CastleRAT Multi-Stage Remote Access Trojan

Looks for: finger.exe invoked with retrieval-shaped arguments, especially from cmd.exe, PowerShell, or the Run-dialog lineage and with caret-heavy command text. Accomplishes: targets Blackpoint's repeated initial mechanism before CastleLoader or CastleRAT changes payloads.

Trace: H01 · A01

// HUNT: finger.exe retrieval with ClickFix-style command obfuscation
// HYPOTHESIS: H01
// USE: alert-candidate
// MITRE: T1204.004, T1105
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; FileName, CommandLine, ParentBaseFileName, aid
// FALSE POSITIVES: legacy finger diagnostics, network administrators, security labs, and compatibility tests
// TUNING: inventory legitimate finger owners and exclude by managed host plus approved parent/path, never by filename alone
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName = /^finger\.exe$/i
| CommandLine = /(?:@|\/user:|\^.{0,12}\^|\s-[a-z])/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Looks for: deno.exe running from Users, ProgramData, Temp, AppData, or Public and launched by a shell, MSI, or script host. Accomplishes: catches the bring-your-own-runtime transition used in the documented in-memory CastleRAT chain.

Trace: H02 · A02

// HUNT: Deno runtime execution from a user-writable staging path
// HYPOTHESIS: H02
// USE: alert-candidate
// MITRE: T1059.007
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName, aid
// FALSE POSITIVES: developers, CI workers, runtime managers, and approved Deno applications
// TUNING: exclude only approved signer/path/host combinations after owner review
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName = /^deno\.exe$/i
| ImageFileName = /\\(Users|ProgramData|Temp|AppData|Public)\\/i
| ParentBaseFileName = /^(cmd|powershell|pwsh|msiexec|wscript|cscript)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Looks for: Python or Pythonw running from a user-writable path with PyArmor, image, JavaScript, or loader-oriented arguments. Accomplishes: exposes the staged interpreter boundary while keeping packaged applications and research tooling as explicit lookalikes.

Trace: H03 · hunt-only

// HUNT: Staged Python or Pythonw execution with packed-script or image arguments
// HYPOTHESIS: H03
// USE: hunt
// MITRE: T1059.006
// CONF: medium
// FP: high
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; ImageFileName, CommandLine, ParentBaseFileName, aid
// FALSE POSITIVES: packaged Python applications, PyArmor users, data-science notebooks, and image-processing automation
// TUNING: scope to Q01/Q02 hosts or exclude owner-approved signed runtime paths and projects
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName = /^(python|pythonw)(\.exe)?$/i
| ImageFileName = /\\(Users|ProgramData|Temp|AppData|Public)\\/i
| CommandLine = /(?:pyarmor|\.jpe?g\b|\.png\b|\.js\b|loader|runtime)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Looks for: DNS requests to Steam Community carrying Python or Pythonw process context. Accomplishes: creates a narrow public-service dead-drop pivot that is meaningful only with unowned runtime and same-host delivery evidence.

Trace: H04 · hunt-only

// HUNT: Pythonw-attributed dead-drop DNS to Steam Community
// HYPOTHESIS: H04
// USE: hunt
// MITRE: T1102.003
// CONF: medium
// FP: high
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: DnsRequest or SuspiciousDnsRequest; DomainName, ContextBaseFileName, aid
// FALSE POSITIVES: game clients, automation, scraping, monitoring, and security research
// TUNING: never block the parent service; require Q01-Q03 or an unowned Pythonw path on the same host
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName = /(^|\.)steamcommunity\.com$/i
| ContextBaseFileName = /^(python|pythonw)(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, ContextProcessId_decimal, DomainName, aid])
| sort(@timestamp, order=desc, limit=1000)

Looks for: executable writes named deno.exe, python.exe, or pythonw.exe beneath Users, ProgramData, Temp, AppData, or Public. Accomplishes: finds bring-your-own-runtime staging before execution while retaining writer and hash context for same-host correlation.

Trace: H05 · hunt-only

// HUNT: Deno or Python runtime written into a user-writable staging path
// HYPOTHESIS: H05
// USE: hunt
// MITRE: T1105
// CONF: medium
// FP: high
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: NewExecutableWritten or PeFileWritten; TargetFileName, ContextBaseFileName, SHA256HashData, aid
// FALSE POSITIVES: developer runtime installers, package managers, application bundles, and software deployment
// TUNING: baseline approved runtime caches and prioritize Q01/Q02 lineage or unsigned one-off paths
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(NewExecutableWritten|PeFileWritten)$/
| TargetFileName = /\\(Users|ProgramData|Temp|AppData|Public)\\[^\r\n]*(deno|pythonw?)\.exe$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, SHA256HashData, aid])
| sort(@timestamp, order=desc, limit=1000)