Inferlume

# SIGMA Rule: LiteLLM Authorization Header SQL Injection Probe
title: LiteLLM Authorization Header SQL Injection Probe
id: a1f3c7d2-9b4e-4f21-bc08-3e5d1a2f6c90
status: experimental
description: >
  Detects SQL injection patterns in the Authorization header of inbound
  HTTP requests to LiteLLM proxy API endpoints. CVE-2026-42208 allows
  unauthenticated attackers to inject SQL via the Bearer token value
  before any authentication check runs.
author: Inferlume CTI
date: 2026-04-29
tags:
  - attack.initial_access
  - attack.credential_access
  - cve.2026-42208
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains:
      - '/chat/completions'
      - '/completions'
      - '/embeddings'
      - '/models'
      - '/key'
    cs-Authorization|contains:
      - "'"
      - 'UNION'
      - 'SELECT'
      - 'WHERE'
      - 'FROM'
      - 'INSERT'
      - 'DROP'
      - '--'
      - 'OR 1'
      - '1=1'
      - 'INFORMATION_SCHEMA'
      - 'pg_tables'
  condition: selection
falsepositives:
  - None expected. Valid Bearer tokens do not contain SQL syntax.
level: high

# SIGMA Rule: Anomalous PostgreSQL Query Against LiteLLM Credential Tables
title: Anomalous Query Against LiteLLM Credential Storage Tables
id: b2e4d8f1-0c5a-4e32-ad19-7f6e2b3g7d01
status: experimental
description: >
  Detects SQL queries referencing LiteLLM credential and configuration
  tables originating from unexpected database users or containing
  injection artifacts such as UNION or SELECT star constructs.
author: Inferlume CTI
date: 2026-04-29
tags:
  - attack.credential_access
  - cve.2026-42208
logsource:
  product: postgresql
  service: audit
detection:
  selection_tables:
    query|contains:
      - 'litellm_credentials'
      - 'litellm_config'
      - 'LiteLLM_VerificationToken'
  selection_anomaly:
    query|contains:
      - 'UNION'
      - 'SELECT *'
      - 'pg_tables'
      - 'information_schema'
  condition: selection_tables and selection_anomaly
falsepositives:
  - Authorized database administration sessions. Validate against change records.
level: critical

# SIGMA Rule: Trigona Ransomware Staging Tool Execution
title: Trigona Ransomware Staging Tool Execution Detected
id: c3f5e9g2-1d6b-4f43-be2a-8g7f3c4h8e12
status: experimental
description: >
  Detects process creation events for tools documented in the Trigona
  ransomware pre-encryption staging chain. These tools are used to
  terminate endpoint protection via vulnerable kernel drivers, establish
  remote access, and harvest credentials before ransomware encryption runs.
author: Inferlume CTI
date: 2026-04-29
tags:
  - attack.defense_evasion
  - attack.credential_access
  - attack.impact
  - malware.trigona
  - actor.rhantus
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\HRSword.exe'
      - '\PCHunter.exe'
      - '\Gmer.exe'
      - '\YDark.exe'
      - '\WKTools.exe'
      - '\DumpGuard.exe'
      - '\StpProcessMonitorByovd.exe'
      - '\uploader_client.exe'
      - '\PowerRun.exe'
  condition: selection
falsepositives:
  - None expected on production systems
level: critical

# SIGMA Rule: AnyDesk Execution on Server Class Host
title: AnyDesk Remote Access Tool Execution on Server
id: d4g6f0h3-2e7c-4g54-cf3b-9h8g4d5i9f23
status: experimental
description: >
  Detects AnyDesk installation or execution on server class hosts.
  AnyDesk has no legitimate administrative use on file servers, domain
  controllers, or infrastructure hosts in standard environments.
  Trigona affiliates deploy AnyDesk for persistent remote access
  during the pre-encryption staging phase.
author: Inferlume CTI
date: 2026-04-29
tags:
  - attack.persistence
  - attack.remote_access
  - malware.trigona
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith: '\AnyDesk.exe'
  filter_workstation:
    ComputerName|contains:
      - 'WS'
      - 'LAPTOP'
      - 'DESK'
  condition: selection_process and not filter_workstation
falsepositives:
  - Authorized IT support sessions on servers. Validate against change records before closing.
level: high

# SIGMA Rule: Mimikatz or Nirsoft Credential Harvesting on Production Host
title: Credential Harvesting Tool Execution in Trigona Attack Chain
id: e5h7g1i4-3f8d-4h65-dg4c-0i9h5e6j0g34
status: experimental
description: >
  Detects execution of Mimikatz and Nirsoft credential harvesting
  utilities on production hosts. These tools are deployed by Trigona
  affiliates to extract account credentials and NTLM hashes during
  the pre-exfiltration staging phase.
author: Inferlume CTI
date: 2026-04-29
tags:
  - attack.credential_access
  - malware.trigona
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\mimikatz.exe'
      - '\mimilib.dll'
      - '\NirCmd.exe'
      - '\WebBrowserPassView.exe'
      - '\MailPassView.exe'
      - '\RouterPassView.exe'
      - '\NetworkPasswordRecovery.exe'
      - '\CredentialsFileView.exe'
      - '\VaultPasswordView.exe'
  condition: selection
falsepositives:
  - Authorized penetration testing. Validate against authorized test windows.
level: critical

# SIGMA Rule: Parallel Outbound Connections from File Server
title: Multiple Simultaneous Outbound TCP Connections from File Server Host
id: f6i8h2j5-4g9e-4i76-eh5d-1j0i6f7k1h45
status: experimental
description: >
  Detects network behavior consistent with uploader_client.exe exfiltration
  tool used by Trigona affiliates. The tool opens five simultaneous TCP
  connections per file to an external destination and rotates sessions
  after approximately 2 GB of outbound data to evade volume-based detection.
author: Inferlume CTI
date: 2026-04-29
tags:
  - attack.exfiltration
  - malware.trigona
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationIsInternal: 'false'
    SourceHostType: 'fileserver'
  aggregate:
    count(DestinationIp) >= 5
    by: SourceIp, DestinationIp
    timeframe: 60s
  condition: selection | aggregate
falsepositives:
  - Backup agents performing parallel cloud uploads. Validate against authorized backup schedules.
level: high

# YARA Rule: uploader_client.exe Behavioral Characteristics
rule Trigona_UploaderClient_Exfil_Tool
{
    meta:
        description     = "Detects behavioral string artifacts associated with the Trigona custom exfiltration binary uploader_client.exe based on documented operational characteristics"
        author          = "Inferlume CTI"
        date            = "2026-04-29"
        version         = "1.0"
        threat_actor    = "Trigona, Rhantus"
        reference       = "Symantec March 2026 Trigona incident analysis"
        status          = "experimental"

    strings:
        $s1 = "uploader_client" ascii wide nocase
        $s2 = "parallel_upload" ascii wide nocase
        $s3 = "rotate_connection" ascii wide nocase
        $s4 = "file_filter" ascii wide nocase
        $s5 = "invoice" ascii wide nocase
        $s6 = ".pdf" ascii wide nocase
        $s7 = "max_connections" ascii wide nocase
        $s8 = "2048" ascii wide
        $s9 = "skip_media" ascii wide nocase

        $c2_pattern = /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d{4,5}/ ascii

    condition:
        uint16(0) == 0x5A4D and
        filesize < 10MB and
        (
            3 of ($s*) or
            ($c2_pattern and 2 of ($s*))
        )
}

# YARA Rule: Trigona HRSword Kernel Driver Staging
rule Trigona_HRSword_KernelDriver_Stage
{
    meta:
        description     = "Detects string artifacts associated with HRSword kernel driver component used in Trigona BYOVD defense evasion staging"
        author          = "Inferlume CTI"
        date            = "2026-04-29"
        version         = "1.0"
        threat_actor    = "Trigona, Rhantus"
        status          = "experimental"

    strings:
        $s1 = "HRSword" ascii wide nocase
        $s2 = "Huorong" ascii wide nocase
        $s3 = "terminate_av" ascii wide nocase
        $s4 = "kill_process" ascii wide nocase
        $s5 = "driver_service" ascii wide nocase
        $s6 = "PCHunter" ascii wide nocase
        $s7 = "YDark" ascii wide nocase
        $s8 = "WKTools" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D and
        filesize < 5MB and
        2 of ($s*)
}

-- SIEM SPL Query: LiteLLM SQL Injection Probe Detection (Splunk)
index=web_proxy OR index=app_logs
  sourcetype=litellm_access
  (
    Authorization="*'*" OR
    Authorization="*UNION*" OR
    Authorization="*SELECT*" OR
    Authorization="*WHERE*" OR
    Authorization="*FROM*" OR
    Authorization="*DROP*" OR
    Authorization="*INSERT*" OR
    Authorization="*--*" OR
    Authorization="*OR 1*" OR
    Authorization="*pg_tables*" OR
    Authorization="*information_schema*"
  )
| eval risk="HIGH: Potential CVE-2026-42208 SQL Injection Probe"
| table _time, src_ip, uri_path, Authorization, status, risk
| sort -_time

-- SIEM SPL Query: Trigona Staging Tool Process Execution (Splunk)
index=endpoint sourcetype=sysmon EventCode=1
  (
    Image="*HRSword.exe" OR
    Image="*PCHunter.exe" OR
    Image="*Gmer.exe" OR
    Image="*YDark.exe" OR
    Image="*WKTools.exe" OR
    Image="*DumpGuard.exe" OR
    Image="*StpProcessMonitorByovd.exe" OR
    Image="*uploader_client.exe" OR
    Image="*PowerRun.exe" OR
    Image="*mimikatz.exe" OR
    Image="*AnyDesk.exe"
  )
| eval risk="CRITICAL: Trigona Staging Tool Execution Detected"
| table _time, ComputerName, User, Image, CommandLine, ParentImage, risk
| sort -_time

-- SIEM SPL Query: Parallel Outbound Connections from File Servers (Splunk)
index=network sourcetype=firewall action=allowed direction=outbound
  NOT dest_ip IN (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
| stats
    count(dest_ip) as connection_count,
    sum(bytes_out) as total_bytes_out
    by src_ip, dest_ip, _time span=60s
| where connection_count >= 5
| eval risk="HIGH: Parallel Outbound Connections Consistent with uploader_client.exe"
| table _time, src_ip, dest_ip, connection_count, total_bytes_out, risk
| sort -_time

-- SIEM KQL Query: LiteLLM SQL Injection Probe Detection (Microsoft Sentinel)
CommonSecurityLog
| where DeviceVendor == "LiteLLM" or DeviceProduct contains "litellm"
| where RequestURL contains "/chat/completions"
    or RequestURL contains "/completions"
    or RequestURL contains "/embeddings"
    or RequestURL contains "/models"
| where AdditionalExtensions contains "'"
    or AdditionalExtensions contains "UNION"
    or AdditionalExtensions contains "SELECT"
    or AdditionalExtensions contains "pg_tables"
    or AdditionalExtensions contains "information_schema"
| extend Risk = "HIGH: CVE-2026-42208 SQL Injection Probe"
| project TimeGenerated, SourceIP, RequestURL, AdditionalExtensions, Risk
| order by TimeGenerated desc

-- SIEM KQL Query: Trigona Staging Tool Execution (Microsoft Sentinel)
SecurityEvent
| where EventID == 4688
| where
    NewProcessName endswith "HRSword.exe" or
    NewProcessName endswith "PCHunter.exe" or
    NewProcessName endswith "Gmer.exe" or
    NewProcessName endswith "YDark.exe" or
    NewProcessName endswith "WKTools.exe" or
    NewProcessName endswith "DumpGuard.exe" or
    NewProcessName endswith "StpProcessMonitorByovd.exe" or
    NewProcessName endswith "uploader_client.exe" or
    NewProcessName endswith "PowerRun.exe" or
    NewProcessName endswith "mimikatz.exe" or
    NewProcessName endswith "AnyDesk.exe"
| extend Risk = "CRITICAL: Trigona Ransomware Staging Tool Detected"
| project TimeGenerated, Computer, Account, NewProcessName, CommandLine, Risk
| order by TimeGenerated desc