Astaroth WhatsApp Web Spambot

Looks for: creation of the distinctive ChromeAuto profile-copy directory beneath Public Temp. Accomplishes: catches the spambot's browser-session staging before contact enumeration while keeping directory naming and host context for triage.

Trace: H01 · A01

// HUNT: ChromeAuto browser-profile directory creation
// HYPOTHESIS: H01
// USE: alert-candidate
// MITRE: T1539
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: TargetDirectoryName plus ComputerName, UserName, aid
// FALSE POSITIVES: authorized browser-automation research or a deliberately named test directory
// TUNING: exclude only owner-approved lab assets and exact documented test windows
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(NewExecutableWritten|PeFileWritten|ZipFileWritten)$/
| test(@timestamp >= now() - 2592000000)
| TargetFileName = /\\Users\\Public\\Temp\\ChromeAuto_[^\\]+/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=1000)

Looks for: Chrome or Edge launched headlessly with a user-data directory under the ChromeAuto Public Temp path. Accomplishes: combines two distinctive automation behaviors into a strong process signal without depending on rotating Astaroth infrastructure.

Trace: H02 · A02

// HUNT: Headless Chromium with copied Public Temp profile
// HYPOTHESIS: H02
// USE: alert-candidate
// MITRE: T1539, T1102.002
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName
// FALSE POSITIVES: authorized Selenium tests, kiosk automation, or accessibility tooling
// TUNING: exclude only signed owner-approved automation with fixed host and command evidence
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| test(@timestamp >= now() - 2592000000)
| ImageFileName = /(?:chrome|msedge)\.exe$/i
| CommandLine = /--headless/i
| CommandLine = /--user-data-dir[^
]*\\Users\\Public\\Temp\\ChromeAuto_/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Looks for: ChromeDriver or EdgeDriver starting a headless Chromium process with automation flags. Accomplishes: exposes the browser-control stage for same-host correlation, while acknowledging legitimate testing frameworks as a substantial benign population.

Trace: H03 · hunt-only

// HUNT: WebDriver parent launching headless browser
// HYPOTHESIS: H03
// USE: hunt
// MITRE: T1102.002
// CONF: medium
// FP: high
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; ParentBaseFileName, ImageFileName, CommandLine
// FALSE POSITIVES: Selenium grids, QA automation, kiosk management, and accessibility tooling
// TUNING: inventory automation owners and exclude by signed parent path plus managed host group
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| test(@timestamp >= now() - 2592000000)
| ParentBaseFileName = /^(?:chromedriver|msedgedriver)\.exe$/i
| ImageFileName = /(?:chrome|msedge)\.exe$/i
| CommandLine = /(?:--headless|--disable-infobars|--remote-debugging-port)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Looks for: PowerShell, script host, or Python command lines that reference ChromeDriver or EdgeDriver with retrieval semantics. Accomplishes: catches a preparatory stage before browser automation but needs owner and download context to separate driver management.

Trace: H04 · hunt-only

// HUNT: Script tooling acquiring WebDriver binaries
// HYPOTHESIS: H04
// USE: hunt
// MITRE: T1105
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName
// FALSE POSITIVES: approved browser driver managers, QA bootstrap scripts, and developer tools
// TUNING: exclude signed enterprise driver managers only after owner, path, and destination review
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| test(@timestamp >= now() - 2592000000)
| ImageFileName = /(?:powershell|pwsh|wscript|cscript|python)\.exe$/i
| CommandLine = /(?:chromedriver|msedgedriver)/i
| CommandLine = /(?:invoke-webrequest|iwr|curl|downloadfile|downloadstring|https?:)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Looks for: process events carrying one of three SHA-256 values published with the spambot analysis. Accomplishes: gives responders an exact current pivot for known samples while keeping hash volatility and research-system exceptions visible.

Trace: H05 · hunt-only

// HUNT: Execution of current Astaroth component hashes
// HYPOTHESIS: H05
// USE: hunt
// MITRE: T1204.002
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 90d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; SHA256HashData, ImageFileName, CommandLine
// FALSE POSITIVES: authorized malware-analysis systems or preserved historical telemetry
// TUNING: exclude only isolated research assets with case ownership and a bounded analysis window
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| test(@timestamp >= now() - 7776000000)
| SHA256HashData = /^(?:d891d38b5a15fe750cd48ad29b26d7737c23ef6b47d6ec018dbb74264c578ddb|c7c62332bb91d144feb53993479244856b4ecfdaed151bab2a1a6a645e4bda5d|ec43a79fa53b048231cf45f3e7ebee03816d052e280063577f425369ad10a1e2)$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)