Inferlume

// SIEM: Defender version exposure alert
// Source: Endpoint management platform (Intune / SCCM / MDE device inventory)

index=endpoint_management
  product="Microsoft Defender"
  platform_version < "4.18.26050.3011"
| stats count BY host, platform_version, last_seen
| where count > 0
| sort last_seen desc

// SIEM: Anomalous SYSTEM-level process creation from Defender service parents
// Behavioral basis: BlueHammer post-exploitation — SYSTEM context process spawned
// from Defender parent is the direct consequence of a successful LPE exploit
// Date scope: April 10 2026 to present (confirmed exploitation start date)

index=windows EventCode=4688
  ParentProcessName IN (
    "MsMpEng.exe", "MpCmdRun.exe", "mpdefui.exe"
  )
  IntegrityLevel="System"
  NOT ProcessName IN (
    "MpCmdRun.exe", "MpSigStub.exe", "NisSrv.exe", "MpDlpCmd.exe"
  )
| where _time >= "2026-04-10T00:00:00Z"
| stats count BY host, ParentProcessName, ProcessName, CommandLine, _time
| where count > 0
| sort _time desc

// SIEM: UnDefend indicator — Defender definition update failure lag
// Behavioral basis: UnDefend blocks Defender definition updates, causing
// progressive signature staleness on affected endpoints
// Threshold: 48 hours stale, tunable per environment SLA

index=windows EventCode IN (2001, 2003)
  SourceName="Microsoft Antimalware"
| stats latest(_time) as last_successful_update BY host
| eval hours_stale = (now() - last_successful_update) / 3600
| where hours_stale > 48
| join type=left host [
    search index=windows EventCode=4688
      ParentProcessName="MsMpEng.exe"
      IntegrityLevel="System"
  ]
| table host, hours_stale, ParentProcessName, ProcessName, CommandLine

// SIEM: SAM registry access by non-authorised process
// Behavioral basis: BlueHammer redirects Defender's privileged operations
// to the SAM hive, exposing local account password hashes

index=windows EventCode=4663
  ObjectName IN (
    "\\REGISTRY\\MACHINE\\SAM",
    "\\REGISTRY\\MACHINE\\SECURITY",
    "\\REGISTRY\\MACHINE\\SYSTEM"
  )
  ProcessName NOT IN (
    "lsass.exe", "svchost.exe", "services.exe",
    "MsMpEng.exe", "regsvc.exe"
  )
| stats count BY host, ProcessName, ObjectName, SubjectUserName, _time
| where count > 0

// YARA: BlueHammer exploitation artifact pattern
// Targets the documented NTFS junction and SAM access combination
// characteristic of the exploit chain

rule BlueHammer_Defender_LPE_Artifacts
{
    meta:
        description = "Detects BlueHammer-style Defender LPE exploit artifacts"
        date = "2026-04-24"
        confidence = "medium"
        source_basis = "Huntress Nightmare Eclipse research, SentinelOne analysis"
    strings:
        $junction = "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy"
                    ascii wide nocase
        $sam_path  = "\\REGISTRY\\MACHINE\\SAM" ascii wide
        $oplock    = "DeviceIoControl" ascii wide
        $ntfs_junc = "CreateSymbolicLink" ascii wide
    condition:
        ($junction and $sam_path) or
        ($ntfs_junc and $sam_path and $oplock)
}

// SIEM: Unauthenticated WebSocket connection to /terminal/ws
// Behavioral basis: The vulnerable endpoint accepts connections
// with no authentication handshake; any access from untrusted IP
// space without a valid session should be treated as an exploitation attempt
// Requires WAF or reverse proxy logs with WebSocket metadata

index=web_proxy OR index=app_gateway
  uri_path="/terminal/ws"
  http_method="GET"
  upgrade_header="websocket"
  NOT (auth_header=* AND session_cookie=*)
| stats count BY src_ip, dest_host, uri_path, user_agent, _time
| where count > 0
| sort _time desc

// SIEM: Post-exploitation process spawning from Marimo container context
// Behavioral basis: Sysdig documented shell and network tool execution
// spawned from Marimo and its WSGI server process parents
// post-exploitation following /terminal/ws RCE

index=container_runtime OR index=linux_auditd
  parent_process IN (
    "marimo", "python3", "uvicorn", "gunicorn", "hypercorn"
  )
  child_process IN (
    "bash", "sh", "dash", "curl", "wget", "python3",
    "nc", "ncat", "nmap", "pip", "npm", "git", "env", "printenv"
  )
| stats count BY host, container_id, parent_process,
                 child_process, cmdline, _time
| where count > 0

// YARA: NKAbuse blockchain botnet loader
// Targets NKAbuse's documented use of the NKN peer-to-peer C2 protocol
// and HuggingFace distribution infrastructure observed in Sysdig research

rule NKAbuse_Blockchain_Botnet_Loader
{
    meta:
        description = "Detects NKAbuse loader artifacts from Marimo campaign"
        date = "2026-04-24"
        confidence = "medium"
        source_basis = "Sysdig Threat Research Team"
    strings:
        $nkn_domain  = "nkn.org" ascii wide
        $nkn_proto   = "NKN" ascii wide
        $blockchain  = "blockchain" ascii nocase wide
        $env_theft   = ".env" ascii
        $hf_dist     = "huggingface" ascii nocase
        $nkabuse_str = "NKAbuse" ascii wide
    condition:
        2 of them
}

// SIEM: IKE service crash or unexpected restart as exploitation attempt indicator
// Behavioral basis: A successful double-free exploit would cause the IKE service
// to crash or restart before achieving code execution in some cases
// Scope to internet-exposed VPN gateway hosts

index=windows EventCode=7034
  Message IN (
    "*IKEEXT*", "*IKE*", "*IPsec*",
    "*Internet Key Exchange*"
  )
  host IN [list_of_internet_exposed_vpn_gateways]
| stats count, earliest(_time) as first_seen, latest(_time) as last_seen
         BY host, Message
| where count > 0
| sort last_seen desc

// SIEM: Ransomware precursor — shadow copy deletion and backup destruction
// Behavioral basis: Storm-1175 Medusa deployment chain includes shadow copy
// deletion as a pre-encryption step; near-universal ransomware precursor signal
// Priority: deploy as Critical alert immediately if not already active

index=windows EventCode=4688
  CommandLine IN (
    "*vssadmin*delete*shadows*",
    "*wmic*shadowcopy*delete*",
    "*bcdedit*/set*safeboot*",
    "*net*stop*backup*",
    "*taskkill*/im*veeam*",
    "*sc*config*backup*disabled*",
    "*wbadmin*delete*",
    "*schtasks*/delete*backup*"
  )
| stats count BY host, user, CommandLine, ParentProcessName, _time
| where count > 0

// SIEM: Web application service spawning anomalous shell children
// Behavioral basis: Storm-1175 initial access via public-facing app exploitation;
// web service process spawning command interpreter is the post-exploitation signal

index=windows EventCode=4688
  ParentProcessName IN (
    "*w3wp.exe*", "*tomcat*", "*javaw.exe*", "*node.exe*",
    "*TeamCity*", "*CrushFTP*", "*SmarterMail*",
    "*BeyondTrust*", "*simplehelp*", "*weblogic*"
  )
  ProcessName IN (
    "cmd.exe", "powershell.exe", "cscript.exe",
    "wscript.exe", "certutil.exe", "bitsadmin.exe",
    "mshta.exe", "regsvr32.exe"
  )
| stats count BY host, ParentProcessName, ProcessName, CommandLine, _time
| where count > 0

// YARA: Medusa ransomware end-stage identification
// Targets Medusa's documented file extension and ransom note naming conventions

rule Medusa_Ransomware_EndStage
{
    meta:
        description = "Detects Medusa ransomware file markers"
        date = "2026-04-24"
        confidence = "high"
        source_basis = "Microsoft TI, BleepingComputer"
    strings:
        $ext1  = ".medusa" ascii wide
        $note1 = "!!!READ_ME_MEDUSA!!!" ascii wide
        $note2 = "MEDUSA_README.txt" ascii wide
        $blog  = "MEDUSA BLOG" ascii wide
    condition:
        any of them
}

// SIEM: Programmatic Slack and Discord API access from non-user context
// Behavioral basis: GopherWhisper routes C2 over Slack and Discord APIs
// using calls that do not originate from legitimate desktop client processes
// Threshold of 10 requests should be tuned per environment baseline

index=proxy OR index=web_gateway
  dest_domain IN (
    "slack.com", "api.slack.com",
    "discord.com", "discordapp.com", "discord.gg"
  )
  user_agent NOT IN [known_slack_client_user_agents]
  src_process NOT IN (
    "slack.exe", "discord.exe", "electron.exe",
    "Teams.exe", "chrome.exe", "firefox.exe"
  )
| stats count, values(user_agent) as agents,
         values(src_process) as processes
         BY src_ip, src_host, dest_domain, _time
| where count > 10

// SIEM: Microsoft 365 Outlook API access from non-standard client context
// Behavioral basis: GopherWhisper uses Outlook API for C2 messaging
// against the Microsoft Unified Audit Log

index=o365_audit OR index=azure_ad
  Operation IN (
    "MailItemsAccessed", "MessageBind",
    "FolderBind", "SendAs"
  )
  ClientInfoString NOT IN [known_mail_client_strings]
  UserAgent NOT IN [known_outlook_user_agents]
| stats count BY UserId, ClientIPAddress,
                 ClientInfoString, UserAgent, _time
| where count > 5

// SIEM: AnyDesk execution on server-class systems
// Behavioral basis: Trigona affiliates use AnyDesk for persistent
// remote access on compromised server environments

index=windows EventCode=4688
  ProcessName IN ("*AnyDesk*", "*anydesk.exe*")
  host_type="server"
| stats count BY host, user, ProcessName, CommandLine, _time
| where count > 0

// SIEM: Trigona custom exfiltration tool execution
// Behavioral basis: uploader_client.exe is Trigona's purpose-built
// exfil binary confirmed in Symantec research via BleepingComputer

index=windows EventCode=4688
  ProcessName="*uploader_client.exe*"
| stats count BY host, user, ProcessName, CommandLine,
                 ParentProcessName, _time
| where count > 0

// YARA: Trigona custom exfiltration tool behavioral signatures
// Targets uploader_client.exe behavioral characteristics from Symantec research

rule Trigona_Custom_Exfil_Tool
{
    meta:
        description = "Detects Trigona uploader_client.exe behavioral markers"
        date = "2026-04-24"
        confidence = "medium"
        source_basis = "Symantec via BleepingComputer"
    strings:
        $tool_name = "uploader_client" ascii wide
        $exfil_ref = "upload" ascii wide
        $rclone_alt = "rclone" ascii nocase wide
        $anydesk    = "AnyDesk" ascii wide
        $mimikatz   = "mimikatz" ascii nocase wide
    condition:
        $tool_name or
        ($exfil_ref and not $rclone_alt and $anydesk)
}

// SIEM: Suspicious POST to Breeze or Gravatar upload endpoints
// Behavioral basis: CVE-2026-3844 is triggered via unauthenticated POST
// to Breeze Gravatar-related upload paths; 200-series response confirms
// successful file write

index=web_server_logs
  http_method="POST"
  uri_path IN (
    "*breeze*", "*gravatar*", "*cloudways*",
    "*cache/upload*", "*wp-content/uploads*"
  )
  src_ip NOT IN [known_admin_ip_ranges]
  http_status IN ("200", "201", "202", "204")
| stats count BY src_ip, uri_path, http_status,
                 filename_uploaded, _time
| where count > 0
| sort _time desc

// SIEM: Data Protection HMAC validation failures on non-Windows ASP.NET hosts
// Behavioral basis: CVE-2026-40372 HMAC bypass; validation failures on
// affected hosts may indicate exploitation attempts against forged payloads

index=application_logs
  application_framework="ASP.NET Core"
  log_level IN ("Error", "Warning")
  message IN (
    "*DataProtection*", "*HMAC*",
    "*validation*failed*", "*unprotect*failed*",
    "*payload*invalid*", "*key*not*found*"
  )
  host_os NOT IN ("Windows")
| stats count BY host, application_name, message, _time
| where count > 0