APT37 / ScarCruft — NarwhalRAT (Fake Microsoft Alert → LNK → Batch → Compiled-Python RAT)

Looks for: Explorer or an archive tool (WinRAR/7-Zip/Windows Zip handler) spawning cmd/powershell with download / hidden / batch indicators — the LNK-inside-ZIP launch. Accomplishes: breaks the front door before staging. FP: low-med — some legit installers; flag hidden/encoded/curl/.bat tells.

// HUNT: ZIP->LNK launch -> cmd/powershell staging lineage
// MITRE: T1204.002, T1059.001, T1059.003 | CONF: high  FP: low-med  COST: low
// REQUIRES: ProcessRollup2 process telemetry
// FALSE POSITIVES: legit installers/IT scripts launched from Explorer -- flag hidden/encoded/curl/.bat tells
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(explorer|7zFM|7zG|winrar|rar|opener|isoburn)\.exe$/i
| FileName=/^(cmd|powershell|pwsh|mshta|wscript|cscript)\.exe$/i
| CommandLine=/(-w\s?hidden|-enc|FromBase64|IEX|Invoke-WebRequest|curl|\.bat|\.lnk|ExecutionPolicy\s+Bypass)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: the env-var substring-substitution obfuscation (%x:~n,1%) used by the batch droppers, and curl downloading to a user/temp path or running from a non-standard copy. Accomplishes: catches stage-3 staging. FP: low — substring-substitution command building is rare in benign scripts.

// HUNT: env-var substring obfuscation + curl ingress download
// MITRE: T1027, T1140, T1105, T1059.003 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 with full CommandLine
// FALSE POSITIVES: rare; some packagers build strings via %var:~%; confirm parent is cmd/.bat
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine=/%[A-Za-z0-9_]+:~\d+,1%/
   or (FileName=/^curl\.exe$/i and CommandLine=/(-o|--output|-O)\b/i and CommandLine=/https?:/i))
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: a process whose on-disk name differs from its PE OriginalFileName of python/pythonw (the userscreen.exe rename), or a Python interpreter loading a .cat/.pyc from a user path. Accomplishes: catches the compiled-Python RAT loader. FP: low-med — baseline sanctioned Python apps.

// HUNT: renamed pythonw (userscreen.exe) / compiled-Python .cat loader
// MITRE: T1036.003, T1059.006, T1620 | CONF: med-high  FP: low-med  COST: low
// REQUIRES: ProcessRollup2 with OriginalFileName (PE VersionInfo)
// FALSE POSITIVES: sanctioned packaged Python apps -- allow-list signer/path
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ((OriginalFileName=/^pythonw?\.exe$/i and FileName!=/^pythonw?\.exe$/i)
   or FileName=/^userscreen\.exe$/i
   or CommandLine=/\\(config|AccountConfig)\.cat\b/i
   or CommandLine=/\.cat["'\s]/i and ImageFileName=/python/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, OriginalFileName, ImageFileName, CommandLine], limit=200)

Looks for: file writes into the hidden %APPDATA%\naverwhale staging directory or the AccountPictures\UserInerfacePicture persistence path. Accomplishes: surfaces keylog/screenshot/audio staging. FP: medium — narrow on the specific dir names; correlate to Q3 on the same host.

FP note: file-write hunts can be noisy — anchor on the literal naverwhale / UserInerfacePicture directory names (note the misspelling) and require co-occurrence with a Q3 hit on the host.

// HUNT: NarwhalRAT staging/persistence directory writes
// MITRE: T1056.001, T1113, T1123, T1025 | CONF: medium  FP: medium  COST: low
// REQUIRES: file-write telemetry (FileCreateInfo / PeFileWritten)
// FALSE POSITIVES: anchor on literal naverwhale/UserInerfacePicture dir names; correlate to Q3
#event_simpleName=/PeFileWritten|NewExecutableWritten/
| TargetFileName=/\\(naverwhale|UserInerfacePicture)\\/i
| table([@timestamp, ComputerName, UserName, ImageFileName, TargetFileName], limit=200)

Looks for: execution or write of any reported NarwhalRAT MD5. Accomplishes: a high-fidelity known-sample sweep. FP: low — exact-hash match. Hashes rotate, so pair with the behavioral hunts.

// HUNT: known NarwhalRAT sample MD5s
// MITRE: T1204.002 | CONF: high  FP: low  COST: low
// REQUIRES: MD5HashData on process/file events
// FALSE POSITIVES: none on exact match; hashes rotate -- keep behavioral hunts on
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten/
| MD5HashData=/^(3715092aa00f380cefe8b4d2eddb7d08|7cef19f9c4480adac0cd4702ff98f46c|7eb9cee1f696727752169f25cf79a338|b6b0602310bb2d4360c52685119aac1b)$/i
| table([@timestamp, ComputerName, UserName, FileName, ImageFileName, MD5HashData], limit=200)

Looks for: a scheduled task created with the MS-lookalike name, or any task whose action runs from C:\Users\Public\AccountPictures\ — the NarwhalRAT relaunch. Accomplishes: a high-fidelity persistence signal. FP: low — no legit task runs from that user path.

// HUNT: NarwhalRAT scheduled-task persistence
// MITRE: T1053.005, T1036.005 | CONF: high  FP: low  COST: low
// REQUIRES: ScheduledTask telemetry or schtasks ProcessRollup2
// FALSE POSITIVES: low -- no benign task runs from Users\Public\AccountPictures
#event_simpleName=/ScheduledTaskRegistered|ScheduledTaskModified|ProcessRollup2|SyntheticProcessRollup2/
| (TaskName=/MicrosoftUserInterfacePicturesUpdate/i
   or TaskExecArguments=/Users\\Public\\AccountPictures/i
   or (FileName=/^schtasks\.exe$/i and CommandLine=/(\/create).*(Users\\Public\\AccountPictures|userscreen\.exe)/i))
| table([@timestamp, ComputerName, UserName, TaskName, TaskExecArguments, CommandLine], limit=200)

Looks for: DNS / connections to pcloud infrastructure made by a non-browser, user/temp-path binary (NarwhalRAT abusing the pCloud API as C2). Accomplishes: surfaces the cloud dead-drop channel. FP: medium — baseline sanctioned pCloud desktop clients; flag python/userscreen parents.

FP note: orgs that legitimately use pCloud will hit this — allow-list the official pCloud client by signer/path and require a non-browser, user-path image (e.g. userscreen.exe / a renamed pythonw).

// HUNT: pCloud API used as dead-drop C2 by non-browser binary
// MITRE: T1102, T1567.002 | CONF: medium  FP: medium  COST: med
// REQUIRES: DnsRequest and/or NetworkConnectIP4 telemetry
// FALSE POSITIVES: legit pCloud desktop client -- allow-list signer/path; flag user-path images
#event_simpleName=/DnsRequest|NetworkConnectIP4/
| (DomainName=/(^|\.)pcloud\.com$/i or DomainName=/api\.pcloud\.com$/i)
| ContextImageFileName=/\\(Temp|AppData|ProgramData|Users\\Public)\\/i
| ContextImageFileName!=/\\(chrome|msedge|firefox|brave|pcloud)\.exe$/i
| table([@timestamp, ComputerName, UserName, ContextImageFileName, DomainName, RemoteAddressIP4], limit=200)

Looks for: DNS / connections to the reported dead-drop front domains or hardcoded C2 IPs. Accomplishes: a targeted IOC sweep for the C2 channel. FP: low-med — these are reported-malicious atoms; some fronts are compromised legit sites, so confirm host context.

// HUNT: NarwhalRAT dead-drop resolver fronts + C2 IPs
// MITRE: T1071.001, T1102 | CONF: high  FP: low-med  COST: low
// REQUIRES: DnsRequest and/or NetworkConnectIP4 telemetry
// FALSE POSITIVES: fronts are compromised legit sites -- confirm initiating process context
#event_simpleName=/DnsRequest|NetworkConnectIP4/
| (DomainName=/(^|\.)(daehoat\.com|novel21\.co\.kr|webhostingkorea\.com|crwellfood\.com|fe01\.co\.kr)$/i
   or RemoteAddressIP4=/^(121\.254\.222\.(10|80)|211\.239\.157\.126|218\.150\.78\.(198|231)|61\.100\.9\.206)$/)
| table([@timestamp, ComputerName, UserName, ContextImageFileName, DomainName, RemoteAddressIP4], limit=200)