Inferlume

title: AI Coding Assistant Spawning Suspicious Child Processes
id: d4f8a2b1-9c3e-4f7a-8b2d-1e6f5a9c3d2e
status: experimental
description: Detects AI coding assistants spawning unusual child processes indicative of session hijack or supply chain compromise matching the Shai-Hulud pattern
author: Inferlume NightWatch
date: 2026-09-20
references:
  - hxxps[://]www[.]mandiant[.]com/resources/blog/ai-risk-resilience-2026
  - hxxps[://]www[.]sentinelone[.]com/labs/agents-at-large-tracing-illicit-openai-agent-activity-on-hugging-face/
logsource:
  category: process_creation
  product: windows
detection:
  selection_ai_parent:
    ParentImage|endswith:
      - '\\GitHub Copilot.exe'
      - '\\Cursor.exe'
      - '\\Codeium.exe'
      - '\\Tabnine.exe'
  selection_suspicious_child:
    Image|endswith:
      - '\\powershell.exe'
      - '\\cmd.exe'
      - '\\wscript.exe'
      - '\\cscript.exe'
      - '\\python.exe'
      - '\\pip.exe'
      - '\\twine.exe'
  condition: selection_ai_parent and selection_suspicious_child
fields:
  - ParentImage
  - Image
  - CommandLine
  - User
  - ParentCommandLine
falsepositives:
  - Legitimate build or deployment scripts triggered from AI assisted development
level: high
tags:
  - attack.t1059.006
  - attack.t1195.001

title: Potential ClickFix Clipboard Command Execution via Run Dialog
id: 5a8e1b32-94b1-4f81-a832-72648eef9201
status: experimental
description: Detects powershell.exe or cmd.exe spawned directly from explorer.exe with hidden window, encoded command, or download strings typical of ClickFix user execution
references:
  - hxxps[://]sansec[.]io/research/brevo-supply-chain-attack
author: Inferlume NightWatch
date: 2026-09-20
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\\explorer.exe'
  selection_child:
    Image|endswith:
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\cmd.exe'
  selection_cli:
    CommandLine|contains:
      - ' -w hidden '
      - ' -windowstyle hidden '
      - ' -enc '
      - ' -encodedcommand '
      - 'Net.WebClient'
      - 'DownloadString'
      - 'Invoke-Expression'
      - 'IEX('
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Administrative maintenance scripts initiated manually via Run dialog, rare on enterprise workstations
level: high
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001

title: Suspicious Traversal and Sensitive File Requests to Web Application
id: 8c5c54bc-447d-4d40-9c5e-95d8f5a4d84a
status: experimental
description: Detects requests commonly associated with path traversal, secret discovery, or source control metadata access
author: Inferlume NightWatch
date: 2026-09-20
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
      - HEAD
  selection_path:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '%2e%2e%2f'
      - '%252e%252e%252f'
    cs-uri-stem|contains:
      - '/.git/'
      - '/.env'
      - '/etc/passwd'
      - '/proc/self/environ'
      - '/api/v4/projects/'
  condition: selection_method and selection_path
falsepositives:
  - Authorized security testing
  - Vulnerability scanning from approved scanners
level: high
tags:
  - attack.t1190
  - attack.t1552.001

rule Shai_Hulud_Worm_Indicators
{
    meta:
        description = "Detects Shai-Hulud worm artifacts from 2026 AI risk reporting"
        author = "Inferlume NightWatch"
        date = "2026-09-20"
        reference = "hxxps[://]www[.]mandiant[.]com/resources/blog/ai-risk-resilience-2026"
        threat_actor = "Unknown (AI assistant hijack)"
        malware_family = "Shai-Hulud"
    strings:
        $pypi_publish = "twine upload" nocase
        $dependency_confusion = "dependency_confusion" nocase
        $shai_hulud_str = "Shai-Hulud" nocase
        $ai_assistant_hijack = "ai_assistant" nocase
        $coding_assistant = "coding_assistant" nocase
        $copilot = "copilot" nocase
        $credential_exfil = "GITHUB_TOKEN" nocase
        $pypi_token = "PYPI_TOKEN" nocase
        $npm_token = "NPM_TOKEN" nocase
        $obfuscated_payload = /eval\(compile\(base64\.b64decode/
    condition:
        2 of ($pypi_publish, $dependency_confusion, $shai_hulud_str, $ai_assistant_hijack, $coding_assistant, $copilot, $credential_exfil, $pypi_token, $npm_token, $obfuscated_payload)
}

rule Win_Backdoor_GrayRabbit_UNC3569 {
    meta:
        description = "Detects GrayRabbit backdoor binaries and related memory staging modules used by UNC3569"
        author = "Inferlume NightWatch"
        reference = "CVE-2026-51990 / UNC3569 Campaign"
        date = "2026-09-20"
        score = 80
    strings:
        $str1 = "GrayRabbit" ascii wide nocase
        $str2 = "sgbiz://protocol" ascii wide
        $str3 = "rundll32.exe" ascii wide
        $magic_header = { 4D 5A 90 00 }
        $hex_pattern = { 8B 45 ?? 33 D2 89 45 ?? 8A 04 11 30 04 17 42 }
    condition:
        $magic_header at 0 and (2 of ($str*) or $hex_pattern)
}

rule Suspicious_WebShell_Execution_Primitives
{
  meta:
    description = "Triage rule for common web shell execution and command launch primitives"
    author = "Inferlume NightWatch"
    date = "2026-09-20"
    confidence = "heuristic"

  strings:
    $php_exec_1 = "shell_exec(" nocase
    $php_exec_2 = "system(" nocase
    $php_exec_3 = "passthru(" nocase
    $php_exec_4 = "proc_open(" nocase
    $php_decode = "base64_decode(" nocase
    $asp_exec_1 = "ProcessStartInfo" nocase
    $asp_exec_2 = "cmd.exe" nocase
    $jsp_exec_1 = "Runtime.getRuntime().exec" nocase
    $py_exec_1 = "subprocess.Popen" nocase
    $py_exec_2 = "os.popen(" nocase

  condition:
    filesize < 500KB and
    (
      2 of ($php_exec_*) or
      ($php_decode and 1 of ($php_exec_*)) or
      1 of ($asp_exec_*) or
      $jsp_exec_1 or
      1 of ($py_exec_*)
    )
}

SEARCH sourcetype=firewall OR sourcetype=web_proxy
  (destination_port IN (80, 443, 8080, 8443) AND
   uri_path MATCHES ".*(/cgi-bin/|/webvpn/|/admin/).*")
| WHERE http_method IN ("POST", "PUT") AND response_code = 200
| STATS count BY src_ip, dest_ip, uri_path, user_agent
| WHERE count > 5

SEARCH sourcetype=web_server (uri_path LIKE "%/../%" OR uri_path LIKE "%..\\%")
  AND (uri_path LIKE "%/api/v4/%" OR uri_path LIKE "%/.git/%")
| WHERE http_status = 200 AND bytes_out > 1024
| STATS count, sum(bytes_out) BY src_ip, dest_ip, uri_path

SEARCH sourcetype=application_logs (uri_path LIKE "%/access/api/v1/aws/token/%")
| WHERE http_method = "POST"
| STATS count BY src_ip, dest_ip, http_status, user_agent
| WHERE (http_status = 200 AND count > 10) OR (http_status = 401 AND count > 50)

SEARCH sourcetype=screenconnect_logs
  (event_type IN ("SessionCreated", "UserAdded", "RoleChanged") AND
   user_name IN ("anonymous", "token:anonymous", "admin*"))
| STATS count BY src_ip, user_name, event_type

SEARCH sourcetype=syslog OR sourcetype=auditd
  (message MATCHES ".*(tls|ebtables|af_alg).*") AND
  (message MATCHES ".*(OOB|out.of.bounds|race.condition|memory.disclosure).*")
| STATS count BY host, message

SELECT
    timestamp,
    source_ip,
    destination_ip,
    http_method,
    uri_path,
    request_headers,
    http_payload,
    response_code
FROM web_proxy_events
WHERE uri_path LIKE '%/pa'
  AND http_method = 'POST'
  AND (
      http_payload LIKE '%<PolycomIPPhone>%'
      OR http_payload LIKE '%PhoneIP%'
  )
  AND (
      http_payload LIKE '%SELECT%'
      OR http_payload LIKE '%UNION%'
      OR http_payload LIKE '%pg_sleep%'
      OR http_payload LIKE '%copy%from%program%'
      OR http_payload LIKE '%\\x27%'
  )
GROUP BY source_ip, destination_ip, uri_path
HAVING count(*) >= 1

LET suspicious_requests =
  web_logs
  WHERE uri CONTAINS_ANY (
    "../", "%2e%2e%2f", "/.git/", "/.env",
    "/etc/passwd", "/proc/self/environ"
  )
  OR response_status IN (401, 403, 500)
  GROUP BY source_ip, destination_host, user_agent
  HAVING count(*) >= 10

LET follow_on_admin_activity =
  application_audit
  WHERE action IN (
    "user_created", "token_created", "api_key_created",
    "role_changed", "plugin_installed", "repository_exported",
    "configuration_changed"
  )

RETURN suspicious_requests
  JOIN follow_on_admin_activity
    ON destination_host = target_host
   AND follow_on_admin_activity.timestamp
       BETWEEN suspicious_requests.first_seen
       AND suspicious_requests.first_seen + 30m
  ENRICH WITH identity_events, endpoint_process_events
  ORDER BY risk_score DESC

SEARCH auth_events
WHERE dest_asset_role = network_management_interface
  AND auth_result = success
  AND account_type = low_privilege_static
FLAG known low priv default style accounts WITHIN last 24h
JOIN process_or_network_events ON same_host
WHERE process_name IN (ssh, plink, ncat, socat)
   OR dest_port IN (22, 443)
  AND connection_direction = outbound_or_reverse
  WITHIN 30m AFTER auth_events.timestamp
ALERT SEVERITY high
MESSAGE Static credential login to management interface followed by tunneling tool execution, possible CVE-2026-20316 style post exploitation