{
  "Event": {
    "uuid": "7bd73cce-a068-5c73-a8f4-0e7b5d3e847e",
    "info": "CloudSync: An Assembler's Intrusion Toolkit",
    "date": "2026-08-03",
    "threat_level_id": 1,
    "analysis": 2,
    "timestamp": 1791727766,
    "publish_timestamp": 1791727766,
    "published": true,
    "Orgc": {
      "name": "The Hunters Ledger",
      "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d"
    },
    "Tag": [
      {
        "name": "tlp:clear",
        "colour": "#ffffff"
      },
      {
        "name": "hunters-ledger:topic=\"Toolkit\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"RAT\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Access Broker\"",
        "colour": "#58a6ff"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"SMB/Windows Admin Shares - T1021.002\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration Over C2 Channel - T1041\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Network Service Discovery - T1046\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Keylogging - T1056.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"PowerShell - T1059.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Indicator Removal - T1070\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Layer Protocol - T1071\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"System Information Discovery - T1082\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Proxy - T1090\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Multi-hop Proxy - T1090.003\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Replication Through Removable Media - T1091\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Additional Local or Domain Groups - T1098.007\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Service - T1102\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Ingress Tool Transfer - T1105\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Screen Capture - T1113\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Audio Capture - T1123\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"MSBuild - T1127.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1136.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain Account - T1136.002\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Access Tools - T1219\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Remote Desktop Software - T1219.002\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Shell - T1505.003\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Windows Service - T1543.003\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials from Web Browsers - T1555.003\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Hidden Users - T1564.002\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Reflective Code Loading - T1620\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1685\"",
        "colour": "#0088cc"
      }
    ],
    "Attribute": [
      {
        "uuid": "a4e693bc-e1db-5d8c-a6d0-24589d566ed2",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "to_ids": false,
        "comment": "Detection rules, The Hunters Ledger",
        "timestamp": 1791727766
      },
      {
        "uuid": "bee909ef-f7b1-5bf5-91c9-1f85bf7db5a4",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/ioc-feeds/cloudsync-assembler-toolkit-91-197-98-188-iocs.json",
        "to_ids": false,
        "comment": "IOC feed (JSON), The Hunters Ledger",
        "timestamp": 1791727766
      },
      {
        "uuid": "d6e2fda0-d3d8-5ab7-a0af-bfc2c946206e",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/reports/cloudsync-assembler-toolkit-91-197-98-188/",
        "to_ids": false,
        "comment": "Report, The Hunters Ledger",
        "timestamp": 1791727766
      },
      {
        "uuid": "408acdf0-01f8-52c8-8198-111fff45aaef",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/stix/cloudsync-assembler-toolkit-91-197-98-188.json",
        "to_ids": false,
        "comment": "STIX 2.1 bundle, The Hunters Ledger",
        "timestamp": 1791727766
      },
      {
        "uuid": "aab12cd9-6d9b-5ebf-ad31-8e4b4910f6cf",
        "type": "domain",
        "category": "Network activity",
        "value": "c3lestial.fun",
        "to_ids": true,
        "comment": "domain: c3lestial.fun. [sourced_commodity_stealer_indicators] NOT operator-owned. Shared Hostinger hosting. Detect via TLS SNI; do NOT author a POST/method-bound rule on /receive.php - it would not fire on real traffic. [confidence 60/100]",
        "timestamp": 1791727766
      },
      {
        "uuid": "4a517661-d200-5186-a958-9f0716c1b4e6",
        "type": "url",
        "category": "Network activity",
        "value": "http://91.197.98.188:8000/client.exe",
        "to_ids": true,
        "comment": "url: http://91.197.98.188:8000/client.exe. [operator_estate] Fetched with a spoofed browser User-Agent and proxy-credential inheritance [confidence 80/100]",
        "timestamp": 1791727766
      },
      {
        "uuid": "2ebc97b9-c02e-5991-825c-137558f3a449",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "2.27.248.138",
        "to_ids": true,
        "comment": "ipv4: 2.27.248.138. [operator_estate] Raw-IP TCP, no domain. :8443 = Express/socket.io operator panel (cert CN=localhost); :1337 = operator RDP (cert CN=DESKTOP-KHCG4S8) [confidence 80/100]",
        "timestamp": 1791727766
      },
      {
        "uuid": "15a5a995-7a00-5402-b7e3-0fefd5effa38",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "91.197.98.188",
        "to_ids": true,
        "comment": "ipv4: 91.197.98.188. [operator_estate] Also serves CloudSync C2 on :5555 (bk dropped implant) and :7777 (svhost4), both cleartext TCP, wait-then-speak, no banner | [operator_estate] Cleartext TCP, [C2_END] terminator; confirmed on the wire (Sysmon EID 3 + PCAP) | [operator_estate] Cleartext TCP, [END] terminator; continuously open in passive scan history [confidence 80/100]",
        "timestamp": 1791727766
      },
      {
        "uuid": "e988a7db-6e49-5b49-ab08-18b33a3a3dc7",
        "type": "ip-dst",
        "category": "Network activity",
        "value": "91.92.43.221",
        "to_ids": true,
        "comment": "ipv4: 91.92.43.221. [operator_estate] Ports 5000-5003 serve identical CloudSync-Dashboard panel; client->5000, s->5001, q->5002; 5003 live with no build in hand. Aeza OFAC-designated 2025; DEDIK-inside-designation unproven. [confidence 80/100]",
        "timestamp": 1791727766
      },
      {
        "uuid": "85ce920c-5e1f-58ca-92ae-4ff150232da5",
        "type": "snort",
        "category": "Network activity",
        "value": "alert dns $HOME_NET any -> any any (msg:\"THL HUNT CloudSync-Assembler-Toolkit SentinelStealer c3lestial.fun DNS Query (Sourced Commodity Stealer C2)\"; dns.query; dotprefix; content:\".c3lestial.fun\"; nocase; endswith; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/; classtype:trojan-activity; sid:9301604; rev:3; metadata:author The_Hunters_Ledger, date 2026-08-03;)",
        "to_ids": false,
        "comment": "SentinelStealer c3lestial.fun DNS Query | TIER: Hunting | robustness 0 | confidence MODERATE | rule hash 3cf39e25 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "5ca6649f-b2b9-56f4-a1ff-aa4b94875950",
        "type": "snort",
        "category": "Network activity",
        "value": "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL DETECT CloudSync-Assembler-Toolkit AUTO UPDATE C2 Registration Marker (C2 Registration)\"; flow:established,to_server; content:\"=== AUTO UPDATE ===\"; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/; classtype:trojan-activity; sid:9301601; rev:2; metadata:author The_Hunters_Ledger, date 2026-08-03;)",
        "to_ids": true,
        "comment": "CloudSync C2 Registration Marker | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1071, T1571 | rule hash 1d1ce895 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "5a54c5ef-15cf-5131-b220-0de034b70dac",
        "type": "snort",
        "category": "Network activity",
        "value": "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL DETECT CloudSync-Assembler-Toolkit Shares Heartbeat Terminator Marker (C2 Heartbeat)\"; flow:established,to_server; content:\"[Shares]\"; pcre:\"/\\[(C2_END|END)\\]/\"; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/; classtype:trojan-activity; sid:9301602; rev:2; metadata:author The_Hunters_Ledger, date 2026-08-03;)",
        "to_ids": true,
        "comment": "CloudSync C2 Heartbeat And Terminator Marker | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1071, T1571 | rule hash 91f87a0a | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "372554f0-2cca-5bc5-ad80-503daf2365c0",
        "type": "snort",
        "category": "Network activity",
        "value": "alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT CloudSync-Assembler-Toolkit SentinelStealer c3lestial.fun TLS SNI (Sourced Commodity Stealer C2)\"; flow:established,to_server; tls.sni; dotprefix; content:\".c3lestial.fun\"; nocase; endswith; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/; classtype:trojan-activity; sid:9301603; rev:3; metadata:author The_Hunters_Ledger, date 2026-08-03;)",
        "to_ids": false,
        "comment": "SentinelStealer c3lestial.fun TLS SNI | TIER: Hunting | robustness 0 | confidence MODERATE | ATT&CK T1071.001 | rule hash 9f82b4cd | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "36423065-ef7d-54bf-9832-89716091d092",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: AMSI Bypass Command Line With amsiInitFailed, SetValue and NonPublic Reflection Strings\nid: f539cc09-bd50-4675-9119-08c09fb2ac24\nstatus: experimental\ndescription: >-\n    Detects a process command line that contains the amsiInitFailed field name together\n    with the SetValue and NonPublic reflection strings, the shape of the reflective\n    AMSI-initialization-failed bypass that blinds in-process AMSI scanning. The rule\n    tests those three substrings only: neither the AmsiUtils type name nor a static\n    binding flag is tested, and no PowerShell Image is required. The AmsiUtils type-name\n    string is deliberately not matched, since the deployment stub\n    observed in this campaign constructs that type name from a reversed string\n    literal specifically to evade signature matching on the literal \"AmsiUtils\"\n    substring.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\n    - https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n    - attack.defense-impairment\n    - attack.t1685\n    - stp.3\nlogsource:\n    category: process_creation\n    product: windows\n    definition: 'Requires process-creation events with CommandLine populated, for example Sysmon EID 1 or Security EID 4688 with command-line auditing enabled.'\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - 'amsiInitFailed'\n            - 'SetValue'\n            - 'NonPublic'\n    condition: selection\nfalsepositives:\n    - Unlikely, legitimate scripts do not reflectively clear the AMSI initialization-failed field\nlevel: high",
        "to_ids": true,
        "comment": "AMSI Bypass Command Line With amsiInitFailed, SetValue and NonPublic Reflection Strings | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1685 | rule hash 25771e92 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "94ac892d-e882-5576-a2a2-3b6764f7c617",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: ASPX File Written to IIS aspnet_client Directory\nid: da35ea9d-176c-412e-9325-3df4f98a7033\nstatus: experimental\ndescription: >-\n    Detects creation of an .aspx file inside an IIS aspnet_client directory. This\n    path is reserved for a fixed set of Microsoft-shipped ASP.NET AJAX support\n    files, not for uploaded or authored pages, any new .aspx file there is\n    consistent with a web shell drop. Observed with the Sharp4WebCmd command-console\n    web shell, dropped as the first stage of a post-compromise orchestrator tool.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n    - attack.persistence\n    - attack.t1505.003\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        TargetFilename|contains: '\\aspnet_client\\'\n        TargetFilename|endswith: '.aspx'\n    condition: selection\nfalsepositives:\n    - Unlikely, the aspnet_client directory does not normally receive new .aspx files after IIS/ASP.NET installation\nlevel: high",
        "to_ids": true,
        "comment": "ASPX File Written to IIS aspnet_client Directory | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1505.003 | rule hash acc37d8a | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "01045aca-9a1f-55ca-b782-28d2fb513200",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Active Directory Tier-0 Backdoor Account Creation Or Privileged Group Addition\nid: b66c823b-08d3-4e03-8259-78257e98439c\nstatus: experimental\ndescription: >-\n    Detects either the creation of a user account (not a computer account) whose\n    sAMAccountName ends in a literal dollar sign, or the addition of any account to\n    a Tier-0 privileged group (local Administrators, or the well-known Domain\n    Admins/Enterprise Admins/Schema Admins relative IDs, matched by SID suffix so\n    the rule is independent of OS locale and does not require the victim's domain\n    name). Windows logs true computer-account creation under a separate event ID,\n    so a dollar-suffixed name arriving via the user-account-creation event is itself\n    the discriminator for a machine-account masquerade. Observed as an orchestrator\n    tool's one-shot creation of a hidden \"Guest$\" account escalated into all four\n    groups to build a forest-level backdoor.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\nmodified: 2026-10-11\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1136.002\n    - attack.t1098.007\nlogsource:\n    product: windows\n    service: security\ndetection:\n    selection_create:\n        EventID: 4720\n        SamAccountName|endswith: '$'\n    selection_privgroup_domain:\n        EventID:\n            - 4728\n            - 4756\n        TargetSid|endswith:\n            - '-512'\n            - '-518'\n            - '-519'\n    selection_privgroup_local:\n        EventID: 4732\n        TargetSid: 'S-1-5-32-544'\n    filter_main_homegroup:\n        EventID: 4720\n        TargetUserName: 'HomeGroupUser$'\n    condition: 1 of selection_* and not 1 of filter_main_*\nfalsepositives:\n    - Legitimate onboarding of a new privileged administrator, or a genuine computer/service account naming collision with the dollar-sign check\nlevel: high",
        "to_ids": true,
        "comment": "Active Directory Tier-0 Backdoor Account Creation Or Privileged Group Addition | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1136.002, T1098.007 | rule hash 379146fb | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "d74dd3c8-5b1b-5d69-bf57-ef8f57a3a184",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: AnyDesk Unattended Password Piped Over Stdin\nid: 944c365c-8565-4097-8d18-4e9a5f74aafe\nstatus: experimental\ndescription: >-\n    Detects a command line in which an echo is piped into AnyDesk.exe with the\n    --set-password flag, in that order (the shell process that runs the pipeline\n    carries the whole text). The password does not appear on AnyDesk's own\n    command line, since AnyDesk.exe reads it from stdin, but it can appear in the\n    command line of the shell that runs the echo, which is the command line this\n    rule selects, so a matching event can carry the password in clear. The\n    pipeline shape is the anchor. Observed issued by an orchestrator tool\n    immediately after a silent, unattended AnyDesk install.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\n    - https://redcanary.com/blog/misbehaving-rats/\nauthor: The Hunters Ledger\ndate: 2026-08-03\nmodified: 2026-10-11\ntags:\n    - attack.command-and-control\n    - attack.t1219.002\n    - stp.3\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains: 'echo*|*AnyDesk.exe*--set-password'\n    condition: selection\nfalsepositives:\n    - Legitimate IT automation that pipes a password to AnyDesk during scripted unattended deployment\nlevel: medium",
        "to_ids": true,
        "comment": "AnyDesk Unattended Password Piped Over Stdin | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1219.002 | rule hash 0f2a4831 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "a38050a1-ab3b-562d-bcc2-269841f826c4",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: CloudSync RAT Guest Dollar Local Account Persistence Command\nid: 301385e1-0331-459e-b547-6229cf0788ff\nstatus: experimental\ndescription: >-\n    Detects a \"net user\" command targeting a local account named \"Guest$\" without\n    the \"/domain\" switch. CloudSync's implant re-issues this command on a short cycle\n    to keep a local machine-account-masquerade backdoor present; the trailing dollar\n    sign mimics a computer-account naming convention that most admins never use for a\n    local user.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n    - attack.persistence\n    - attack.t1136.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - 'net user'\n            - 'Guest$'\n    filter_domain:\n        CommandLine|contains: '/domain'\n    condition: selection and not filter_domain\nfalsepositives:\n    - Unlikely, local accounts ending in a literal dollar sign are not a standard Windows naming convention\nlevel: high",
        "to_ids": true,
        "comment": "CloudSync Guest Dollar Local Account Persistence Command | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1136.001 | rule hash ba2cf04d | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "d77f5a2b-e75b-5301-b5cc-a70a561baca6",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: CloudSync RAT Tor Hidden Service Staging Under Public Profile\nid: 4a7f8a52-bc79-48d2-8776-550cad2455af\nstatus: experimental\ndescription: >-\n    Detects file creation consistent with CloudSync standing up a per-victim Tor\n    hidden service from a working directory under the shared Public profile, a\n    masqueraded Tor binary named taskhostw.exe, or any file written inside a\n    hidden_service subdirectory of C:\\Users\\Public\\. The build-variant working\n    directory name (fs vs filesystem) is not required; the anchor is the Public-path\n    root paired with the Tor hidden-service artifact.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n    - attack.command-and-control\n    - attack.t1090.003\n    - attack.stealth\n    - attack.t1036.005\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection_taskhostw:\n        TargetFilename|contains: '\\Users\\Public\\'\n        TargetFilename|endswith: '\\taskhostw.exe'\n    selection_hiddensvc:\n        TargetFilename|contains|all:\n            - '\\Users\\Public\\'\n            - '\\hidden_service\\'\n    condition: 1 of selection_*\nfalsepositives:\n    - Unlikely, legitimate software does not write an executable named taskhostw.exe or create a hidden_service directory under the shared Public profile\nlevel: high",
        "to_ids": true,
        "comment": "CloudSync Tor Hidden Service Staging Under Public Profile | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1090.003, T1036.005 | rule hash c5831af4 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "76e55523-f1db-510e-96e7-84236876e427",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: CloudSync RAT Windows Update Service Masquerade Installation\nid: 0ae91cbf-e335-4060-9283-8862790a7c0e\nstatus: experimental\ndescription: >-\n    Detects installation of a Windows service whose display name is \"Windows Update\n    Service\". The genuine Windows Update service display name is \"Windows Update\"\n    (short form), the extra word is CloudSync's masquerade convention for its\n    svhost4 implant's persistence service, and does not occur in stock Windows.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1543.003\nlogsource:\n    product: windows\n    service: system\ndetection:\n    selection:\n        Provider_Name: 'Service Control Manager'\n        EventID: 7045\n        ServiceName: 'Windows Update Service'\n    condition: selection\nfalsepositives:\n    - Unlikely, the genuine Windows Update service display name is \"Windows Update\", not \"Windows Update Service\"\nlevel: high",
        "to_ids": true,
        "comment": "CloudSync Windows Update Service Masquerade Installation | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1543.003 | rule hash d441c469 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "a8f5570c-ebc3-5c3a-8241-56faf5a8bbea",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: IIS Worker Process Spawning A Command Shell\nid: efdf846f-4879-4ee6-99e9-45a7203503a4\nstatus: experimental\ndescription: >-\n    Detects the IIS worker process (w3wp.exe) spawning powershell.exe or cmd.exe.\n    An IIS application pool process does not normally launch an interactive shell;\n    this is the classic behavioral signal of a web shell being used to execute\n    commands, observed here immediately after an ASPX web shell is dropped into the\n    aspnet_client directory.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.t1505.003\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\w3wp.exe'\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\cmd.exe'\n    condition: selection\nfalsepositives:\n    - Rare IIS management or deployment automation that legitimately spawns a shell from the worker process\nlevel: high",
        "to_ids": true,
        "comment": "IIS Worker Process Spawning A Command Shell | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1505.003, T1059.001 | rule hash 68644eb3 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "1a3f4b55-5e72-530f-9925-766e2077dea4",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: MSBuild Launched Without a Project File by a Hidden or Bypass-Policy PowerShell Parent\nid: 4f593a7e-a980-452a-bc36-25db2acf2c7c\nstatus: experimental\ndescription: >-\n    Detects MSBuild.exe launched directly by a PowerShell process whose own command\n    line carries a hidden-window or an execution-policy-bypass flag (either one is\n    enough), with no build-project argument (no .csproj/.vbproj/.sln/.xml/.proj/\n    .targets text on the MSBuild command line). Legitimate MSBuild invocations, even\n    from a shell, almost always pass a project or target path; a bare invocation is\n    consistent with using MSBuild as a hollow injection target rather than as a\n    build tool. Observed as the final stage of a wscript-launched fileless loader\n    chain that injects a custom .NET RAT into the resulting process. The rule sees\n    only the PowerShell-to-MSBuild step: process-creation events carry the parent\n    and not the grandparent, so the wscript start of the chain is not tested.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\nmodified: 2026-10-11\ntags:\n    - attack.stealth\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.t1127.001\n    - attack.t1055\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\MSBuild.exe'\n        - OriginalFileName: 'MSBuild.exe'\n    selection_parent:\n        ParentImage|endswith: '\\powershell.exe'\n        ParentCommandLine|contains:\n            - '-w hidden'\n            - '-windowstyle hidden'\n            - '-ep bypass'\n            - '-ExecutionPolicy Bypass'\n    filter_project_file:\n        CommandLine|contains:\n            - '.csproj'\n            - '.vbproj'\n            - '.sln'\n            - '.proj'\n            - '.targets'\n            - '.xml'\n    condition: all of selection_* and not filter_project_file\nfalsepositives:\n    - Developer or CI tooling that launches MSBuild from a hidden PowerShell wrapper without a visible project path on the command line\nlevel: high",
        "to_ids": true,
        "comment": "MSBuild Launched Without a Project File by a Hidden or Bypass-Policy PowerShell Parent | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1127.001, T1055 | rule hash a0f1d456 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "66cb13d5-f9cc-5622-8628-adf8680f8a70",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: MSBuild Process Making a Direct Outbound Network Connection\nid: 9629ebb5-35e9-4e2c-b209-c66eee51f0ea\nstatus: experimental\ndescription: >-\n    Detects MSBuild.exe itself initiating an outbound network connection (no protocol test is made, so a UDP connection also matches). MSBuild does\n    not make direct network connections as part of normal build activity (NuGet\n    restore and package operations run through separate client processes); an\n    outbound connection from MSBuild.exe is consistent with a RAT running inside an\n    injected MSBuild process beaconing to its command-and-control server.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n    - attack.stealth\n    - attack.execution\n    - attack.t1127.001\nlogsource:\n    category: network_connection\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\MSBuild.exe'\n        Initiated: 'true'\n    condition: selection\nfalsepositives:\n    - Unknown, MSBuild network activity is rare in normal build environments but has not been exhaustively surveyed across all CI configurations\nlevel: high",
        "to_ids": true,
        "comment": "MSBuild Process Making a Direct Outbound Network Connection | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1127.001 | rule hash c0c3ae0c | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "cd1c34ff-c97f-52e5-9a08-e5f373a2edc3",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Photo Studio Masquerade Loader Files Under LocalAppData\nid: d570d892-64b5-4eb9-ad99-2b615230bbdf\nstatus: experimental\ndescription: >-\n    Detects creation of a JScript or VBScript file inside a \"Photo Studio\" directory\n    under the user's LocalAppData folder. This is the on-disk persistence copy and\n    windowless relaunch wrapper for a fileless .NET RAT loader; no legitimate \"Photo\n    Studio\" application is installed by this path convention.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\nmodified: 2026-10-11\ntags:\n    - attack.persistence\n    - attack.stealth\n    - attack.t1036.005\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        TargetFilename|contains: '\\AppData\\Local\\Photo Studio\\'\n        TargetFilename|endswith:\n            - '.js'\n            - '.vbs'\n    condition: selection\nfalsepositives:\n    - Unlikely, no common legitimate application installs script files under a \"Photo Studio\" LocalAppData folder\nlevel: high",
        "to_ids": true,
        "comment": "Photo Studio Masquerade Loader Files Under LocalAppData | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1036.005 | rule hash 4c62a341 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "c8bd3793-8f3c-5999-b8e5-220ce950be33",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: PowerShell Net.WebClient Proxy Set to Default Credentials\nid: 80dee74f-6c3d-4947-81bc-4fe1bb14f919\nstatus: experimental\ndescription: >-\n    Detects a PowerShell process whose command line builds a Net.WebClient and sets\n    Proxy.Credentials to DefaultCredentials (the rule tests the three command-line\n    strings, not an actual download), which inherits the logged-on user's authenticated proxy\n    session so a payload download succeeds from inside an authenticated enterprise\n    proxy. This is the deployment stub's always-present download stage, it fires\n    even on runs where the subsequent payload write fails, since the stub gates its\n    later stages on a successful save rather than a successful connection.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\nmodified: 2026-10-11\ntags:\n    - attack.command-and-control\n    - attack.t1090\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_cmd:\n        CommandLine|contains|all:\n            - 'Net.WebClient'\n            - 'Proxy.Credentials'\n            - 'DefaultCredentials'\n    condition: all of selection_*\nfalsepositives:\n    - Unlikely, legitimate proxy-aware download scripts rarely combine WebClient with explicit DefaultCredentials proxy inheritance in this exact form\nlevel: high",
        "to_ids": true,
        "comment": "PowerShell Net.WebClient Proxy Set to Default Credentials | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1090 | rule hash a1eb65f3 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "14908188-8f87-5cd3-b696-45c692285513",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Run Key SystemUpdate Value Pointing To Startup Folder Tilde Executable\nid: 3598bf78-f702-4ab3-b8ba-9d38f62eab80\nstatus: experimental\ndescription: >-\n    Detects an HKCU Run value named \"SystemUpdate\" whose data points at a\n    tilde-prefixed executable inside the user's Startup folder. This is the\n    deployment stub's persistence step, added immediately after it copies its\n    downloaded payload into Startup under a randomized ~<digits>.exe name.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\nmodified: 2026-10-11\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1547.001\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|startswith: 'HKU\\'\n        TargetObject|endswith: '\\CurrentVersion\\Run\\SystemUpdate'\n        Details|contains: '\\Start Menu\\Programs\\Startup\\~*.exe'\n    condition: selection\nfalsepositives:\n    - Unlikely, the combination of the SystemUpdate value name and a Startup-folder tilde-prefixed target is not a known legitimate pattern\nlevel: high",
        "to_ids": true,
        "comment": "Run Key SystemUpdate Value Pointing To Startup Folder Tilde Executable | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1547.001 | rule hash 354d05f3 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "98f55c49-0598-57bf-834f-ba8135cf8285",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Temp Log File Deleted Matching Fileless Loader Staging Pattern\nid: b237faa4-ae89-4f42-b5c7-d6c2d8b7f15b\nstatus: experimental\ndescription: >-\n    Detects deletion of a temp file named \"log_<digits>_<digits>\" from the user's\n    Temp folder. The fileless .NET RAT loader decrypts its staged payload into a\n    file of this name, reads it back into memory with PowerShell, then deletes it as\n    anti-forensic cleanup, a temp file of this exact naming shape is not a pattern\n    used by common legitimate logging utilities.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\nmodified: 2026-10-11\ntags:\n    - attack.stealth\n    - attack.t1070.004\nlogsource:\n    category: file_delete\n    product: windows\ndetection:\n    selection:\n        TargetFilename|re: '.*\\\\AppData\\\\Local\\\\Temp\\\\log_[0-9]+_[0-9]+'\n    condition: selection\nfalsepositives:\n    - Unknown, a coincidental temp filename matching the log_<digits>_<digits> shape from unrelated software has not been surveyed\nlevel: high",
        "to_ids": true,
        "comment": "Temp Log File Deleted Matching Fileless Loader Staging Pattern | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1070.004 | rule hash b5f06b20 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "53cfc135-e243-5da0-a15a-f7d1ed50ec7d",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Tilde Prefixed Executable Written To User Startup Folder\nid: 818f62ed-fba7-4252-97fd-234961f88eb5\nstatus: experimental\ndescription: >-\n    Detects an executable with a tilde-prefixed filename written directly into a\n    user's Startup folder. Broader and weaker in isolation than the paired\n    SystemUpdate Run-key rule in this set, some installers briefly use\n    tilde-prefixed temp names, though rarely inside the Startup folder itself, so\n    this is intended for hunting and triage rather than standalone alerting.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n    - attack.persistence\n    - attack.stealth\n    - attack.t1036.005\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        TargetFilename|contains: '\\Start Menu\\Programs\\Startup\\~'\n        TargetFilename|endswith: '.exe'\n    condition: selection\nfalsepositives:\n    - Installer temp-extraction artifacts that transiently use tilde-prefixed names\n    - Legitimate portable applications that place a randomly-named launcher shortcut in Startup\nlevel: medium",
        "to_ids": false,
        "comment": "Tilde Prefixed Executable Written To User Startup Folder | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1036.005 | rule hash d7d993dd | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "efb37fa0-56ca-5575-834f-f4ddc74276e0",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Windows Defender Tampering Via Set-MpPreference Disable Switches\nid: 3b3283c2-d047-402f-b46d-b6fb43faebf3\nstatus: experimental\ndescription: >-\n    Detects a PowerShell Set-MpPreference or Add-MpPreference command disabling\n    Windows Defender real-time protection, IOAV protection, or behavior monitoring.\n    Observed issued from inside an injected MSBuild.exe process immediately after a\n    fileless .NET RAT loads, to blind Defender ahead of further activity.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\n    - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n    - attack.defense-impairment\n    - attack.t1685\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_cmdlet:\n        CommandLine|contains:\n            - 'Set-MpPreference'\n            - 'Add-MpPreference'\n    selection_option:\n        CommandLine|contains:\n            - 'DisableRealtimeMonitoring'\n            - 'DisableIOAVProtection'\n            - 'DisableBehaviorMonitoring'\n    condition: selection_cmdlet and selection_option\nfalsepositives:\n    - Administrative hardening or troubleshooting scripts that legitimately toggle Defender preferences\nlevel: high",
        "to_ids": true,
        "comment": "Windows Defender Tampering Via Set-MpPreference Disable Switches | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1685 | rule hash 3666f9d2 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "6abaf8ec-2556-5a17-9d38-0290b07f4dda",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: WindowsUpdateService Scheduled Task Creation By Dotnet RAT Chain\nid: 07502798-ce21-4812-86ca-3368b6f9f38c\nstatus: experimental\ndescription: >-\n    Detects creation of a scheduled task named \"WindowsUpdateService\" configured to\n    run at logon. This is the fileless .NET RAT chain's second persistence layer,\n    created from inside the injected MSBuild.exe process after the Defender tamper\n    step. This task name and mechanism are specific to the .NET RAT chain, the\n    unrelated CloudSync Tor-panel RAT in the same toolkit persists only via a\n    registry Run key and a Windows service, never a scheduled task.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\ntags:\n    - attack.execution\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1053.005\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains|all:\n            - 'schtasks'\n            - '/tn'\n            - 'WindowsUpdateService'\n            - 'onlogon'\n    condition: selection\nfalsepositives:\n    - Unlikely, \"WindowsUpdateService\" is not a task name used by any genuine Windows Update component\nlevel: high",
        "to_ids": true,
        "comment": "WindowsUpdateService Scheduled Task Creation By Dotnet RAT Chain | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1053.005 | rule hash dfb32051 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "c9bcc811-40dc-535c-823c-6226f62a42ab",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Winlogon SpecialAccounts UserList Registry Write\nid: 2966dbb8-8da1-492d-aeea-9921679ed4b6\nstatus: experimental\ndescription: >-\n    Detects any registry value write under the Winlogon SpecialAccounts\\UserList\n    key. A value there named for an account, set to 0, hides that account from the\n    Windows logon screen and User Manager tile. The rule does not read the value\n    data, so a write that sets the value to 1 (which shows the account again) also\n    matches. This key is written almost exclusively to hide a newly created\n    backdoor account, and legitimate use (hiding a genuine service account) is\n    rare enough that any write under this key merits review regardless of which\n    account is targeted.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\nauthor: The Hunters Ledger\ndate: 2026-08-03\nmodified: 2026-10-10\ntags:\n    - attack.stealth\n    - attack.t1564.002\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains: '\\Winlogon\\SpecialAccounts\\UserList\\'\n    condition: selection\nfalsepositives:\n    - Deliberate administrative hiding of a legitimate local service account from the logon screen\nlevel: high",
        "to_ids": true,
        "comment": "Winlogon SpecialAccounts UserList Registry Write | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1564.002 | rule hash d087cac6 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "12c0bc7b-0e04-577f-af45-51e79d4fa83b",
        "type": "yara",
        "category": "Payload installation",
        "value": "/*\n   Yara Rule Set\n   Identifier: CloudSync Assembler Toolkit - 91.197.98.188\n   Author: The Hunters Ledger\n   Source: https://the-hunters-ledger.com/\n   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule RAT_CloudSync_TorPanel_NetscanBuild {\n   meta:\n      description = \"Detects the later-build CloudSync Tor-panel RAT (client.exe/q.exe/s.exe) via embedded HTML/JS markup for its CIDR+port network scanner panel tab, unique to the later of two known CloudSync build generations\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\"\n      date = \"2026-08-03\"\n      modified = \"2026-10-11\"\n      hash1 = \"62aa8e470e60aa9fa77df6e6e63b7c253657e95d6018240b1752a9ca9fe389fa\"\n      family = \"CloudSync\"\n      malware_type = \"RAT\"\n      campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n      id = \"b14306ec-cdfb-5107-bf6f-156ea821ae75\"\n   strings:\n      $api1 = \"/api/netscan\" ascii\n      $html1 = \"id='scan-cidr'\" ascii\n      $html2 = \"placeholder='Target CIDR (e.g. 192.168.1.0/24)'\" ascii\n      $html3 = \"id='netscan-output'\" ascii\n      $html4 = \"showTab('netscan'\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 60MB and\n      3 of them\n}",
        "to_ids": true,
        "comment": "CloudSync Tor Panel: Netscan Build | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1046 | rule hash 7b2f2f20 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "d1a760ea-60ad-5ec0-a402-5cab83924914",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule Loader_ABExe_DeploymentOrchestrator_Banners {\n   meta:\n      description = \"Detects the ab.exe post-compromise deployment orchestrator via at least one of its five console banner strings (the sequence is not enforced) together with two more strings drawn from the banners, the German-localized Active Directory privileged-group names it targets, New-ADUser and Guest$ when it creates a hidden backdoor account\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\"\n      date = \"2026-08-03\"\n      hash1 = \"d25a3a858e28faa68ca6c624d7d19350c11ac798c346be3067307463e40aaff1\"\n      family = \"CloudSync\"\n      malware_type = \"Orchestrator\"\n      campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n      id = \"bcfebc4f-1273-566e-8121-19cd9dc91272\"\n   strings:\n      $b1 = \"Starting deployment - WebShell First\" ascii wide\n      $b2 = \"=== WEB SHELL ===\" ascii wide\n      $b3 = \"=== USER ===\" ascii wide\n      $b4 = \"=== ANYDESK ===\" ascii wide\n      $b5 = \"All tasks completed successfully!\" ascii wide\n      $grp1 = \"Organisations-Admins\" ascii wide\n      $grp2 = \"Schema-Admins\" ascii wide\n      $grp3 = \"Administratoren\" ascii wide fullword\n      $adu = \"New-ADUser\" ascii wide\n      $guest = \"Guest$\" ascii wide\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 2MB and\n      1 of ($b*) and\n      3 of them\n}",
        "to_ids": true,
        "comment": "Deployment Orchestrator Console Banners | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1136.002, T1098 | rule hash 9d0958d1 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "773f583b-8841-5538-9ada-2f01b9aa23a3",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule Loader_CtBat_ProxyAwareUSBWormStub {\n   meta:\n      description = \"Detects the ct.bat infection stub when any two of five of its distinctive command fragments co-occur in a file under 5 KB: proxy-credential-inheriting WebClient download (DefaultCredentials), USB drive enumeration for its worm loop (wmic logicaldisk where), autorun.inf propagation, its AMSI-bypass field name (amsiInitFailed) and the SystemUpdate value name\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\"\n      date = \"2026-08-03\"\n      hash1 = \"0ff0cee1fbf1050fbe3ab91918e56334a93269265e5614717ec0441baa8c42df\"\n      family = \"CloudSync\"\n      malware_type = \"Loader\"\n      campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n      id = \"21d45221-9c71-50e5-89fa-a7b3d0ea4e76\"\n   strings:\n      $proxy = \"DefaultCredentials\" ascii\n      $wmic = \"wmic logicaldisk where\" ascii\n      $autorun = \"autorun.inf\" ascii\n      $amsi = \"amsiInitFailed\" ascii\n      $sysupd = \"SystemUpdate\" ascii\n   condition:\n      filesize < 5KB and\n      2 of them\n}",
        "to_ids": true,
        "comment": "ct.bat Proxy-Aware USB Worm Stub | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1105, T1091 | rule hash 5ecdcab6 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "5d1cfff8-46b2-5e05-8f01-c1a241d3865b",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule Loader_SvchostJS_CustomAlphabet {\n   meta:\n      description = \"Detects the svhost.js WSH JScript fileless loader via its custom 16-character substitution alphabet used in a layered base16-XOR plus AES/ChaCha/permutation decoder. The alphabet string is the only anchor: the generic function-constructor and String.fromCharCode strings this rule once accepted on their own appear in ordinary JavaScript and were removed\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\"\n      date = \"2026-08-03\"\n      modified = \"2026-10-11\"\n      hash1 = \"4b115a9f745219e3f3abdea275da89f35e4ec5f3d43286e5efc58eaf8049f3f7\"\n      family = \"SvchostPayload\"\n      malware_type = \"Loader\"\n      campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n      id = \"2b39854f-a2dc-535f-824f-b28af4328b35\"\n   strings:\n      $alpha = \"5v_qoKAku06M^ZW1\" ascii\n   condition:\n      filesize < 1MB and\n      $alpha\n}",
        "to_ids": true,
        "comment": "svhost.js Fileless Loader: Custom Alphabet | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1027, T1140 | rule hash d7e2589e | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "7153b051-2353-55a3-8b36-a2bcfd1f0805",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule RAT_CloudSync_C2Protocol_DualBuild {\n   meta:\n      description = \"Detects CloudSync's cleartext TCP C2 registration/heartbeat protocol strings across both observed build generations, which differ in message terminator ([C2_END] vs [END]) and registration field names\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\"\n      date = \"2026-08-03\"\n      hash1 = \"9744c12a06b4562e175d4aeb7b8fd5c1e1877ac30222af8243eeaae16df324b0\"\n      family = \"CloudSync\"\n      malware_type = \"RAT\"\n      campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n      id = \"df292c17-07ad-5292-9f33-206ab7582bdd\"\n   strings:\n      $autoupd = \"=== AUTO UPDATE ===\" ascii\n      $heartbeat = \"[Shares]\" ascii\n      $term1 = \"[C2_END]\" ascii\n      $term2 = \"[END]\" ascii\n      $field1 = \"AnyDesk Pass:\" ascii\n      $field2 = \"AD Pwd:\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 60MB and\n      2 of them\n}",
        "to_ids": false,
        "comment": "CloudSync C2 Protocol: Dual Build Coverage | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1071, T1571 | rule hash bf081a65 | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "4ff026e6-a837-5cf9-b643-877b43f91161",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule RAT_CloudSync_PublicWorkdir_Artifacts {\n   meta:\n      description = \"Detects CloudSync working-directory, dropped-Tor-binary, and mutex string artifacts common to droppers and implants across both build generations; broader and lower-precision than the dedicated panel and protocol rules, intended for hunting\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\"\n      date = \"2026-08-03\"\n      hash1 = \"6bd0366372b7d765e76c5a888d68a4991ad04ee614bdb589a20ffbe433db58fc\"\n      family = \"CloudSync\"\n      malware_type = \"RAT\"\n      campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n      id = \"d226bb58-e0bc-5f2e-8846-d8b3cb415bc2\"\n   strings:\n      $wd1 = \"C:\\\\Users\\\\Public\\\\fs\\\\\" ascii\n      $wd2 = \"C:\\\\Users\\\\Public\\\\filesystem\" ascii\n      $hs = \"hidden_service\" ascii\n      $thw = \"taskhostw.exe\" ascii\n      $frf = \"first_run.flag\" ascii\n      $mtx1 = \"Global\\\\WUDFHost\" ascii wide\n      $mtx2 = \"Global\\\\WinUpdateSvcMutex\" ascii wide\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 60MB and\n      3 of them\n}",
        "to_ids": false,
        "comment": "CloudSync Working-Directory, Dropped-Tor-Binary and Mutex String Artifacts (Any Three of Seven) | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1090.003, T1036.005 | rule hash 3204a05c | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "9809c2b2-035c-5736-87f8-f29998a25004",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule RAT_SvchostPayload_ParalellInjector_TypeNames {\n   meta:\n      description = \"Detects the sourced Paralell (Blind Eagle-associated) reflective injector and the custom SvchostPayload .NET RAT via debug PDB path fragment and distinctive obfuscated/cleartext type and member names; matches the on-disk cls.exe sibling build and, when captured, in-memory dumps of Crystal-Monk.dll and SvchostPayload\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/\"\n      date = \"2026-08-03\"\n      hash1 = \"79b6f2eb6583a83aabe590264de08c0ad1eb7e960ae9a4bdbc6ed84142ce95a9\"\n      hash3 = \"135877ecc663ee47340a4726078234f0\"\n      family = \"SvchostPayload\"\n      malware_type = \"RAT\"\n      campaign = \"CloudSync-Assembler-Toolkit-91.197.98.188\"\n      id = \"5d097282-dcf6-58bf-a8e8-17d97cff3ec2\"\n   strings:\n      $pdb = \"Paralell\\\\Paralell\\\\bin\\\\x64\\\\Debug\\\\CryptoObfuscator_Output\\\\Crystal-Monk.pdb\" ascii\n      $t1 = \"SvchostPayload\" ascii wide fullword\n      $t2 = \"BrowserCredentialRecovery\" ascii fullword\n      $t3 = \"Crystal-Monk\" ascii wide\n      $t4 = \"VoidNexus\" ascii fullword\n      $t5 = \"ShadowWeave\" ascii fullword\n      $t6 = \"CrystalCore\" ascii fullword\n      $t7 = \"UmbraGate\" ascii fullword\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 5MB and\n      ($pdb or 2 of ($t*))\n}",
        "to_ids": true,
        "comment": "Paralell Injector and SvchostPayload Type Names | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1055, T1620 | rule hash 047c7d0c | https://the-hunters-ledger.com/hunting-detections/cloudsync-assembler-toolkit-91-197-98-188-detections/",
        "timestamp": 1791727766,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      }
    ],
    "Object": []
  }
}