7e09e2c7bcf1d21fd83c1743ed9196b3efac6c78482fb0d99207"
]);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "pepesoft.exe"
   or SHA256 in~ (KnownHashes)
   or (ProcessCommandLine has_any (DoHResolvers) or ProcessCommandLine has "dns-query")
   or (InitiatingProcessFileName =~ "explorer.exe" and ProcessCommandLine has ".lnk" and FileName in~ ("powershell.exe","curl.exe","mshta.exe","rundll32.exe"))
   or (ProcessCommandLine has_any ("delete shadows","vim-cmd vmsvc/power.off","recoveryenabled no"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256, AccountName),
(DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (DoHResolvers)
   or RemoteUrl has "api.telegram.org"
   or RemoteUrl has "sheets.googleapis.com" and InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort)
| sort by TimeGenerated desc

# OTX Pulse Hunt — pepesoft / XenoRAT / Aurora host artifacts
# Run elevated on endpoints; output JSON for SIEM ingestion
$ErrorActionPreference = 'SilentlyContinue'
$results = @()

# 1. pepesoft.exe and NuGet-tool implant artifacts
$pepePaths = @("$env:TEMP\pepesoft.exe","$env:APPDATA\pepesoft.exe","$env:USERPROFILE\.dotnet\tools","$env:LOCALAPPDATA\Programs")
foreach ($p in $pepePaths) {
    Get-ChildItem -Path $p -Recurse -Filter "pepesoft.exe" -Force | ForEach-Object {
        $results += [PSCustomObject]@{Check='PepeSoftBinary'; Path=$_.FullName; SHA256=(Get-FileHash $_.FullName -Algorithm SHA256).Hash}
    }
}

# 2. Known-bad SHA256 sweep in common staging dirs
$badHashes = @("d5385526f2f3e52c7d96087611c6cd4e479bf61828400efdb3ca09406d981609","9a2091e6625fc11cfd8f39c17aa271604e66322ee045028946274b988103e35b","a4af136d159a8eb96b54924fa80355ca52874913301300f55af7d67ae97edcfe","eb0aab1e892d7e09e2c7bcf1d21fd83c1743ed9196b3efac6c78482fb0d99207")
Get-ChildItem "$env:TEMP","$env:APPDATA","$env:USERPROFILE\Downloads" -Recurse -Include *.exe,*.dll -Force | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
    if ($badHashes -contains $h) { $results += [PSCustomObject]@{Check='KnownBadHash'; Path=$_.FullName; SHA256=$h} }
}

# 3. XenoRAT persistence: Run keys, scheduled tasks with suspicious LOLBins
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
    (Get-ItemProperty $k).PSObject.Properties | Where-Object { $_.Value -match 'powershell|curl|mshta|rundll32|\.lnk' } | ForEach-Object {
        $results += [PSCustomObject]@{Check='SuspiciousRunKey'; Key=$k; Name=$_.Name; Value=$_.Value}
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|curl|mshta' -and $_.TaskPath -notmatch 'Microsoft' } | ForEach-Object {
    $results += [PSCustomObject]@{Check='SuspiciousScheduledTask'; Name=$_.TaskName; Action=$_.Actions.Execute}
}

# 4. Recent LNK execution artifacts (Kimsuky delivery vector)
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Recent" -Filter *.lnk -Force | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | ForEach-Object {
    $results += [PSCustomObject]@{Check='RecentLNK'; Path=$_.FullName; LastWrite=$_.LastWriteTime}
}

# 5. Network: Telegram C2, DoH resolvers, Google Sheets exfil
Get-NetTCPConnection -State Established | Where-Object { $_.RemotePort -in 443,853 } | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess).ProcessName
    if ($proc -match 'pepesoft|python|dotnet|autoit') {
        $results += [PSCustomObject]@{Check='SuspiciousEgress'; Process=$proc; Remote=$_.RemoteAddress; Port=$_.RemotePort}
    }
}

# 6. Aurora staging: SMBv1 enabled + shadow copy status
$smb1 = (Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol).State
if ($smb1 -eq 'Enabled') { $results += [PSCustomObject]@{Check='SMBv1Enabled'; State=$smb1} }
$shadows = (vssadmin list shadows 2>$null)
if (-not $shadows -match 'shadow copies') { $results += [PSCustomObject]@{Check='NoShadowCopies'; Note='Possible pre-encryption deletion'} }

$results | ConvertTo-Json -Depth 4