Inferlume

title: Suspicious Child Process Spawned by Plex Media Server
id: c8b45f12-9843-4e67-91a5-plex2shell-execution
status: experimental
description: Detects Plex Media Server spawning shell interpreters, download tools, or known Plex2Shell payload binaries.
references:
  - hxxps://thehackernews[.]com/2026/10/cisa-orders-federal-agencies-to-patch[.]html
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/Plex Media Server'
  selection_child:
    Image|endswith:
      - '/wget'
      - '/curl'
      - '/sh'
      - '/bash'
      - '/myawesomeproxy'
      - '/mylovelyminer'
      - '/x12345'
  selection_command_line:
    CommandLine|contains:
      - 'proxystream'
      - '--donate-level'
      - '217.60.194.116'
  condition: selection_parent and (selection_child or selection_command_line)
falsepositives:
  - Administrative maintenance executed under the service context
level: critical

title: SafePay Share Enumeration Followed by Data Staging
id: e4b7a192-3c82-4f11-9a72-safepay-staging
status: experimental
description: Detects SafePay network share enumeration followed by archive creation within sixty minutes.
references:
  - hxxps://www[.]cisa[.]gov/news-events/cybersecurity-advisories/aa26-293a
logsource:
  category: process_creation
  product: windows
detection:
  selection_discovery:
    Image|endswith:
      - '\SharpShares.exe'
    CommandLine|contains:
      - 'sharefinder.ps1'
      - 'netscan'
  selection_archiving:
    Image|endswith:
      - '\7z.exe'
      - '\WinRAR.exe'
      - '\rar.exe'
      - '\rclone.exe'
    CommandLine|contains:
      - ' a '
      - 'sync'
      - 'copy'
  condition: selection_discovery | near selection_archiving
  timeframe: 60m
falsepositives:
  - Legitimate administrative data migration scripts
level: high

title: SafePay Volume Shadow Copy Service Sabotage
id: 5a81e9f0-2819-4a92-8172-safepay-vss-sabotage
status: experimental
description: Detects attempts to delete shadow copies or halt the Volume Shadow Copy Service matching SafePay behavior.
references:
  - hxxps://www[.]cisa[.]gov/news-events/cybersecurity-advisories/aa26-293a
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  selection_service:
    CommandLine|contains:
      - 'sc stop VSS'
      - 'net stop VSS'
      - 'wmic shadowcopy delete'
  condition: selection_vssadmin or selection_service
falsepositives:
  - Disaster recovery software performing automated cleanup
level: critical

title: Siemens Software Center Executed from User Writable Directory
id: 9812eaf4-1234-4bca-8791-siemens-clickfix
status: experimental
description: Detects execution of Siemens Software Center from AppData paths via msiexec matching Romulus ClickFix campaigns.
references:
  - hxxps://productcert[.]siemens[.]com/productcert/html/ssa-580366[.]html
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    ParentImage|endswith: '\msiexec.exe'
    Image|endswith: '\SiemensSoftwareCenter.exe'
    Image|contains: '\AppData\Local\'
  condition: selection_process
falsepositives:
  - Non standard user driven software installation
level: high

-- SafePay Command and Control or Exfiltration Traffic
SELECT event.timestamp, source.ip, destination.ip, destination.port, process.name, user.name
FROM network_events
WHERE destination.ip IN (
    '88.119.167.239',
    '5.255.11.134',
    '37.10.71.188',
    '173.194.194.94',
    '167.235.225.149'
)
AND destination.ip NOT IN (SELECT approved_ip FROM enterprise_authorized_destinations);

-- Plex2Shell Exploitation Request Sequence
SELECT event.timestamp, source.ip, destination.ip, http.url, http.method, http.status_code
FROM web_access_logs
WHERE (
    http.url LIKE '%/player/timeline%protocol=http%'
    OR http.url LIKE '%/video/:/transcode/universal%'
)
AND source.ip NOT IN (SELECT subnet FROM internal_corporate_network);

-- eMudhra Revoked Certificate Serial Monitoring
SELECT event.timestamp, source.ip, tls.client_hello.server_name, tls.server_certificate.issuer, tls.server_certificate.serial_number
FROM tls_inspection_events
WHERE tls.server_certificate.issuer LIKE '%emSign%'
   OR tls.server_certificate.issuer LIKE '%EM DV TLS CA%'
   OR tls.server_certificate.issuer LIKE '%EM OV TLS CA%'
   OR tls.server_certificate.issuer LIKE '%EM EV TLS CA%';

-- PAN-OS VPN Session Without MFA Correlation
SELECT vpn.timestamp, vpn.username, vpn.source_ip, vpn.session_id
FROM pan_globalprotect_logs vpn
LEFT JOIN mfa_authentication_logs mfa
    ON vpn.username = mfa.username
    AND mfa.timestamp BETWEEN (vpn.timestamp - INTERVAL 5 MINUTE) AND (vpn.timestamp + INTERVAL 5 MINUTE)
WHERE vpn.action = 'login_success'
  AND (mfa.status = 'failure' OR mfa.status IS NULL);

rule SafePay_Cryptographic_Binaries
{
    meta:
        description = "Detects compiled SafePay ransomware components including 1.exe and locker.dll"
        author = "CTI Pipeline Operations"
        date = "2026-10-21"
        reference = "CISA AA26-293A"
    strings:
        $s1 = ".SafePay" ascii wide
        $s2 = "ChaCha20" ascii
        $s3 = "locker.dll" ascii nocase
        $s4 = "soc.dll" ascii nocase
        $s5 = "SharpShares" ascii
        $s6 = "vssadmin delete shadows" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and (3 of ($s*))
}

rule Antino_Backdoor_Artifacts
{
    meta:
        description = "Detects Antino Rust backdoor dynamic library and Microsoft 365 C2 strings"
        author = "CTI Pipeline Operations"
        date = "2026-10-21"
        reference = "Cisco Talos UAT-11587"
    strings:
        $dll = "slc.dll" ascii nocase
        $c2 = "command_req_" ascii
        $host = "GatherOsState.exe" ascii nocase
        $graph = "graph.microsoft.com" ascii
        $scope = "client_credentials" ascii
    condition:
        uint16(0) == 0x5A4D and ($dll or $host) and ($c2 or ($graph and $scope))
}

rule Siemens_ClickFix_Romulus_Payload
{
    meta:
        description = "Detects companion artifacts associated with Siemens Software Center DLL hijacking"
        author = "CTI Pipeline Operations"
        date = "2026-10-21"
        reference = "Siemens SSA-580366"
    strings:
        $m1 = "AllMyBasic.msi" ascii wide nocase
        $m2 = "wizardexpensive.com" ascii wide nocase
        $m3 = "SM Software Provisioning Service" ascii wide
        $m4 = "statinfosta.DB" ascii wide
    condition:
        any of ($m*)
}