###############################################################################
#
#  ThreatHunter.ai - Active Threats Hunt Pack
#  Version: 2026-07-06   |   License: MIT   |   https://threathunter.ai
#
#  12 free Sigma detection rules built from attacks being exploited RIGHT NOW.
#  Single-file edition: every rule below is a standard Sigma document separated
#  by "---". Works as-is with the Sigma CLI:
#
#      pip install sigma-cli
#      sigma plugin install splunk        # or sentinel, elasticsearch, qradar
#      sigma convert -t splunk ThreatHunter-Active-Threats-Pack-2026-07.yml
#
#  All 12 rules compile cleanly with the current pySigma engine.
#
# ---------------------------------------------------------------------------
#  WHY THIS PACK EXISTS
# ---------------------------------------------------------------------------
#  On 2026-07-02 CISA added CVE-2026-45659, a SharePoint Server RCE (CVSS 8.8,
#  unsafe deserialization -> code execution inside w3wp.exe), to its Known
#  Exploited Vulnerabilities catalog with a 2026-07-04 federal patch deadline.
#  Microsoft patched it in May 2026 but rated exploitation "less likely." It is
#  now confirmed exploited in the wild.
#
#  Storm-2603 (Sophos: GOLD SALEM, suspected China-based) is using it to stage
#  Warlock ransomware, living off the land the whole way:
#    - Velociraptor (v2.msi) pulled from attacker *.workers.dev hosts
#    - Remote access via VS Code tunnels, Cloudflare tunnels, Zoho Assist,
#      SSH, and TightVNC dropped as a service with PsExec
#    - masscan for internal recon
#    - DLL search-order hijack: signed MpCmdRun.exe + spoofed Mpclient.dll
#    - BYOVD EDR-killer using the NSecKrnl.sys driver
#    - Rogue local admins (backupadmin, admin_gpo) for persistence
#  Running alongside: Qilin exploiting Check Point VPN CVE-2026-50751, and a
#  mid-2026 infostealer surge (StealC, Amadey, CastleStealer).
#
# ---------------------------------------------------------------------------
#  RULE INDEX
# ---------------------------------------------------------------------------
#   01  SharePoint w3wp spawning command interpreter    T1190     high
#   02  New .aspx written to SharePoint LAYOUTS          T1505.003 high
#   03  Velociraptor / MSI from *.workers.dev            T1219     high
#   04  VS Code remote tunnel execution                  T1219     medium
#   05  Cloudflared tunnel execution                     T1572     medium
#   06  High-speed internal scan via masscan             T1046     medium
#   07  MpCmdRun side-loading Mpclient.dll               T1574.001 high
#   08  BYOVD / EDR-killer driver load (NSecKrnl.sys)    T1562.001 high
#   09  Rogue local admin (backupadmin/admin_gpo)        T1136.001 medium
#   10  Remote access service via PsExec (TightVNC)      T1569.002 medium
#   11  Unexpected Zoho Assist execution                 T1219     medium
#   12  Non-browser process reading credential stores    T1555.003 medium
#
# ---------------------------------------------------------------------------
#  TELEMETRY REQUIRED
# ---------------------------------------------------------------------------
#   Process creation w/ command line (Sysmon 1 / 4688)  -> 01,03,04,05,06,09,11
#   File create / file access        (Sysmon 11)         -> 02,12
#   Image / DLL load                 (Sysmon 7)          -> 07
#   Driver load                      (Sysmon 6)          -> 08
#   Windows System log (Event ID 7045)                   -> 10
#
# ---------------------------------------------------------------------------
#  TUNING
# ---------------------------------------------------------------------------
#  These are HUNT-GRADE rules, not fire-and-forget alerts. Rules 04, 05, 10, 11
#  fire on tools that may be legitimate in your environment; filter known-good
#  hosts or invert the logic. Rules 01/02 can fire during SharePoint patching.
#  Start in hunt mode, baseline, then promote high-confidence rules to alerts.
#
# ---------------------------------------------------------------------------
#  MITIGATION (detection buys time; patching ends the risk)
# ---------------------------------------------------------------------------
#   1. Patch CVE-2026-45659 across SharePoint Subscription Edition, 2019, 2016.
#   2. Hunt for compromise before assuming clean (web shells, rogue admins,
#      remote tunnels). A patch does not evict an attacker already inside.
#   3. Block / alert on unsanctioned outbound tunnels and RMM tools.
#   4. Enable the telemetry above (Sysmon, command-line auditing, driver +
#      service logging). Without it, none of these rules can fire.
#   5. Enforce MFA and least privilege.
#   6. Enable EDR tamper protection and watch for BYOVD driver loads.
#   Also current: Qilin + Check Point VPN CVE-2026-50751 -> disable deprecated
#   IKEv1 and apply Check Point's hotfix.
#
# ---------------------------------------------------------------------------
#  SOURCES
# ---------------------------------------------------------------------------
#   CISA KEV Catalog   https://www.cisa.gov/known-exploited-vulnerabilities-catalog
#   The Hacker News    https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html
#   SecurityWeek       https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/
#   Sophos (GOLD SALEM) https://www.sophos.com/en-us/blog/gold-salem-tradecraft-for-deploying-warlock-ransomware
#   Cisco Talos        https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/
#   Huntress           https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm
#   Help Net Security  https://www.helpnetsecurity.com/2026/06/08/check-point-cve-2026-50751-qilin-ransomware/
#   Malwarebytes       https://www.malwarebytes.com/blog/threat-intel/2026/06/infostealers-are-becoming-the-go-to-phishing-payload
#
#  Provided as-is for defensive use. Intel current as of 2026-07-06. Test in a
#  non-production environment before deploying.
###############################################################################

---
title: SharePoint Worker Process Spawning Command Interpreter
id: 4f5d8778-cae4-45c0-974f-a21ba3e6ed13
status: experimental
description: >
    Detects the SharePoint IIS worker process (w3wp.exe) spawning a command
    interpreter or script host. This is the core post-exploitation signal for
    the actively exploited SharePoint RCE CVE-2026-45659 (added to CISA KEV on
    2026-07-02), used by Storm-2603 / GOLD SALEM to stage Warlock ransomware.
references:
    - https://attack.mitre.org/techniques/T1190/
    - https://thehackernews.com/2026/07/sharepoint-rce-cve-2026-45659-added-to.html
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\w3wp.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\csc.exe'
            - '\certutil.exe'
    condition: selection
falsepositives:
    - SharePoint occasionally invokes csc.exe to compile pages. Baseline before alerting.
level: high

---
title: New ASPX File Written to SharePoint LAYOUTS Directory
id: 13d296de-631b-431c-a3d1-49d1393de169
status: experimental
description: >
    Detects creation of an .aspx file inside the SharePoint web server
    extensions/LAYOUTS path, a common web shell drop location observed in
    CVE-2026-45659 (ToolShell) exploitation staging Warlock ransomware.
references:
    - https://attack.mitre.org/techniques/T1505/003/
    - https://www.securityweek.com/cisa-warns-of-actively-exploited-microsoft-sharepoint-vulnerability/
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains: 'Web Server Extensions'
        TargetFilename|endswith: '.aspx'
    condition: selection
falsepositives:
    - SharePoint cumulative updates and patches add legitimate .aspx files. Correlate with maintenance windows.
level: high

---
title: Velociraptor or Attacker MSI Deployed from Cloudflare Workers Subdomain
id: f40a71a8-b011-4823-b6e6-ba4902dcd220
status: experimental
description: >
    Detects msiexec installing a package referencing Velociraptor or a
    workers.dev subdomain. Storm-2603 / GOLD SALEM abused the legitimate
    Velociraptor DFIR tool (v2.msi) pulled from attacker-controlled
    *.workers.dev hosts to blend in during Warlock ransomware intrusions.
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://www.sophos.com/en-us/blog/gold-salem-tradecraft-for-deploying-warlock-ransomware
    - https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.command-and-control
    - attack.t1219
    - attack.defense-evasion
    - attack.t1218.007
logsource:
    category: process_creation
    product: windows
detection:
    selection_msiexec:
        Image|endswith: '\msiexec.exe'
    selection_indicators:
        CommandLine|contains:
            - '.workers.dev'
            - 'v2.msi'
            - 'velociraptor'
    condition: all of selection_*
falsepositives:
    - Legitimate Velociraptor deployments by your own DFIR team. Filter known-good sources.
level: high

---
title: Visual Studio Code Remote Tunnel Execution
id: 18b4fa42-154d-4231-835f-e6ead7634b89
status: experimental
description: >
    Detects code.exe launched with the tunnel option, which opens a signed,
    Microsoft-hosted C2 and remote command channel. Used by Storm-2603 for
    remote access alongside Cloudflare and SSH in recent Warlock intrusions.
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://cybersecuritynews.com/hackers-use-velociraptor-cloudflare-tunnels-zoho-assist/
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.command-and-control
    - attack.t1219
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection_bin:
        - Image|endswith: '\code.exe'
        - OriginalFileName: 'code.exe'
    selection_cli:
        CommandLine|contains: 'tunnel'
    condition: all of selection_*
falsepositives:
    - Developers legitimately using VS Code tunnels. Rare on servers and DCs.
level: medium

---
title: Cloudflared Tunnel Execution for Covert Remote Access
id: 3a5bf9e0-263b-44f9-a92d-fb025b01cf25
status: experimental
description: >
    Detects execution of cloudflared establishing a tunnel, a technique used
    by Storm-2603 / GOLD SALEM to create outbound C2 and remote access channels
    that bypass inbound firewall rules during Warlock ransomware operations.
references:
    - https://attack.mitre.org/techniques/T1572/
    - https://www.sophos.com/en-us/blog/gold-salem-tradecraft-for-deploying-warlock-ransomware
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.command-and-control
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection_bin:
        - Image|endswith: '\cloudflared.exe'
        - OriginalFileName: 'cloudflared'
    selection_run:
        CommandLine|contains:
            - ' tunnel '
            - 'tunnel run'
            - '--token'
    condition: all of selection_*
falsepositives:
    - Organizations that legitimately run Cloudflare Tunnel. Filter known hosts.
level: medium

---
title: High-Speed Internal Port Scan via masscan
id: 4af23e05-00d2-4483-a287-c1c3a8b86fc5
status: experimental
description: >
    Detects execution of masscan, a high-rate port scanner Storm-2603 uses for
    internal reconnaissance (for example scanning /24 ranges for ports 22, 80,
    443 at 100k packets/sec) after gaining SharePoint access.
references:
    - https://attack.mitre.org/techniques/T1046/
    - https://www.picussecurity.com/resource/blog/storm-2603-ransomware-campaign-targets-microsoft-sharepoint-in-2025-activity-and-ttp-analysis
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.discovery
    - attack.t1046
logsource:
    category: process_creation
    product: windows
detection:
    selection_bin:
        Image|endswith: '\masscan.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'masscan'
            - '--rate'
    condition: 1 of selection_*
falsepositives:
    - Authorized internal vulnerability scanning or pentests. Filter scanner hosts.
level: medium

---
title: Defender MpCmdRun Side-Loading Mpclient.dll from Non-Standard Path
id: ca6a6c79-5705-4730-abc2-9c11056dc060
status: experimental
description: >
    Detects MpCmdRun.exe loading Mpclient.dll from an unexpected directory,
    a DLL search-order hijack Storm-2603 uses to launch Warlock ransomware by
    pairing the signed Defender binary with a spoofed Mpclient.dll.
references:
    - https://attack.mitre.org/techniques/T1574/001/
    - https://reliaquest.com/blog/threat-spotlight-storm-2603-exploits-CVE-2026-23760-to-stage-warlock-ransomware/
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.defense-evasion
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\MpCmdRun.exe'
        ImageLoaded|endswith: '\Mpclient.dll'
    filter_legit:
        ImageLoaded|startswith:
            - 'C:\Program Files\Windows Defender\'
            - 'C:\ProgramData\Microsoft\Windows Defender\'
            - 'C:\Program Files\Microsoft Security Client\'
    condition: selection and not filter_legit
falsepositives:
    - Unusual Defender install paths. Verify the DLL signature and location.
level: high

---
title: Known Vulnerable or EDR-Killer Driver Loaded (BYOVD)
id: 1e3ae7e5-7415-459b-8e5d-59d3b8ade290
status: experimental
description: >
    Detects loading of drivers abused in Bring-Your-Own-Vulnerable-Driver
    attacks to disable security tools at the kernel level. Includes NSecKrnl.sys,
    a 2026 addition to the Storm-2603 arsenal used as an EDR killer.
references:
    - https://attack.mitre.org/techniques/T1562/001/
    - https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.defense-evasion
    - attack.t1562.001
logsource:
    category: driver_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith:
            - '\NSecKrnl.sys'
            - '\truesight.sys'
            - '\rentdrv2.sys'
            - '\aswArPot.sys'
            - '\viragt64.sys'
    condition: selection
falsepositives:
    - Legitimate use of the original signed products these drivers ship with. Verify hash and path.
level: high

---
title: Rogue Local Administrator Account Creation
id: 8696a173-910d-4596-8d67-a33cde064164
status: experimental
description: >
    Detects creation of a local account followed by addition to the local
    Administrators group, or creation of the specific persistence accounts
    (backupadmin, admin_gpo) used by GOLD SALEM in Warlock ransomware intrusions.
references:
    - https://attack.mitre.org/techniques/T1136/001/
    - https://www.sophos.com/en-us/blog/gold-salem-tradecraft-for-deploying-warlock-ransomware
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.persistence
    - attack.t1136.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_named:
        Image|endswith: '\net.exe'
        CommandLine|contains:
            - 'backupadmin'
            - 'admin_gpo'
    selection_group:
        Image|endswith: '\net.exe'
        CommandLine|contains|all:
            - 'localgroup administrators'
            - '/add'
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative account management for the group-add case. Baseline expected activity.
level: medium

---
title: Remote Access Service Installed via PsExec (TightVNC)
id: 6be653cd-1a5d-439d-b1c4-b0f6fa838f2a
status: experimental
description: >
    Detects service installation events for PsExec (PSEXESVC) or TightVNC.
    Storm-2603 deployed TightVNC silently as a Windows service via PsExec in
    2026 for persistent GUI remote access independent of tunnel infrastructure.
references:
    - https://attack.mitre.org/techniques/T1569/002/
    - https://www.huntress.com/blog/velociraptor-misuse-part-two-eye-of-the-storm
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.lateral-movement
    - attack.execution
    - attack.t1569.002
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 7045
        ServiceName|contains:
            - 'PSEXESVC'
            - 'tightvnc'
            - 'tvnserver'
    condition: selection
falsepositives:
    - Administrators using PsExec or TightVNC for legitimate remote support. Filter known admin hosts.
level: medium

---
title: Unexpected Zoho Assist Remote Access Tool Execution
id: 6a69779c-a51c-4c1d-b7e7-c3c51e50adca
status: experimental
description: >
    Detects execution of Zoho Assist remote access software. Storm-2603 used
    Zoho Assist as one of several redundant remote access channels during
    recent Warlock ransomware operations. Alert if Zoho Assist is not your
    sanctioned RMM.
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://cybersecuritynews.com/hackers-use-velociraptor-cloudflare-tunnels-zoho-assist/
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.command-and-control
    - attack.t1219
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Company|contains: 'ZOHO'
        - Description|contains: 'Zoho Assist'
        - Image|contains: 'ZohoAssist'
        - Image|contains: 'ZA_Access'
    condition: selection
falsepositives:
    - Environments that legitimately use Zoho Assist for IT support. Filter or invert as needed.
level: medium

---
title: Non-Browser Process Accessing Browser Credential Stores
id: 188006f0-eeb0-416d-9ddc-e03788168287
status: experimental
description: >
    Detects a non-browser process reading browser credential and secrets files.
    This is the core behavior of the infostealers surging in mid-2026 (StealC,
    Amadey, CastleStealer via OXLOADER malvertising), which scrape saved
    passwords and cookies in seconds before exfiltrating them.
references:
    - https://attack.mitre.org/techniques/T1555/003/
    - https://www.malwarebytes.com/blog/threat-intel/2026/06/infostealers-are-becoming-the-go-to-phishing-payload
author: ThreatHunter.ai
date: 2026-07-06
tags:
    - attack.credential-access
    - attack.t1555.003
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '\Login Data'
            - '\Local State'
            - '\key4.db'
            - '\logins.json'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
    condition: selection and not filter_browsers
falsepositives:
    - Backup, sync, or password-manager utilities. Baseline expected readers.
level: medium

