Detection Rules — Houselet.exe (Go-Based Loader Masquerading as PlayStation Remote Play)

Campaign: Houselet-GoLoader-PlayStationRemotePlay Date: 2025-11-17 Author: The Hunters Ledger License: CC BY 4.0 Reference: https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet-detections/

Detection Coverage Summary

Houselet is a Go-based loader distributed as a fake Sony PlayStation Remote Play installer. It drops to the user’s Temp directory, weakens Internet Explorer zone and proxy security settings via the registry, and beacons to a hardcoded command-and-control IP over an unauthenticated HTTP POST channel. Coverage here is scoped to the four behavioral leads that retain analyst value after tiering; the campaign’s atomic file and network indicators (dropped filename/path, C2 IP) are carried in the IOC feed rather than as standalone signatures.

Detection vs Hunting: Detection rules are high-fidelity and evasion-resilient — safe to alert on. Hunting rules are broader, for scoping and threat-hunting — expect to review the hits.

Highest-confidence anchor: the Sony Interactive Entertainment PE-metadata-versus-signature masquerade check — filename- and infrastructure-independent, the sole Detection-tier rule in this file (Sigma Detection).

Atomics routed to the IOC feed: three of the original eight Sigma rules keyed solely on the sample’s hardcoded filename (houselet.exe, alone and combined with a non-distinguishing explorer.exe-parent filter) or its command-and-control IP (45.155.69.25) — removing the literal from each collapses the rule to either nothing usable or to universally-broad noise. All three indicators are already present in malware-analysis-houselet-iocs.json; no feed changes were required. Block/monitor them via the feed.

Sigma Rules

Detection Rules

Unsigned Process With Sony Interactive Entertainment PE Description

Tier: Detection Robustness: 3 ATT&CK Coverage: T1036.001 (Match Legitimate Name or Location) Confidence: HIGH Rationale: The pairing of a PE version-info Description claiming Sony Interactive Entertainment authorship with an invalid or absent trusted signature is a structural masquerade-detection pattern independent of filename, IP, or domain — it survives rename and infrastructure rotation and is the actual technique invariant for catching fake-vendor-branded malware. The documented false-positive vector is a telemetry/environmental edge case (signature metadata not populated), not behavioral overlap with legitimate activity, so both durability and precision clear the bar for Detection. False Positives: A genuine Sony-signed binary evaluated in an environment where signature metadata is not populated or logged correctly (a telemetry gap, not a behavioral collision). Blind Spots: A build that drops the Sony Interactive Entertainment branding entirely (generic or no vendor metadata) evades this rule; misses non-PE or memory-only payloads with no on-disk version-info resource. Validation: Scan or load a sample carrying the Sony Interactive Entertainment PE description without a valid Sony signature — must match; an actual Sony-signed PlayStation Remote Play installer must NOT fire. Deployment: Endpoint EDR image-load / process telemetry with signature-verification logging enabled; static triage of unknown binaries claiming first-party vendor branding.

title: Unsigned Process With Sony Interactive Entertainment PE Description
id: 4e6a8c2d-1f3b-4d57-9a6e-8b1d4f2a7c9e
status: experimental
description: >-
    Detects a running process whose PE version-info Description field claims
    Sony Interactive Entertainment authorship while the process is not signed
    or carries an untrusted signature. Houselet is distributed as a fake
    PlayStation Remote Play installer using this exact metadata combination
    to appear legitimate at a glance.
references:
    - https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet-detections/
author: The Hunters Ledger
date: '2025-11-17'
tags:
    - attack.stealth
    - attack.t1036.001
    - detection.emerging-threats
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Description|contains: 'Sony Interactive Entertainment'
    filter_signed:
        Signed: 'true'
        SignatureStatus: 'Valid'
    condition: selection and not filter_signed
falsepositives:
    - A genuine Sony-signed binary evaluated in an environment where signature metadata is not populated or logged correctly
level: medium

Hunting Rules

Internet Explorer ZoneMap Registry Modification

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1112 (Modify Registry) Confidence: MODERATE Rationale: The ZoneMap registry path is the actual Windows chokepoint for weakening Internet Explorer/WinINet zone-security restrictions — a durable, technique-level anchor that survives file rename and infrastructure rotation. The same key is also written by legitimate Group Policy and IT-managed software adding intranet or vendor update servers to a non-default zone, a real and recurring benign-hit scenario rather than a one-time setup artifact — so this clears Gate 1 durability but not Gate 2 precision cleanly enough for Detection. False Positives:

• Administrative scripts or Group Policy legitimately managing Internet Zone security settings (adding intranet or trusted sites)
• IT-managed software installers that register their own update or licensing servers into a non-default security zone during setup Deployment: Endpoint EDR / Sysmon-fed SIEM registry-write telemetry; correlate with the originating process before treating a hit as suspicious.

title: Internet Explorer ZoneMap Registry Modification
id: 5f8b2d4e-3a7c-4e91-9b6d-1c4a8f2e6b7d
status: experimental
description: >-
    Detects modification of Internet Explorer Internet Settings ZoneMap registry
    keys. Houselet writes to these keys to weaken Internet Zone security
    restrictions, easing follow-on download or execution steps.
references:
    - https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet-detections/
author: The Hunters Ledger
date: '2025-11-17'
tags:
    - attack.defense-impairment
    - attack.persistence
    - attack.t1112
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap'
    condition: selection
falsepositives:
    - Administrative scripts or group policy that legitimately manage Internet Zone security settings
level: medium

Internet Settings Proxy Registry Modification

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1112 (Modify Registry) Confidence: MODERATE Rationale: Like the ZoneMap key, the Internet Settings proxy registry path is the canonical WinINet/IE proxy-configuration chokepoint — a durable, technique-level anchor independent of filename or infrastructure. Proxy configuration changes are also a routine, frequent legitimate action (VPN clients, corporate proxy rollouts, users toggling automatic detection in Internet Options), so precision does not clear the bar for Detection despite the durable anchor. False Positives:

• Legitimate proxy configuration changes made by IT-managed software, VPN clients, or the user via Internet Options
• Group Policy-pushed proxy settings during onboarding, network changes, or routine IT maintenance Deployment: Endpoint EDR / Sysmon-fed SIEM registry-write telemetry; correlate with the originating process before treating a hit as suspicious.

title: Internet Settings Proxy Registry Modification
id: 2a6c8e4d-7b1f-4d93-8e5a-3f7c1b9d4e6a
status: experimental
description: >-
    Detects modification of Internet Settings proxy-related registry keys.
    Houselet alters these values to reroute or obscure the victim's outbound
    web traffic.
references:
    - https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet-detections/
author: The Hunters Ledger
date: '2025-11-17'
tags:
    - attack.defense-impairment
    - attack.persistence
    - attack.t1112
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Proxy'
    condition: selection
falsepositives:
    - Legitimate proxy configuration changes made by IT-managed software or the user
level: medium

HTTP POST to PHP Endpoint With Missing User-Agent

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1071.001 (Web Protocols) Confidence: MODERATE Rationale: The original selector (any HTTP POST to a .php URI) fails Gate 2 on its own — this is ubiquitous, benign web traffic generated by CMS backends, form handlers, and API endpoints. Re-anchored on a more distinctive, documented combination: Houselet’s C2 POST requests carry no User-Agent header, an anomaly most legitimate HTTP clients do not exhibit since browsers and standard HTTP libraries set a default User-Agent unless deliberately suppressed. This is a capability-abstraction rewrite of the original rule rather than a new indicator — the missing-UA behavior is documented in this campaign’s own IOC feed. False Positives:

• Automated internal tooling, health-check scripts, or webhook integrations that intentionally omit or blank the User-Agent header when POSTing to PHP-based endpoints
• Lightweight HTTP client libraries or embedded/IoT devices configured with an empty User-Agent by default Deployment: Web proxy / gateway log monitoring; analyst review of hits, prioritizing destinations with no prior reputation history.

title: HTTP POST to PHP Endpoint With Missing User-Agent
id: 8d4f6b2a-9c1e-4a75-8b3d-6e2a9f4c1d8b
status: experimental
description: >-
    Detects an HTTP POST request to a .php URI with no User-Agent header
    present. Houselet beacons to its command-and-control backend via POST
    requests to a PHP-based endpoint without setting a User-Agent string;
    legitimate browsers and most HTTP client libraries set a default
    User-Agent unless deliberately suppressed, making the combination of a
    PHP POST target and an absent User-Agent more distinctive than either
    trait alone.
references:
    - https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet-detections/
author: The Hunters Ledger
date: '2025-11-17'
modified: '2026-07-12'
tags:
    - attack.command-and-control
    - attack.t1071.001
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    selection:
        c-uri|endswith: '.php'
        cs-method: 'POST'
        c-useragent: null
    condition: selection
falsepositives:
    - >-
      Automated internal tooling, health-check scripts, or webhook
      integrations that intentionally omit or blank the User-Agent header
      when POSTing to PHP-based endpoints
    - Lightweight HTTP client libraries or embedded/IoT devices configured with an empty User-Agent by default
level: medium

Command Line Referencing Virtualization or Sandbox Artifacts

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1497.001 (System Checks) Confidence: MODERATE Rationale: The original selector required Image|endswith: '\houselet.exe' AND a command-line reference to VBoxService/vmtoolsd/qemu — but houselet.exe’s own launch command line is very unlikely to literally contain those substrings, since the source analysis describes internal process/service enumeration checks, not command-line arguments, so the rule as originally written would likely never fire. Capability-abstraction rewrite: drop the filename requirement and re-anchor on the technique-level primitive — any process command line referencing known VM/sandbox tooling process or service names — filtered to exclude the legitimate VM tools’ own processes referencing themselves at startup. This is a recognized, durable anti-VM/sandbox-discovery hunting pattern independent of Houselet specifically, but it is genuinely noisy in virtualized enterprise environments where legitimate management and monitoring scripts reference the same names. False Positives:

• IT inventory, monitoring, or provisioning scripts on virtualized infrastructure that reference VBoxService, vmtoolsd, or qemu process/service names
• Legitimate VirtualBox/VMware/QEMU guest-tools management activity beyond the tool’s own process, such as a helper script checking service status for health monitoring

A note on virtualization hosts. The filter_legit_vmtools list covers the guest tools only, so on a hypervisor the selection matches the host’s own routine work: every VM start runs qemu-system-x86_64, disk operations run qemu-img, and TPM emulation runs swtpm, all of which carry a matching command line. A version of this rule filtering only the guest agents therefore fires continuously on any Proxmox, KVM, or libvirt host. filter_virtualization_host excludes the host-side binaries so the rule keeps its intended meaning, which is a process that references VM artifacts without being part of the virtualization stack itself. Remember the deployment note above: this rule is most useful where the endpoint population is known not to be virtualized, and on a hypervisor it will still need local scoping for management scripts that wrap these binaries. Deployment: Endpoint EDR / Sysmon-fed SIEM process-creation telemetry; most useful in environments with a known non-virtualized endpoint population, where any hit is inherently more suspicious.

title: Command Line Referencing Virtualization or Sandbox Artifacts
id: 6c8e2a4f-3d1b-4e79-8c5a-2f9b7d1e4a6c
status: experimental
description: >-
    Detects a process command line referencing common virtualization or
    sandbox process/service names (VBoxService, vmtoolsd, qemu), excluding
    the legitimate VM tooling's own process starting itself. Originally
    observed as part of the Houselet loader's anti-VM sandbox-evasion
    routine; broadened from a filename-anchored selector to this
    technique-level pattern because houselet.exe's own launch command line
    would not plausibly contain these substrings — the underlying behavior
    is an internal process/service enumeration check, not a command-line
    argument.
references:
    - https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet-detections/
author: The Hunters Ledger
date: '2025-11-17'
modified: '2026-07-12'
tags:
    - attack.stealth
    - attack.discovery
    - attack.t1497.001
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'VBoxService'
            - 'vmtoolsd'
            - 'qemu'
    filter_legit_vmtools:
        Image|endswith:
            - '\VBoxService.exe'
            - '\vmtoolsd.exe'
            - '\qemu-ga.exe'
    filter_virtualization_host:
        Image|contains:
            - '/qemu-system-'
            - '/qemu-img'
            - '/qemu-nbd'
            - '/qemu-storage-daemon'
            - '/swtpm'
            - '/usr/bin/kvm'
            - '/libvirtd'
            - '/virt-'
    condition: selection and not 1 of filter_*
falsepositives:
    - >-
      IT inventory, monitoring, or provisioning scripts on virtualized
      infrastructure that reference VBoxService, vmtoolsd, or qemu
      process/service names
    - >-
      Legitimate VirtualBox/VMware/QEMU guest-tools management activity
      beyond the tool's own process, such as a helper script checking
      service status for health monitoring
level: medium

Coverage Gaps

Atomics routed to the IOC feed (3 of 8 original rules). Three of the file’s eight original Sigma rules keyed solely on one hardcoded literal each — the malware’s own filename, that filename paired with a non-distinguishing parent-process filter, or its command-and-control IP — with no durable behavioral signal surviving the literal’s removal:

• Houselet.exe Execution From Temp Directory matched only \AppData\Local\Temp\houselet.exe; removing the filename collapses the selector to “any executable in Temp,” far too broad to be useful given how many legitimate installers and portable applications run from Temp. Already carried in malware-analysis-houselet-iocs.json (IOCs.File).
• Houselet.exe Relaunched With Explorer.exe as Parent paired the same houselet.exe filename with a ParentImage|endswith: '\explorer.exe' filter that adds no discriminating power — explorer.exe is the parent of nearly every user-launched process. The filename is the rule’s only real signal and is already carried in the feed.
• Outbound Traffic to Houselet C2 IP matched only the exact destination 45.155.69.25, a transient infrastructure indicator. Already carried in the feed (IOCs.Network).

No feed edits were required — all three indicators were already present from the original analysis.

Persistence mechanism behind the self-respawn behavior is not documented. The relaunch-via-explorer.exe pattern (the second atomic rule above) is consistent with a logon-triggered persistence mechanism — a Registry Run key or Startup folder entry per T1547.001 — but no specific registry value name, Startup folder path, or scheduled task name was captured in the source analysis, only the relaunch behavior itself, which requires the hardcoded filename to be usable at all. What would enable a rule: the exact Run key value name or Startup folder artifact Houselet writes during its persistence step.

RWX memory allocation and crypto API usage — no standard-telemetry Sigma rule possible from documented evidence. Two behaviors are documented in the malware analysis but cannot be converted into valid Sigma rules: (1) allocation of Read/Write/Execute memory via VirtualAlloc for staging in-memory payloads, and (2) use of CryptEncrypt/CryptAcquireContext/BCryptEncrypt for AES/RC4/Base64-based obfuscation. Both were originally keyed on a CallTrace field under a sysmon logsource category — neither is valid Sigma: sysmon is a product/service name, not a logsource category, and no standard Windows telemetry source (Sysmon process_creation, image_load, or otherwise) exposes a per-call in-process API trace field. What would enable coverage: a specific, distinguishing command-line argument, injected target-process identity, or named pipe/section-object artifact tied to the RWX allocation or crypto routine — something a standard Sysmon deployment can natively log. Absent that, this behavior is best hunted with EDR-native API-call monitoring rather than a generic Sigma rule.

Anti-VM checks — command-line coverage broadened, registry-based queries still uncovered. The malware analysis references “registry or process queries typical of VM detection.” The command-line half is now covered by the technique-level Hunting rule above (Command Line Referencing Virtualization or Sandbox Artifacts), broadened from a Houselet-specific selector because houselet.exe’s own launch command line would not plausibly contain the VM-artifact substrings the original rule required — that combination reads as an internal API-level process/service enumeration check, not a command-line argument. No specific registry key path was documented for the registry-query half of this behavior, so no registry_event rule was authored. What would enable coverage: the specific registry key(s) or value(s) Houselet queries during its anti-VM check (e.g., a HKLM\HARDWARE\Description\System BIOS-string read or a SYSTEM\CurrentControlSet\Services\VBoxGuest presence check) would allow a registry_event rule keyed on EventType: QueryValue against that exact path.

License

Detection rules are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
Free to use, including commercially, with attribution to The Hunters Ledger.