Georg Lauenstein
@gsecTrusted contributorCompletionist
11 followers468 downloads740 copies45 likes15,786 views
211 detections
Filters
Last updated
All Time
Detection languages
197
14
Categories
56
46
14
12
12
Platforms
76
31
6
5
3
Products / Services
13
9
8
4
4
MITRE Techniques
47
43
38
37
21
CVEs
3
3
2
2
1
Detects the COM hijacking persistence used by the MuddyWater-linked PatchAgent loader chain: cloud.dll registers itself under the campaign-specific CLSID {7C3A5D49-E8B2-4F1C-A6D0-3E7F8B9C2D1A}\InprocServer32 via DllRegisterServer, so any later COM instantiation of that CLSID re-loads and re-executes the Stage 1 dropper. The CLSID is a hard, campaign-unique indicator.
Detects creation of Windows registry hive files (ntuser.dat or UsrClass.dat) outside the expected user profile path hierarchy. LegacyHive writes a modified ntuser.dat to a GUID-named staging directory at C:\ root (e.g. C:\{GUID}\ntuser.dat) and copies UsrClass.dat there as well to set up the oplock-based race condition. Any hive file materialising outside C:\Users\ or C:\Windows\ is a strong indicator of this exploit chain or equivalent offline hive manipulation.
Detects DNS resolution or network connections to command-and-control domains associated with ACR Stealer campaigns observed in mid-2026 intrusion chains. ACR Stealer exfiltrates browser credential stores (Login Data, Web Data) and beacons to short-lived infrastructure hosted under .icu, .sale, .cc, .com and .art TLDs. Any observed communication to these domains indicates an active infection.
Detects the PatchAgent persistence mechanism used by MuddyWater-linked PatchAgent loader chain: a copy of the loader written to %APPDATA%\Microsoft\PatchAgent\svc_upd.exe combined with a HKCU...\CurrentVersion\Run\PatchAgent registry value pointing to that binary with -p/-k arguments. This specific path and value name combination is distinctive to the campaign's persistence stage.
Detects rundll32.exe execution loading a DLL from a remote WebDAV share over HTTPS, including pushd-mounted WebDAV shares and @SSL/DavWWWRoot UNC indicators. Observed as the initial execution stage of ACR Stealer's Campaign 1, where a ClickFix prompt launches cmd.exe which invokes rundll32.exe against a GUID-based WebDAV path to fetch and load a malicious DLL.
Detects the odbcconf LOLBin delivery step assessed for the MuddyWater-linked PatchAgent chain: 'odbcconf /f cloud.rsp' launched from a PatchAgent working directory, typically via a ClickFix lure (explorer -> conhost --headless -> cmd -> odbcconf) fetching the response file over WebDAV. odbcconf executing a .rsp response file is rare in legitimate use and is high-fidelity when paired with WebDAV or a user-writable working directory.
Detects creation of a hidden scheduled task disguised as a legitimate software update, a persistence technique used by ACR Stealer's Campaign 1 installer stage. The malware extracts payloads into deceptive AppData directories such as LogiOptionsPlus and registers a scheduled task to relaunch a pythonw.exe-based Python loader at user sign-in.
Detects regsvr32 executing cloud.dll (or a similarly named DLL exporting DllRegisterServer) as observed in the MuddyWater-linked PatchAgent loader chain. Stage 1 is executed via 'regsvr32 /s cloud.dll' following ClickFix-style social engineering, invoking DllRegisterServer with no user interaction to begin the three-stage loader chain leading to a hollowed notepad.exe HTTP backdoor.
Detects the PatchAgent Stage 3 HTTP C2 protocol recovered from the decrypted shellcode: plain HTTP requests to /api/checkin, /api/cmd/<id>, or /api/result/<id> combined with the hardcoded, truncated User-Agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" (a real browser UA continues past this). Matching the API path plus the exact short UA keeps this durable across C2 IP rotation (observed on 46.30.188[.]99 and 185.228.83[.]217, port 8443).
Detects Python reverse shell execution from /tmp/rev_shell.py
as described in Siemens ROX II exploitation chain. This specific file path
and Python command injection pattern indicates active exploitation of the
command injection vulnerabilities in the feature key validation function.
as described in Siemens ROX II exploitation chain. This specific file path
and Python command injection pattern indicates active exploitation of the
command injection vulnerabilities in the feature key validation function.
Page 9 of 22