Inferlume

title: Inbound HTTP Request Originating From ARTEX Campaign Proxy Node
id: c7e1f482-628d-4b91-987d-8a5e84011008
status: experimental
description: Detects inbound web traffic targeting enterprise assets originating from proxy IPs identified in the ARTEX campaign.
logsource:
  category: webserver
detection:
  selection_ip:
    c-ip:
      - '101.53.80.20'
      - '205.214.59.31'
      - '124.155.252.63'
      - '154.201.79.246'
      - '23.248.249.90'
      - '23.158.220.98'
      - '103.248.148.84'
      - '203.160.133.172'
      - '209.209.85.38'
      - '38.244.50.120'
  condition: selection_ip
falsepositives:
  - Legitimate traffic traversing shared hosting egress
level: high

title: Citrix NetScaler Suspicious Handler Modification in httpd.conf
id: d8b4f902-3e5f-4c9a-8d23-9f4b3e2d6c78
status: experimental
description: Identifies unauthorized modifications to httpd.conf registering archive and image extensions as PHP handlers.
logsource:
  product: linux
  service: file_integrity
detection:
  selection:
    file_name|endswith: '/etc/httpd.conf'
    command_line|contains:
      - 'AddHandler application/x-httpd-php .deb'
      - 'AddHandler application/x-httpd-php .sig'
      - 'AddHandler application/x-httpd-php .ico'
  condition: selection
falsepositives:
  - None expected in production NetScaler appliances
level: critical

title: Atlassian Data Center Web Resource Path Traversal Attempt
id: b41a9981-12ef-4c12-8871-3a9d8214ec01
status: experimental
description: Detects web requests attempting path traversal against Atlassian download resource handlers using double colon encodings.
logsource:
  category: webserver
detection:
  selection_route:
    cs-uri-stem|contains: '/download/resources/'
  selection_pattern:
    cs-uri|contains:
      - '..%3a%3a'
      - '..::'
      - 'crowd.properties'
      - 'web.xml'
  selection_status:
    sc-status: 200
  condition: selection_route and selection_pattern and selection_status
falsepositives:
  - Internal vulnerability testing
level: critical

// Splunk SPL: Citrix NetScaler Authentication Parameter Hunting
index=citrix sourcetype=netscaler:auth
| search authentication_event
| eval user_length=len(username)
| where user_length > 50 OR match(username, "[;\|\$\`]")
| table _time, src_ip, username, action, result

// Splunk SPL: FortiGate Administrative User Creation Hunt
index=fortigate sourcetype=fortinet:fgt:event
| search logdesc="Admin user added" OR logdesc="Admin user deleted"
| table _time, src_ip, user, ui, action, status
| where user IN ("fortiAdmin", "forticloud-sync", "support_fortinet", "system_config")

// Splunk SPL: Suspicious Web Probing Targeting Claude Artifacts
index=web_proxy OR index=waf_logs
| where match(uri_path, "/\.claude/") OR match(uri_path, "CLAUDE\.md") OR match(uri_path, "xcai\.pro")
| table _time, src_ip, dest_host, uri_path, http_status

rule WHIPSHOT_PHP_Webshell_Disguised_Debian {
    meta:
        description = "Detects WHIPSHOT PHP webshell deployed on Citrix NetScaler disguised as Debian package"
        author = "Threat Research"
        date = "2026/10/08"
        hash = "ae22ef2517b5c0fb47f78745b9cb5260acee0e751b89bcd354640ff8bc8d29ec"
    strings:
        $php = "<?php" ascii
        $header_cmd = "$_SERVER['HTTP_X_COMMAND'" ascii
        $header_data = "$_SERVER['HTTP_X_DATA'" ascii
        $decode = "base64_decode" ascii
        $proc = "proc_open" ascii
        $proxy = "127.0.0.1:8443" ascii
        $fake_404 = "HTTP/1.1 404 Not Found" ascii
    condition:
        $php and 3 of ($header_cmd, $header_data, $decode, $proc, $proxy, $fake_404)
}

rule ARTEX_Agentic_AI_Artifacts {
    meta:
        description = "Detects staging files and system prompts associated with the ARTEX agentic framework"
        author = "Threat Research"
        date = "2026/10/08"
    strings:
        $s1 = "ARTEX" ascii wide
        $s2 = "CLAUDE.md" ascii wide
        $s3 = "xcai.pro" ascii wide nocase
        $s4 = "DeepSeek" ascii wide nocase
        $s5 = "/.claude/CLAUDE.md" ascii wide
    condition:
        3 of them
}