Inferlume

title: Cisco ISE Unauthenticated Administrative API Invocation
status: experimental
logsource:
  product: cisco_ise
  category: webserver
detection:
  selection_endpoint:
    c_uri|contains:
      - '/api/'
      - '/ers/'
  selection_auth:
    cs_username: '-'
    sc_status: 200
  condition: selection_endpoint and selection_auth
falsepositives:
  - Legitimate anonymous endpoints explicitly configured in administrative documentation
level: critical

title: Orkes Conductor GraalVM Sandbox Escape Code Execution
status: experimental
logsource:
  product: orkes_conductor
  category: application
detection:
  selection_tasks:
    message|contains:
      - 'INLINE'
      - 'LAMBDA'
      - 'DO_WHILE'
      - 'SWITCH'
  selection_payloads:
    message|contains:
      - 'Java.type'
      - 'Runtime.getRuntime'
      - 'allowAllAccess'
      - 'HostAccess.ALL'
  condition: selection_tasks and selection_payloads
falsepositives:
  - Rare administrative workflow templates employing internal reflection
level: critical

title: Suspicious Linux Kernel KEV Subsystem Manipulation
status: experimental
logsource:
  product: linux
  category: process_creation
detection:
  selection_binaries:
    Image|endswith:
      - '/ebtables'
      - '/arptables'
      - '/nft'
      - '/bpftrace'
  selection_indicators:
    CommandLine|contains:
      - 'AF_ALG'
      - 'tls_sw_recvmsg'
      - 'ebt_snat'
      - 'skb_store_bits'
      - '--to-source'
  condition: selection_binaries and selection_indicators
falsepositives:
  - Authorized network engineers configuring container bridging or ebtables rules
level: high

title: macOS IDE Spawning Masqueraded Binaries
status: experimental
logsource:
  product: macos
  category: process_creation
detection:
  selection_parent:
    ParentImage|contains:
      - 'Cursor'
      - 'Code'
      - 'Electron'
  selection_child:
    Image|contains:
      - '/Library/com.apple.'
      - '/Library/com.apple.iTunesCloud/'
      - '/Library/com.apple.internal.ck/'
      - '/Library/com.apple.appleaccountd/'
    CommandLine|contains:
      - '--type=renderer'
  condition: selection_parent and selection_child
falsepositives:
  - Highly non standard local developer helper plugins
level: critical

title: ChainScript MSI to WScript to Node Execution Lineage
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection_msi:
    Image|endswith: '\msiexec.exe'
    CommandLine|contains:
      - 'ALLUSERS=2'
      - 'api-configuard'
  selection_wscript:
    Image|endswith: '\wscript.exe'
    CommandLine|contains:
      - '._agent.vbs'
  selection_node:
    Image|endswith: '\node.exe'
    CommandLine|contains:
      - 'app\src\index.js'
    Image|contains:
      - '\AppData\Local'
      - '\AppData\Roaming'
  condition: selection_msi or selection_wscript or selection_node
falsepositives:
  - Legitimate packaged desktop utilities bundling standalone Node runtimes
level: high

rule BlueMoon_V8_Exploit_Pattern
{
    meta:
        description = "Detects V8 type confusion exploit strings associated with BlueMoon kit"
        author = "Consolidated CTI"
        date = "2026/09/21"
    strings:
        $s1 = "HeapObject::IsJSArray" ascii
        $s2 = "Map::kIsArrayBit" ascii
        $s3 = "WasmInstanceObject::exported_functions" ascii
        $s4 = "NtAlpcSendWaitReceivePort" ascii
    condition:
        3 of them
}

rule Orkes_GraalVM_RCE_Payload
{
    meta:
        description = "Detects GraalVM reflection escape payloads in workflow definitions"
        author = "Consolidated CTI"
        date = "2026/09/21"
    strings:
        $g1 = "Java.type(\"java.lang.Runtime\")" ascii
        $g2 = "Runtime.getRuntime().exec" ascii
        $g3 = "allowAllAccess(true)" ascii
        $g4 = "HostAccess.ALL" ascii
    condition:
        any of them
}

rule macOS_Rust_Backdoor_FLATROOF_ROOFDECK
{
    meta:
        description = "Heuristic detection for Jade Sleet Rust ARM64 implants"
        author = "Consolidated CTI"
        date = "2026/09/21"
    strings:
        $p1 = "com.apple.internal.ck/iSync" ascii
        $p2 = "com.apple.iTunesCloud/SystemUpdate" ascii
        $p3 = "com.apple.appleaccountd/loginwindow" ascii
        $c1 = "/app_version" ascii
        $c2 = "--type=renderer" ascii
        $c3 = ".repl_history" ascii
        $c4 = "nostr_public_keys" ascii
        $x1 = "xattr -rd com.apple.quarantine" ascii
    condition:
        uint32(0) == 0xfeedfacf and 3 of them
}

rule ChainScript_Node_Agent_Artifacts
{
    meta:
        description = "Detects ChainScript secondary staging files and configuration keys"
        author = "Consolidated CTI"
        date = "2026/09/21"
    strings:
        $a = "HiddenVirtualSilentLoader.dat" ascii
        $b = "X-Agent-Token" ascii
        $c = "connect-delay-state.json" ascii
        $d = "WinRemoteAgentAutoStart" ascii
        $e = "/api/agent/script" ascii
        $f = "wallet_scan" ascii
    condition:
        3 of them
}

rule Ransomware_Sorry_Extension_Marker
{
    meta:
        description = "Detects encrypted files appended with dot sorry extension"
        author = "Consolidated CTI"
        date = "2026/09/21"
    strings:
        $ext = ".sorry" ascii
    condition:
        filesize > 1024 and $ext at (filesize - 6)
}

# SIEM correlation hunting unauthenticated administrative panel access
index=web_logs (destination.port IN (2082, 2083, 2086, 2087, 8443) OR c_uri CONTAINS "/api/")
| where http_status=200 AND (isnull(user) OR user="-" OR user="")
| stats count dc(source.ip) as distinct_ips by host.name, c_uri
| where count > 5

# SIEM detection for outbound scanning characteristic of Mirai infections
index=network_flow direction="outbound" destination.port=23
| stats dc(destination.ip) as target_count by source.ip, host.name, _time span=1h
| where target_count > 50

# SIEM hunt for AWS key quarantine events indicating credential leaks
index=cloudtrail event_name="AttachUserPolicy"
| where request_parameters.policyArn CONTAINS "AWSCompromisedKeyQuarantine"
| table _time, userIdentity.arn, request_parameters.policyArn, recipientAccountId