Inferlume

title: Gamaredon HTA Dropped in Windows Startup Folder (CVE-2025-8088 / PteroSand)
status: experimental
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\Start Menu\Programs\Startup\'
    TargetFilename|endswith:
      - '.hta'
      - '.lnk'
      - '.vbs'
    Image|endswith:
      - '\winrar.exe'
      - '\7z.exe'
      - '\wscript.exe'
      - '\mshta.exe'
  condition: selection
falsepositives:
  - Legitimate enterprise startup scripts (verify against inventory)
level: high
tags:
  - attack.persistence
  - attack.t1547.001
  - gamaredon

title: Gamaredon Dead Drop C2 — Outbound to Paste/Cloud Services from Scripting Engine
status: experimental
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\powershell.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\cscript.exe'
  selection_dest:
    DestinationHostname|contains:
      - 'telegra.ph'
      - 'gofile.io'
      - 'rentry.co'
      - 'write.as'
      - 'nopaste.net'
      - 'paste.ee'
      - 'dev.to'
      - 'lesma.eu'
  condition: selection_process and selection_dest
falsepositives:
  - Developer tooling, legitimate PowerShell automation
level: high
tags:
  - attack.command_and_control
  - attack.t1102
  - gamaredon

index=wineventlog EventCode=4104
| where match(ScriptBlockText, "(?i)(telegra\.ph|gofile\.io|rentry\.co|write\.as|nopaste\.net)")
| eval severity="HIGH"
| stats count by ComputerName, UserName, ScriptBlockText
| sort -count

rule Gamaredon_PteroFamily_InMemory_PS_Loader {
    meta:
        description = "Detects Gamaredon Ptero* PowerShell in-memory loader patterns"
        actor = "Gamaredon / UAC-0010"
        confidence = "medium"
    strings:
        $ptero1 = "PteroDee" ascii nocase
        $ptero2 = "PteroCache" ascii nocase
        $ptero3 = "PteroDum" ascii nocase
        $ptero4 = "PteroOdd" ascii nocase
        $ptero5 = "PteroEffigy" ascii nocase
        $ptero6 = "PteroPaste" ascii nocase
        $iex = "IEX" ascii nocase
        $bypass = "-EncodedCommand" ascii nocase
        $reflective = "[System.Reflection.Assembly]::Load" ascii
    condition:
        (any of ($ptero*)) or
        ($iex and ($bypass or $reflective) and 1 of ($ptero*))
}

title: Check Point VPN CVE-2026-50751 — Unauthenticated IKEv1 Session Established
status: experimental
logsource:
  product: checkpoint
  service: vpn
detection:
  selection:
    event_type: 'VPN session established'
    auth_method: 'certificate'
    ike_version: 'IKEv1'
    user: '-'
  condition: selection
falsepositives:
  - Service accounts with certificate auth (verify against whitelist)
level: critical
tags:
  - attack.initial_access
  - attack.t1133
  - cve.2026-50751

title: Qilin Pre-Encryption Data Staging via Unauthorized RMM
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\anydesk.exe'
      - '\ScreenConnect.ClientService.exe'
      - '\splashtop.exe'
      - '\teamviewer.exe'
  filter_legit:
    ParentImage|endswith:
      - '\services.exe'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate IT remote support (correlate with change tickets)
level: high
tags:
  - attack.command_and_control
  - attack.t1219
  - qilin

title: Qilin Ransomware — VSS Shadow Copy Deletion
status: stable
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin resize shadowstorage'
  selection_wmic:
    CommandLine|contains: 'wmic shadowcopy delete'
  selection_pwsh:
    CommandLine|contains:
      - 'Get-WmiObject Win32_ShadowCopy'
      - '.Delete()'
  condition: 1 of selection_*
level: critical
tags:
  - attack.impact
  - attack.t1490
  - qilin