CARBONATO — Docker Botnet with an AI Agent Operator

Looks for: an infected host issuing its own curl/wget call against a target's Docker API to create a privileged, host-mounted container — the worm's propagation step, seen from the source side. FP: legitimate Docker orchestration/CI tooling calling the Remote API with Privileged:true against a real target.

// HUNT: CARBONATO - T1190 Exploit Public-Facing Application + T1610 Deploy Container (outbound propagation)
// HYPOTHESIS: an infected host performing CARBONATO worm propagation issues its own
//   outbound HTTP calls against a target's Docker API on :2375 to create a privileged,
//   host-mounted container. If this fires, the ALERTING HOST is the attacker/source,
//   not (necessarily) the victim -- treat it as an active-infection indicator.
// MITRE: T1190, T1610 | CONF: high  FP: medium  COST: low | REQUIRES: process execution telemetry
// TUNING: exclude hosts running legitimate Docker orchestration/CI tooling (Portainer,
//   Rancher, GitLab/Jenkins Docker-in-Docker runners) that legitimately call
//   containers/create with Privileged:true against a REMOTE Docker API on 2375 --
//   scope to hosts outside your CI/orchestration allowlist.
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(curl|wget)$/i
| CommandLine like "*2375/containers/create*"
| CommandLine like "*Privileged*"
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Looks for: nsenter attaching to host PID 1's mount/UTS/net/IPC namespaces from inside a container. FP: legitimate container-debugging and security tooling (Falco, kube-bench, sysdig) or manual sysadmin troubleshooting.

// HUNT: CARBONATO - T1611 Escape to Host (nsenter into host PID 1)
// HYPOTHESIS: after launching a privileged container with the host filesystem
//   bind-mounted and host PID/network namespaces, the implant runs nsenter to
//   attach to host PID 1 and execute commands as if running directly on the host.
// MITRE: T1611, T1610 | CONF: high  FP: medium  COST: low | REQUIRES: process execution telemetry
// TUNING: exclude known container-debugging / security-tooling hosts that use
//   nsenter legitimately (Falco, kube-bench, sysdig, manual sysadmin troubleshooting
//   sessions) -- scope to hosts NOT on the container-ops allowlist, or pair with
//   Q3/Q6/Q7 for corroborating implant evidence before escalating.
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^nsenter$/i
| CommandLine like "*-t 1*"
| CommandLine like "*-m*"
| CommandLine like "*-u*"
| CommandLine like "*-n*"
| table([@timestamp, aid, ComputerName, UserName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Looks for: execution of the implant's named entrypoint scripts from their known drop path. FP: negligible — path and filenames are highly specific.

// HUNT: CARBONATO - T1609 Container Administration Command / Implant Entrypoint Execution
// HYPOTHESIS: the deployed container runs entry.sh (v5.3) from /opt/gh0st/, or its
//   companion auto-persist-host.sh, to establish the reverse tunnel, persistence
//   hooks, and Hermes Agent install in one shot.
// MITRE: T1609, T1543 | CONF: high  FP: low  COST: low | REQUIRES: process execution telemetry
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(entry\.sh|auto-persist-host\.sh)$/i
| ImageFileName like "*/opt/gh0st/*"
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Looks for: a process writing into any of the four autostart locations, or enabling a suspiciously-named systemd unit. FP: configuration management (Ansible/Puppet/Chef/cloud-init/Salt) and package post-install scripts write to these same paths constantly — this is the noisiest query in the pack.

// HUNT: CARBONATO - T1053.003/T1053.006/T1037.004 Persistence via Cron, Systemd Timers, rc.local, OpenRC
// HYPOTHESIS: entry.sh installs redundant persistence across four Linux autostart
//   mechanisms so removing any single one does not kill the implant. Look for a
//   process writing into any of the four locations, or enabling a suspicious
//   systemd unit/timer.
// MITRE: T1053.003, T1053.006, T1037.004 | CONF: medium  FP: high  COST: medium | REQUIRES: process execution telemetry
// TUNING: this is one of the noisiest queries in the pack -- configuration
//   management (Ansible, Puppet, Chef, cloud-init, Salt), package managers
//   (apt/dpkg/yum postinst scripts), and routine sysadmin cron edits all write
//   to these same paths constantly. Scope to hosts outside the CM/patch-window
//   allowlist, and correlate with Q3/Q6/Q7/Q12 before treating a hit as
//   confirmed CARBONATO activity rather than routine administration.
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (FileName=/^(tee|cp|install|mv)$/i and (CommandLine like "*/etc/cron.d/*" or CommandLine like "*/etc/systemd/system/*.timer*" or CommandLine like "*/etc/rc.local*" or CommandLine like "*/etc/init.d/*" or CommandLine like "*/etc/conf.d/*"))
 or (FileName=/^systemctl$/i and CommandLine like "*enable*" and (CommandLine like "*netd-svc*" or CommandLine like "*gh0st*" or CommandLine like "*fsociety*" or CommandLine like "*resolved*"))
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Looks for: chattr +i, which entry.sh uses so persistence files and implant binaries survive a naive "delete and forget" response. FP: log-integrity tooling (auditd, OSSEC/Wazuh) and some hardening baselines legitimately use chattr +i on config/log files.

// HUNT: CARBONATO - T1222.002 File and Directory Permissions Modification (chattr +i)
// HYPOTHESIS: entry.sh marks its persistence files and implant binaries immutable
//   with chattr +i so a defender's "delete and forget" response silently fails and
//   the paired watchdog can re-pull the implant if the container/file disappears.
// MITRE: T1222.002 | CONF: medium  FP: medium  COST: low | REQUIRES: process execution telemetry
// TUNING: chattr +i is also used legitimately by log-integrity tooling (auditd,
//   OSSEC/Wazuh agents protecting their own config) and some hardening baselines
//   that lock down /etc/passwd, /etc/shadow, or SSH host keys. Exclude known
//   security-agent parent processes and baseline-managed paths; a hit on
//   /opt/gh0st/, /root/.hermes/, /usr/local/bin/.docker-network-monitor, or
//   /usr/sbin/systemd-logind is high-confidence regardless.
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^chattr$/i
| CommandLine like "*+i*"
| table([@timestamp, aid, ComputerName, UserName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Looks for: any exec'd process whose FileName/CommandLine contains "kworker". FP: essentially none — real kworker kernel threads are created by kthreadd and never exec()'d as a user image, so they never generate this event type in the first place; any hit here is a spoof by definition.

// HUNT: CARBONATO - T1036.004 Masquerade Task or Service (fake [kworker] process arguments)
// HYPOTHESIS: entry.sh disguises the implant's process arguments as the kernel
//   thread "[kworker/u2:0]". Genuine kworker threads are kernel threads created by
//   kthreadd; they are never exec()'d as a user-mode image and therefore never
//   generate this event type at all. Any ProcessRollup2/SyntheticProcessRollup2
//   event whose FileName or CommandLine contains "kworker" is, by definition,
//   not a real kernel worker.
// MITRE: T1036.004 | CONF: high  FP: low  COST: low | REQUIRES: process execution telemetry
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/kworker/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, FileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Looks for: a process named systemd-logind/systemd-resolved spawned by something other than the expected init chain. FP: minimal-container base images that legitimately reimplement these binaries, or non-systemd (OpenRC-only) hosts where the "expected parent" baseline differs.

// HUNT: CARBONATO - T1036.005 Match Legitimate Name or Location (XMRig disguised as systemd-logind / systemd-resolved)
// HYPOTHESIS: the host-side XMRig miner is dropped and executed as
//   /usr/sbin/systemd-logind, and the deployed container presents a fake
//   "systemd-resolved" banner. A process using the real systemd service basename
//   but spawned by something other than the expected init chain (systemd/init as
//   PID 1, or containerd-shim for the container-side fake) is the tell.
// MITRE: T1036.005 | CONF: medium  FP: medium  COST: low | REQUIRES: process execution telemetry
// TUNING: on hosts using a non-systemd init (OpenRC-only, containers built
//   without systemd) the "expected parent" baseline differs -- validate the
//   normal parent for systemd-logind/systemd-resolved in your fleet before
//   enabling detect-to-prevent; false positives cluster on minimal-container
//   base images that legitimately reimplement these binaries.
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(systemd-logind|systemd-resolved)$/i
| !in(ParentBaseFileName, values=["systemd", "init", "containerd-shim", "containerd-shim-runc-v2"])
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, CommandLine])
| sort(@timestamp, order=desc)

Looks for: the SSH client reverse-forward flags (-R/-N), since the actual remote port varies per host (derived from MD5 of the victim IP). FP: reverse SSH tunnels are a completely normal remote-support/bastion technique — this is a wide behavioral net, meant to be cross-referenced against Q9's known destination IPs.

// HUNT: CARBONATO - T1572 Protocol Tunneling (reverse SSH tunnel establishment)
// HYPOTHESIS: entry.sh opens a reverse SSH tunnel (ssh -R ... -N) to a relay in
//   Costa Rica, with the remote port derived from an MD5 hash of the victim's own
//   IP. The exact port varies per host, so hunt the SSH CLIENT BEHAVIOR (-R/-N
//   reverse-forward flags to an external destination) rather than a fixed port.
// MITRE: T1572, T1021.004 | CONF: medium  FP: high  COST: low | REQUIRES: process execution telemetry
// TUNING: reverse SSH tunnels are a completely normal remote-support and
//   bastion-hopping technique. Exclude your known jump-hosts, support-tunnel
//   service accounts, and any destination inside your own ASNs/VPN ranges.
//   Escalate immediately if the destination matches Q9's known CARBONATO IPs or
//   sits in AS262145 (Costa Rica).
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^ssh$/i
| CommandLine like "*-R*"
| CommandLine like "*-N*"
| table([@timestamp, aid, ComputerName, UserName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Looks for: outbound connections to any of the five published CARBONATO IPv4 addresses, joined back to the initiating process for triage context. FP: low — exact IP match; note these are single-sourced (ThreatDown only), so they ship at action=detect, not prevent.

// HUNT: CARBONATO - Network Connections to Known C2 / Beacon / Reverse-Tunnel Infrastructure
// HYPOTHESIS: an infected host beacons to one of CARBONATO's five published IPv4
//   addresses (C2 hub, fsociety-era C2, beacon/reverse-shell, LLM gateway, or the
//   Costa Rica reverse-tunnel sink).
// SOURCE NOTE: all five IPs are single-sourced to the ThreatDown primary report
//   (no second independent source publishes the literal addresses) -- shipped at
//   action=detect, not prevent, per two-source policy for prevent/critical IOCs.
// MITRE: T1071.001, T1572 | CONF: high  FP: low  COST: low | REQUIRES: network connection telemetry
// LOOKBACK: 7d
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4=/^(45\.79\.183\.61|91\.99\.195\.164|213\.136\.79\.115|213\.136\.83\.197|190\.211\.124\.187)$/
| rename(field=ContextProcessId_decimal, as=TargetProcessId_decimal)
| join(query={#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/}, field=TargetProcessId_decimal, include=[ImageFileName, CommandLine])
| table([@timestamp, aid, ComputerName, UserName, RemoteAddressIP4, RemotePort, ImageFileName, CommandLine])
| sort(@timestamp, order=desc)

Looks for: DNS resolution of any of the three carbonato-proxy-*.vercel.app subdomains. FP: low — exact subdomain match. These proxies are reported suspended, so a hit is retrospective evidence of past contact, not necessarily live C2 today.

// HUNT: CARBONATO - T1071.001 DNS Resolution of LLM-Proxy C2 Domains
// HYPOTHESIS: the operator's LLM gateway was additionally proxied through three
//   Vercel-hosted domains. ThreatDown reports all three as suspended at time of
//   publication; a hit is retrospective evidence of past C2 contact, not
//   necessarily live C2 today.
// SOURCE NOTE: single-sourced to ThreatDown -- action=detect, not prevent.
// MITRE: T1071.001 | CONF: high  FP: low  COST: low | REQUIRES: DNS request telemetry
// LOOKBACK: 30d (proxies are suspended; widen the window to catch historical contact)
#event_simpleName=DnsRequest
| DomainName=/^carbonato-proxy-(drab|zeta|zeta-2)\.vercel\.app$/i
| table([@timestamp, aid, ComputerName, UserName, DomainName])
| sort(@timestamp, order=desc)

Looks for: a single host generating many distinct port-2375 connection attempts in a short window — the worm's 5-minute /24 scan loop. FP: vulnerability scanners and Docker orchestration management hosts polling many nodes.

// HUNT: CARBONATO - T1046 Network Service Discovery + Worm Propagation Sweep
// HYPOTHESIS: an infected host scans its attached /24 subnets for exposed Docker
//   daemons on tcp/2375 every 5 minutes. A single host generating many distinct
//   port-2375 connection attempts in a short window is the worm's scan loop, not
//   a person.
// MITRE: T1046, T1210 (repeated exploitation against each newly found host) | CONF: medium  FP: medium  COST: medium | REQUIRES: network connection telemetry
// TUNING: exclude known vulnerability-scanner / asset-inventory service accounts
//   and hosts (Nessus, Qualys, Rapid7 InsightVM, internal CMDB scan windows) and
//   legitimate Docker Swarm / Portainer / Rancher management hosts that poll many
//   node Docker APIs on a schedule.
// LOOKBACK: 1h (the worm's scan interval is 5 minutes; a 1h window comfortably
//   catches a full sweep cycle without an in-query time filter)
#event_simpleName=NetworkConnectIP4
| RemotePort=2375
| groupBy([aid, ComputerName], function=[count(as=Attempts), count(RemoteAddressIP4, distinct=true, as=DistinctTargets)], limit=1000)
| test(DistinctTargets >= 20)
| sort(DistinctTargets, order=desc)

Looks for: the known CARBONATO env-var/secret strings and any process referencing the loot directory. FP: negligible — these are campaign-specific literal strings.

// HUNT: CARBONATO - T1552.001 Unsecured Credentials (AI API key / secret loot collection)
// HYPOTHESIS: the GH0ST persona's top-priority objective is exfiltrating AI
//   provider API keys, storing every credential in plaintext under
//   /root/.hermes/loot/. Hunt for the known CARBONATO env-var and secret strings,
//   and for process activity referencing the loot directory.
// MITRE: T1552.001, T1552 | CONF: high  FP: low  COST: low | REQUIRES: process execution telemetry
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine like "*CARBONATO_API_KEY*" or CommandLine like "*GH0ST_C2*" or CommandLine like "*FSOCIETY_DISABLE_TUNNEL*" or CommandLine like "*GATEWAY_ALLOW_ALL_USERS*" or CommandLine like "*carbonato125*" or CommandLine like "*/root/.hermes/loot/*")
| table([@timestamp, aid, ComputerName, UserName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Looks for: XMRig's own command-line flags, independent of the systemd-logind masquerade (Q7) since some deployments run it under its real name. FP: rare legitimate mining/benchmarking workloads.

// HUNT: CARBONATO - T1496 Resource Hijacking (XMRig miner execution)
// HYPOTHESIS: XMRig is deployed as the secondary payload, most often disguised as
//   /usr/sbin/systemd-logind (see Q7). Hunt the miner's own command-line flags
//   independent of the masquerade, since some deployments run it under its real
//   name from a container repository (fsociety/xmrig, xmrig-agent).
// MITRE: T1496 | CONF: high  FP: medium  COST: low | REQUIRES: process execution telemetry
// TUNING: stratum-protocol flags and "--donate-level" are effectively unique to
//   XMRig and its forks, but a small number of organizations legitimately run
//   authorized mining/benchmarking workloads -- exclude any host on an approved
//   mining-research or benchmarking allowlist.
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine like "*stratum+tcp*" or CommandLine like "*stratum+ssl*" or CommandLine like "*--donate-level*" or FileName=/^xmrig$/i)
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, FileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)

Looks for: dockerd started with an unauthenticated TCP listener on 2375 — this is NOT a compromise detection, it is an exposure audit. Run it on a schedule. FP: low.

// HUNT: CARBONATO - Proactive Exposure Audit: Docker Daemon Listening Unauthenticated on tcp/2375
// HYPOTHESIS: this is NOT a compromise detection -- it is an exposure audit. Any
//   host running dockerd with an unauthenticated TCP listener is a CARBONATO
//   initial-access target regardless of whether it has been hit yet. Run this on
//   a schedule, not just after an incident.
// MITRE: T1190 (the exposure this technique exploits) | CONF: high  FP: low  COST: low | REQUIRES: process execution telemetry
// LOOKBACK: 30d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^dockerd$/i
| CommandLine like "*-H*tcp://*"
| CommandLine like "*2375*"
| table([@timestamp, aid, ComputerName, UserName, CommandLine])
| sort(@timestamp, order=desc)

Looks for: process activity reading/writing the SOUL.md persona path, as a proxy for the file-content check CQL cannot perform natively. FP: unrelated developer or roleplay-bot repos reusing the same filename/string if the path qualifier is dropped.

// HUNT: CARBONATO - Hermes Agent SOUL.md Persona Tampering Signature (GH0ST)
// HYPOTHESIS: ThreatDown's own top recommended abuse signature is the SOUL.md
//   persona file at /root/.hermes/SOUL.md containing the string "GH0ST". Falcon's
//   documented data model does not expose a generic file-write/read event for
//   arbitrary text files (typed events exist for PE/ELF/Zip/Jar, not persona
//   config text), so this is hunted via the process telemetry proxy: any process
//   reading, writing, or grepping that specific path. Treat a hit as
//   high-confidence and pair with a direct RTR file-content check for the
//   authoritative answer -- see Coverage Map (Section 15) for the honest gap.
// MITRE: T1552.001 (loot/persona file), T1036 | CONF: medium  FP: medium  COST: low | REQUIRES: process execution telemetry (file-content confirmation requires RTR / a file-integrity tool, not CQL)
// TUNING: scope strictly to the /root/.hermes/ path -- a bare match on "SOUL.md"
//   or "GH0ST" without the path qualifier will pick up unrelated developer or
//   roleplay-bot repos that happen to use the same filename/string.
// LOOKBACK: 7d
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(cat|grep|less|head|tail|vi|vim|nano|find)$/i
| CommandLine like "*/root/.hermes/*"
| table([@timestamp, aid, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])
| sort(@timestamp, order=desc)