{ "type": "bundle", "id": "bundle--3d77d49f-7a7c-4dfc-a149-0db2282908b4", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-09-30T03:16:41.479054Z", "modified": "2026-09-30T03:16:41.479054Z", "name": "The Hunters Ledger", "identity_class": "organization" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "file", "spec_version": "2.1", "id": "file--957249be-ec1c-5128-a7ff-5d17222c3d43", "hashes": { "SHA-256": "6fbaa2637e7c8773695dcf07a85dc830112da3d8dab5dbe277dfa96111470920" } }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dbbd7389-15de-512d-ba85-3f93fdbe11d3", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-09-30T03:16:41.484104Z", "modified": "2026-09-30T03:16:41.484104Z", "name": "Unsigned Process With Sony Interactive Entertainment PE Description", "indicator_types": [ "malicious-activity" ], "pattern": "title: Unsigned Process With Sony Interactive Entertainment PE Description\nid: 4e6a8c2d-1f3b-4d57-9a6e-8b1d4f2a7c9e\nstatus: experimental\ndescription: >-\n Detects a running process whose PE version-info Description field claims\n Sony Interactive Entertainment authorship while the process is not signed\n or carries an untrusted signature. Houselet is distributed as a fake\n PlayStation Remote Play installer using this exact metadata combination\n to appear legitimate at a glance.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet-detections/\nauthor: The Hunters Ledger\ndate: '2025-11-17'\ntags:\n - attack.stealth\n - attack.t1036.001\n - detection.emerging-threats\nlogsource:\n category: image_load\n product: windows\ndetection:\n selection:\n Description|contains: 'Sony Interactive Entertainment'\n filter_signed:\n Signed: 'true'\n SignatureStatus: 'Valid'\n condition: selection and not filter_signed\nfalsepositives:\n - A genuine Sony-signed binary evaluated in an environment where signature metadata is not populated or logged correctly\nlevel: medium", "pattern_type": "sigma", "valid_from": "2025-11-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b27f9e8d-4e73-596e-a89f-6ee2988f5b69", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-09-30T03:16:41.484591Z", "modified": "2026-10-11T05:08:00.871216Z", "name": "Internet Explorer ZoneMap Registry Modification", "indicator_types": [ "malicious-activity" ], "pattern": "title: Internet Explorer ZoneMap Registry Modification\nid: 5f8b2d4e-3a7c-4e91-9b6d-1c4a8f2e6b7d\nstatus: experimental\ndescription: >-\n Detects modification of Internet Explorer Internet Settings ZoneMap registry\n keys. Houselet writes to these keys to weaken Internet Zone security\n restrictions, easing follow-on download or execution steps.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet-detections/\nauthor: The Hunters Ledger\ndate: '2025-11-17'\nmodified: '2026-10-11'\ntags:\n - attack.defense-impairment\n - attack.persistence\n - attack.t1112\n - detection.emerging-threats\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection:\n TargetObject|startswith: 'HKU\\'\n TargetObject|contains: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap'\n condition: selection\nfalsepositives:\n - Administrative scripts or group policy that legitimately manage Internet Zone security settings\nlevel: medium", "pattern_type": "sigma", "valid_from": "2025-11-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1038eb20-f4dd-5c58-99fd-e44292b5abc2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-09-30T03:16:41.484698Z", "modified": "2026-10-11T05:08:00.87136Z", "name": "Internet Settings Proxy Registry Modification", "indicator_types": [ "malicious-activity" ], "pattern": "title: Internet Settings Proxy Registry Modification\nid: 2a6c8e4d-7b1f-4d93-8e5a-3f7c1b9d4e6a\nstatus: experimental\ndescription: >-\n Detects modification of Internet Settings proxy-related registry keys.\n Houselet alters these values to reroute or obscure the victim's outbound\n web traffic.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet-detections/\nauthor: The Hunters Ledger\ndate: '2025-11-17'\nmodified: '2026-10-11'\ntags:\n - attack.defense-impairment\n - attack.persistence\n - attack.t1112\n - detection.emerging-threats\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection:\n TargetObject|startswith: 'HKU\\'\n TargetObject|contains: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Proxy'\n condition: selection\nfalsepositives:\n - Legitimate proxy configuration changes made by IT-managed software or the user\nlevel: medium", "pattern_type": "sigma", "valid_from": "2025-11-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--196231fb-910a-5c11-aac5-ed563c448272", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-09-30T03:16:41.484793Z", "modified": "2026-09-30T03:16:41.484793Z", "name": "HTTP POST to PHP Endpoint With Missing User-Agent", "indicator_types": [ "malicious-activity" ], "pattern": "title: HTTP POST to PHP Endpoint With Missing User-Agent\nid: 8d4f6b2a-9c1e-4a75-8b3d-6e2a9f4c1d8b\nstatus: experimental\ndescription: >-\n Detects an HTTP POST request to a .php URI with no User-Agent header\n present. Houselet beacons to its command-and-control backend via POST\n requests to a PHP-based endpoint without setting a User-Agent string;\n legitimate browsers and most HTTP client libraries set a default\n User-Agent unless deliberately suppressed, making the combination of a\n PHP POST target and an absent User-Agent more distinctive than either\n trait alone.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet-detections/\nauthor: The Hunters Ledger\ndate: '2025-11-17'\nmodified: '2026-07-12'\ntags:\n - attack.command-and-control\n - attack.t1071.001\n - detection.emerging-threats\nlogsource:\n category: proxy\ndetection:\n selection:\n c-uri|endswith: '.php'\n cs-method: 'POST'\n c-useragent: null\n condition: selection\nfalsepositives:\n - >-\n Automated internal tooling, health-check scripts, or webhook\n integrations that intentionally omit or blank the User-Agent header\n when POSTing to PHP-based endpoints\n - Lightweight HTTP client libraries or embedded/IoT devices configured with an empty User-Agent by default\nlevel: medium", "pattern_type": "sigma", "valid_from": "2025-11-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--23f6b8e5-b40c-53a3-858d-6911c32b2e64", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-09-30T03:16:41.484879Z", "modified": "2026-09-30T03:16:41.484879Z", "name": "Command Line Referencing Virtualization or Sandbox Artifacts", "indicator_types": [ "malicious-activity" ], "pattern": "title: Command Line Referencing Virtualization or Sandbox Artifacts\nid: 6c8e2a4f-3d1b-4e79-8c5a-2f9b7d1e4a6c\nstatus: experimental\ndescription: >-\n Detects a process command line referencing common virtualization or\n sandbox process/service names (VBoxService, vmtoolsd, qemu), excluding\n the legitimate VM tooling's own process starting itself. Originally\n observed as part of the Houselet loader's anti-VM sandbox-evasion\n routine; broadened from a filename-anchored selector to this\n technique-level pattern because houselet.exe's own launch command line\n would not plausibly contain these substrings — the underlying behavior\n is an internal process/service enumeration check, not a command-line\n argument.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/malware-analysis-houselet-detections/\nauthor: The Hunters Ledger\ndate: '2025-11-17'\nmodified: '2026-09-30'\ntags:\n - attack.stealth\n - attack.discovery\n - attack.t1497.001\n - detection.emerging-threats\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n CommandLine|contains:\n - 'VBoxService'\n - 'vmtoolsd'\n - 'qemu'\n filter_legit_vmtools:\n Image|endswith:\n - '\\VBoxService.exe'\n - '\\vmtoolsd.exe'\n - '\\qemu-ga.exe'\n filter_virtualization_host:\n Image|contains:\n - '/qemu-system-'\n - '/qemu-img'\n - '/qemu-nbd'\n - '/qemu-storage-daemon'\n - '/swtpm'\n - '/usr/bin/kvm'\n - '/libvirtd'\n - '/virt-'\n filter_pve_management:\n CommandLine|contains|all:\n - '/nodes/'\n - '/qemu'\n filter_pve_helpers:\n CommandLine|contains:\n - '/usr/libexec/qemu-server/'\n - '/run/pve/'\n filter_pve_vm_state:\n CommandLine|contains:\n - '/etc/pve/qemu-server'\n - '/var/run/qemu-server'\n filter_xdg_desktop_entry_scan:\n Image|endswith: '/grep'\n ParentCommandLine|contains: '/xdg-settings '\n CommandLine|contains|all:\n - '^Exec'\n - '/applications/qemu.desktop'\n condition: selection and not 1 of filter_*\nfalsepositives:\n - >-\n IT inventory, monitoring, or provisioning scripts on virtualized\n infrastructure that reference VBoxService, vmtoolsd, or qemu\n process/service names\n - >-\n Legitimate VirtualBox/VMware/QEMU guest-tools management activity\n beyond the tool's own process, such as a helper script checking\n service status for health monitoring\n - >-\n Proxmox VE's own management CLI querying or snapshotting a QEMU-type VM\n (pvesh get /nodes//qemu//snapshot, or the equivalent via qm),\n invoked through its Perl interpreter or wrapped in bash -c. The REST path\n itself contains \"qemu\" for any operation against a QEMU-type VM, so this\n fires on routine hypervisor administration. Excluded at source by\n filter_pve_management.\n - >-\n Proxmox VE helper scripts under /usr/libexec/qemu-server/ (pve-bridgedown\n and siblings) and cloud-init image generation writing under /run/pve/.\n Excluded at source by filter_pve_helpers.\n - >-\n Reading a Proxmox VE VM's own config or runtime PID file via ls, cat, grep\n or stat (/etc/pve/qemu-server/.conf, /var/run/qemu-server/.pid).\n These are vendor-defined paths present on every PVE install and are touched\n by the most routine hypervisor administration, so the path appears as a\n command argument without any virtualization binary being invoked. Excluded\n at source by filter_pve_vm_state, which matches the directory without a\n trailing slash so that a bare directory argument (find /etc/pve/lxc\n /etc/pve/qemu-server) is covered as well.\n - >-\n The xdg-settings default-browser checks grepping qemu.desktop; excluded at\n source by filter_xdg_desktop_entry_scan\n - >-\n A Linux package manager querying or removing a package whose NAME contains\n a virtualization string (pacman -Qi qemu-system-x86, dpkg -l | grep qemu,\n rpm -qa | grep -i virtualbox), or an awk/pactree/grep helper handed the same\n package name as a label or search term. NOT excluded at source, deliberately -\n see the 2026-08-27 note above. Scope these locally per host.\nlevel: medium", "pattern_type": "sigma", "valid_from": "2025-11-17T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--195bf8d5-8231-59f1-aae2-f12befa102a0", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-09-30T03:16:41.48501Z", "modified": "2026-09-30T03:16:41.48501Z", "name": "6fbaa2637e7c", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "report", "spec_version": "2.1", "id": "report--66cfa6ea-e048-5321-893d-ff84b9a53c13", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-09-30T03:16:41.485138Z", "modified": "2026-09-30T03:16:41.485138Z", "name": "Houselet.exe — Masquerading as PlayStation Remote Play", "report_types": [ "threat-report" ], "published": "2025-11-17T00:00:00Z", "object_refs": [ "file--957249be-ec1c-5128-a7ff-5d17222c3d43", "indicator--dbbd7389-15de-512d-ba85-3f93fdbe11d3", "indicator--b27f9e8d-4e73-596e-a89f-6ee2988f5b69", "indicator--1038eb20-f4dd-5c58-99fd-e44292b5abc2", "indicator--196231fb-910a-5c11-aac5-ed563c448272", "indicator--23f6b8e5-b40c-53a3-858d-6911c32b2e64", "tool--195bf8d5-8231-59f1-aae2-f12befa102a0" ], "labels": [ "Loader", "Stealer", "Go", "Injection" ], "external_references": [ { "source_name": "The Hunters Ledger", "url": "https://the-hunters-ledger.com/reports/malware-analysis-houselet/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] } ] }