FakeAgent — Malicious Claude Artifact → SectopRAT — Hunt & Hardening Pack

Looks for: the two campaign masquerade filenames being written to disk or executed. Accomplishes: catches the user-execution stage at the moment the victim runs the fake installer, with the browser parent still visible. FP: low — Docker ships its installer as "Docker Desktop Installer.exe" and its runtime as Docker Desktop.exe (with a space) under Program Files, so a bare DockerDesktop.exe in a user path is anomalous on both counts.

// HUNT: FakeAgent fake-installer masquerade filenames (T1204.002 / T1036.005)
// MITRE: T1204.002, T1036.005
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2, PeFileWritten
// FALSE POSITIVES: a repackaged internal deployment of Docker Desktop that renames the binary
// LOOKBACK: 14d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context).
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten/
| (FileName=/^(ClaudeDesktop|DockerDesktop)\.exe$/i
   or TargetFileName=/\\(ClaudeDesktop|DockerDesktop)\.exe$/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, TargetFileName, ParentBaseFileName, SHA256HashData, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: the known-benign JetBrains jcef_helper.exe component executing under any filename except its own. Accomplishes: this is the masquerade itself, expressed as a rule rather than an IOC — it fires no matter what the attacker renames the vessel to next, which is why it is the highest-value query in the pack. FP: low. Never add this hash to a block list — it is a legitimate signed component; the signal is the name mismatch, not the file.

// HUNT: benign CEF host binary executing under a masquerade filename (T1036.005 / T1574.002)
// MITRE: T1036.005, T1574.002
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2 with SHA256HashData populated
// NOTE: f8acb8f5... is the BENIGN JetBrains jcef_helper.exe component. Do NOT block it.
// FALSE POSITIVES: an internally repackaged JetBrains IDE that renames the CEF helper
// LOOKBACK: 30d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context).
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| SHA256HashData="f8acb8f5cf88b77a4c27d7fd6856aa299bb178e85f9963c2fbd447d818da3ed0"
| FileName!=/^jcef_helper\.exe$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, ParentBaseFileName, GrandparentBaseFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: the VMProtect-packed libcef.dll by hash, or any libcef.dll written into or loaded from a Downloads / Temp / AppData path. Accomplishes: catches the first-stage side-load payload. FP: medium — per-user Electron and CEF applications legitimately install under \AppData\Local\Programs\, so the path arm needs one baselining pass before it is alertable; the hash arm is clean immediately.

// HUNT: FakeAgent first-stage libcef.dll side-load payload (T1574.002 / T1027.002)
// MITRE: T1574.002, T1027.002
// CONF: high  FP: medium  COST: low | REQUIRES: PeFileWritten, module-load hash telemetry
// TUNING: baseline then exclude your approved per-user CEF/Electron installs by directory
//         (e.g. \AppData\Local\Programs\<approved-vendor>\); the hash arm needs no tuning.
// ⚠ validate in tenant: module-load coverage ships as ImageHash in most tenants —
//   confirm your repo emits it, else fall back to Sysmon EventID 7 (see native hunts).
// LOOKBACK: 30d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context).
#event_simpleName=/PeFileWritten|NewExecutableWritten|ImageHash/
| (SHA256HashData="26bae4d7012bf59847ab4036a065419c3d4ca47e020479f55b3b2c6d0d21394a"
   or ((TargetFileName=/\\libcef\.dll$/i or ImageFileName=/\\libcef\.dll$/i)
       and (TargetFileName=/\\Users\\[^\\]+\\(Downloads|AppData)\\/i
            or ImageFileName=/\\Users\\[^\\]+\\(Downloads|AppData)\\/i
            or TargetFileName=/\\Windows\\Temp\\/i
            or ImageFileName=/\\Windows\\Temp\\/i)))
| table([@timestamp, aid, ComputerName, UserName, TargetFileName, ImageFileName, SHA256HashData, ContextBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: the persistence stage — a signed IBM SPSS sslconf.exe, its paired tempdir.dll, or the encrypted appcfg.dat payload, anywhere under a per-user Microsoft\EdgeUpdate\Install\ directory. Accomplishes: the strongest single signal in the pack — a statistics-package binary inside an Edge-updater directory has no benign explanation. FP: medium, driven entirely by the bare sslconf filename arm firing on genuine IBM SPSS estates; the path arm on its own is effectively FP-free.

// HUNT: FakeAgent second-stage staging dir + sideload pair (T1574.002 / T1036.005 / T1547)
// MITRE: T1574.002, T1036.005, T1547, T1027.013
// CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2, PeFileWritten
// TUNING: if your estate genuinely deploys IBM SPSS, exclude the vendor install root
//         (\Program Files\IBM\SPSS\) and keep only the EdgeUpdate\Install path arm.
//         Genuine Edge updater content lives under \Program Files (x86)\Microsoft\EdgeUpdate\.
// LOOKBACK: 30d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context).
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten/
| (ImageFileName=/\\Microsoft\\EdgeUpdate\\Install\\/i
   or TargetFileName=/\\Microsoft\\EdgeUpdate\\Install\\/i
   or FileName=/^sslconf(\.exe)?$/i
   or TargetFileName=/\\(tempdir\.dll|appcfg\.dat|cache\.dat)$/i)
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData, ParentBaseFileName, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: Run-key values, scheduled-task actions, or schtasks command lines that reference the staging directory or any of the campaign's masquerade binaries. Accomplishes: catches the reinfection loop that made this campaign persistent across 29 estates. FP: medium — genuine Microsoft Edge updater persistence also contains the string "EdgeUpdate", so the Install subdirectory and the per-user location are what separate malicious from benign.

// HUNT: FakeAgent persistence into the per-user EdgeUpdate staging dir (T1547.001 / T1053.005)
// MITRE: T1547.001, T1053.005
// CONF: high  FP: medium  COST: low | REQUIRES: AsepValueUpdate, ScheduledTaskRegistered, ProcessRollup2
// TUNING: exclude genuine Edge updater persistence under \Program Files (x86)\Microsoft\EdgeUpdate\;
//         only a per-user \AppData\Roaming\Microsoft\EdgeUpdate\Install\ target is anomalous.
// LOOKBACK: 30d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context).
#event_simpleName=/AsepValueUpdate|RegGenericValueUpdate|ScheduledTaskRegistered|ProcessRollup2|SyntheticProcessRollup2/
| (RegStringValue=/EdgeUpdate\\Install|ClaudeDesktop\.exe|DockerDesktop\.exe|sslconf\.exe/i
   or TaskExecutable=/EdgeUpdate\\Install|ClaudeDesktop\.exe|DockerDesktop\.exe|sslconf\.exe/i
   or CommandLine=/schtasks.{0,80}(EdgeUpdate\\Install|ClaudeDesktop|DockerDesktop|sslconf)/i)
| table([@timestamp, aid, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, TaskName, TaskExecutable, CommandLine], limit=200)
| sort(@timestamp, order=desc)

Looks for: any outbound connection to the 21 C2 addresses Huntress decrypted from the BNB Smart Chain contract transaction history (2025-05-30 through 2026-06-12). Accomplishes: a retrospective sweep that reaches well beyond this campaign — a hit on a 2025 address still indicates the same operator touched the host. FP: low, but note the historical addresses are over a year old and shared hosting reuse is plausible, so treat a hit on anything other than 2.24.131[.]246 as a lead to confirm rather than a confirmed compromise.

// HUNT: FakeAgent / SectopRAT C2 egress, full decrypted address set (T1071.001)
// MITRE: T1071.001, T1102
// CONF: high  FP: low  COST: medium | REQUIRES: NetworkConnectIP4
// 2.24.131.246 is the CURRENT C2 (since 2026-06-12); the rest are historical (2025-05-30 onward).
// LOOKBACK: 90d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context).
#event_simpleName=/NetworkConnectIP4/
| in(RemoteAddressIP4, values=["2.24.131.246", "107.189.24.67", "104.194.133.210", "107.189.26.86", "107.189.21.86", "45.59.124.17", "45.59.125.228", "45.59.122.82", "107.189.17.143", "45.59.122.134", "45.59.122.235", "107.189.22.118", "107.189.20.32", "107.189.20.95", "107.189.24.255", "45.59.117.145", "45.59.114.190", "45.59.123.122", "45.59.117.67", "195.110.58.222", "191.101.80.211"])
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, LocalAddressIP4, RemoteAddressIP4, RemotePort], limit=max)
| sort(@timestamp, order=desc)

Looks for: two things at once — the campaign's known delivery and backup domains (high confidence), and the reusable pattern behind claude.ai.download-app[.]us: a trusted software brand planted as the leading label of a registrable domain the brand does not own. Accomplishes: turns a one-off IOC into a standing control that catches the next campaign. FP: high on the generic arm — legitimate CDN and SaaS vanity chains do exactly this, so allowlist first and split the arms into two saved searches if you intend to alert.

// HUNT: FakeAgent delivery/backup domains + brand-as-leading-label lookalikes (T1583.001 / T1566.002)
// MITRE: T1583.001, T1566.002, T1071.001
// CONF: medium  FP: high  COST: medium | REQUIRES: DnsRequest
// TUNING: the second arm fires on legitimate CDN/vanity chains that embed a brand label.
//         Allowlist your own CDN and SaaS vanity domains, then keep only unknown registrables.
//         Split the two arms into separate saved searches before promoting either to alerting.
// LOOKBACK: 30d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context).
#event_simpleName=/DnsRequest|SuspiciousDnsRequest/
| DomainName=/^((.*\.)?(download-app\.us|downloading-api\.it\.com|5ca8758c-02d0-4a72-89c8-d468b66dda41\.com)|(claude\.ai|anthropic\.com|docker\.com|slack\.com|zoom\.us)\.[a-z0-9-]{2,40}\.[a-z]{2,12})$/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, DomainName], limit=200)
| sort(@timestamp, order=desc)

Looks for: the three malicious hashes anywhere they can surface — as a running process, as a loaded module, or as a written file. Accomplishes: the fastest confirm/deny for "were we hit". FP: low (exact-hash matching). Deliberately excludes the two benign-but-abused component hashes, which belong in Q2 and Q4 as hunts, never as detections.

// HUNT: FakeAgent malicious hash sweep (T1204.002 / T1574.002)
// MITRE: T1204.002, T1574.002
// CONF: high  FP: low  COST: medium | REQUIRES: ProcessRollup2, PeFileWritten, module-load hashes
// ⚠ validate in tenant: the ImageHash arm depends on module-load telemetry being enabled.
// Malicious only: libcef.dll, tempdir.dll, embedded SectopRAT .NET payload.
// LOOKBACK: 90d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context).
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten|ImageHash/
| in(SHA256HashData, values=["26bae4d7012bf59847ab4036a065419c3d4ca47e020479f55b3b2c6d0d21394a", "1cd58cfba596da296ab1878d74023e00c399345a1b6c2a0e5446c53563f4e3bb", "1fe3646d27d286db8123297e06ae7badf3e26f352a04f91b6d82c28869a91664"])
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: outbound connections whose initiating process is one of the campaign's masquerade vessels, grouped by destination so a beacon pattern stands out. Accomplishes: catches the SectopRAT stage even after the C2 has rotated via EtherHiding, because the vessel name is stable while the address is not. FP: medium — a genuine JetBrains CEF helper talks to the internet routinely, so jcef_helper.exe needs baselining; ClaudeDesktop.exe, DockerDesktop.exe and sslconf.exe making network connections are anomalous on their own.

// HUNT: sideload vessel beaconing — survives EtherHiding C2 rotation (T1071.001 / T1055)
// MITRE: T1071.001, T1102, T1555.003
// CONF: medium  FP: medium  COST: medium | REQUIRES: NetworkConnectIP4
// TUNING: exclude jcef_helper.exe destinations belonging to your approved JetBrains estate
//         (IDE telemetry/licensing endpoints); keep every ClaudeDesktop/DockerDesktop/sslconf row.
// LOOKBACK: 30d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context).
#event_simpleName=/NetworkConnectIP4/
| ContextBaseFileName=/^(ClaudeDesktop|DockerDesktop|sslconf|jcef_helper)\.exe$/i
| groupBy([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], function=count(as=Hits), limit=2000)
| sort(Hits, order=desc, limit=200)

Looks for: the generic version of this actor's tradecraft — any of the classic CEF sideload payload DLLs appearing in a Downloads / AppData / Windows\Temp path. Accomplishes: covers the April 2026 fake Docker Desktop precursor and whatever the operator renames the vessel to next, since the payload DLL name is the one thing the CEF loader cannot change. FP: high — this is a baselining hunt, not a detection. Run it once, allowlist your approved per-user Electron/CEF apps, then re-run weekly for new publishers only.

// HUNT: broad — CEF/Chromium sideload payload DLLs in user-writable dirs (T1574.002)
// MITRE: T1574.002
// CONF: medium  FP: high  COST: medium | REQUIRES: PeFileWritten, module-load hash telemetry
// TUNING: baseline-first query. Allowlist the per-user Electron/CEF apps your estate ships
//         by directory, then alert only on directories seen for the first time.
// ⚠ validate in tenant: the ImageHash arm depends on module-load telemetry being enabled.
// LOOKBACK: 30d. Set the search window in Falcon; no in-query time filter (an expression on the right of a comparison is not valid in CQL filter context).
#event_simpleName=/PeFileWritten|NewExecutableWritten|ImageHash/
| (TargetFileName=/\\(libcef|tempdir|chrome_elf)\.dll$/i
   or ImageFileName=/\\(libcef|tempdir|chrome_elf)\.dll$/i)
| (TargetFileName=/\\Users\\[^\\]+\\(Downloads|AppData)\\/i
   or ImageFileName=/\\Users\\[^\\]+\\(Downloads|AppData)\\/i
   or TargetFileName=/\\Windows\\Temp\\/i
   or ImageFileName=/\\Windows\\Temp\\/i)
| groupBy([TargetDirectoryName, ContextBaseFileName, SHA256HashData], function=count(as=Hits), limit=2000)
| sort(Hits, order=desc, limit=300)