Inferlume

title: Malicious VS Code Extension - Nx Console v18.95.0 Process Activity
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\Code.exe'
      - '\code-insiders.exe'
    CommandLine|contains:
      - 'nx-console'
      - 'nxconsole'
  filter_safe:
    Image|contains: '\extensions\nrwl.angular-console-'
  condition: selection and not filter_safe
  timeframe: 2026-05-18 to 2026-05-27
falsepositives:
  - Legitimate Nx workspace operations from safe extension versions
level: high
tags:
  - attack.initial_access
  - attack.t1195.002

title: cPanel Session File CRLF Injection Indicator - CVE-2026-41940
status: experimental
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|startswith: '/var/cpanel/sessions/raw/'
  keywords:
    - 'hasroot=1'
    - 'tfa_verified=1'
    - 'method=badpass'
  condition: selection and keywords
falsepositives:
  - None expected for 'method=badpass' combined with hasroot=1
level: critical
tags:
  - attack.privilege_escalation
  - attack.t1548
  - cve.2026-41940

title: RTF OLE Execution - APT28 CVE-2026-21509 Pattern
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\OUTLOOK.EXE'
    ParentCommandLine|contains: '.rtf'
  selection_suspicious_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_suspicious_child
falsepositives:
  - Rare; macro-enabled documents in some enterprise workflows
level: high
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.t1203
  - cve.2026-21509
  - actor.apt28

title: Developer Token File Access Post-IDE Compromise
status: experimental
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\.npmrc'
      - '\gh\hosts.yml'
      - '\.ssh\id_rsa'
      - '\.aws\credentials'
      - '\.azure'
    Image|endswith:
      - '\node.exe'
      - '\Code.exe'
  filter_legitimate:
    ParentImage|contains: '\npm\bin'
  condition: selection and not filter_legitimate
falsepositives:
  - Active development operations; tune with process lineage
level: medium
tags:
  - attack.credential_access
  - attack.t1552
  - attack.t1195.002

rule APT28_NotDoor_Outlook_C2_Indicators
{
    meta:
        description = "Heuristic for NotDoor Outlook backdoor - APT28 CVE-2026-21509 campaign"
        author = "Inferlume CTI"
        date = "2026-05-28"
        reference = "Proofpoint 2026 CVE Exploitation Report"
        confidence = "LOW - behavioral indicator only, no confirmed file hash"
        status = "EXPERIMENTAL"
    strings:
        $c2_ref = "filen.io" ascii wide nocase
        $outlook_api1 = "IPM.Note" ascii wide
        $outlook_api2 = "MAPIFolder" ascii wide
        $covenant = "Grunt" ascii wide nocase
        $rtf_ole = {5C 6F 62 6A 65 6D 62 }
        $rtf_header = {7B 5C 72 74 66}
    condition:
        ($rtf_header and $rtf_ole) or
        ($c2_ref and ($outlook_api1 or $outlook_api2)) or
        ($covenant and $c2_ref)
}

rule Suspicious_cPanel_Session_Injection
{
    meta:
        description = "Detect CRLF-injected cPanel session files - CVE-2026-41940"
        author = "Inferlume CTI"
        date = "2026-05-28"
        confidence = "MEDIUM - specific session file pattern"
    strings:
        $hasroot = "hasroot=1" ascii
        $badpass = "method=badpass" ascii
        $tfa = "tfa_verified=1" ascii
        $auth_internal = "successful_internal_auth_with_timestamp=" ascii
    condition:
        ($hasroot and $badpass) or
        ($tfa and $badpass) or
        ($auth_internal and $badpass)
}

index=linux_logs sourcetype=cpanel_access
| where (uri_path LIKE "%cpsess%" AND http_status=307)
| join session_id [
    search index=linux_logs sourcetype=cpanel_access http_method=POST uri_path="/login/" http_status=200
]
| where isnull(login_event)
| table _time src_ip session_id uri_path http_status

DeviceFileEvents
| where TimeGenerated > ago(10d)
| where InitiatingProcessFileName in ("node.exe", "Code.exe", "code-insiders.exe")
| where FolderPath has_any (".npmrc", "gh\\hosts.yml", ".ssh\\id_rsa", ".aws\\credentials")
| where not(InitiatingProcessParentFileName has "npm")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, ActionType
| order by TimeGenerated desc