PayoutsKing (STAC4713 / GOLD ENCOUNTER) — Hidden-QEMU Ransomware

Looks for: qemu-system-* executing (esp. with hidden/headless + netdev/hostfwd args). Accomplishes: the hidden-VM scaffolding — the flagship signal. FP: sanctioned virtualization hosts (allow-list).

// HUNT: PayoutsKing hidden QEMU VM (qemu-system on a non-virtualization host)
// MITRE: T1564.006 | CONF: high  FP: low-med  COST: low
// TUNING: allow-list sanctioned virtualization host group
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^qemu-system-(x86_64|i386|aarch64)\.exe$/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, AuthenticationId], limit=200)

Looks for: a scheduled task named TPMProfiler or any task whose action launches qemu-system. Accomplishes: the VM launcher / persistence. FP: none expected.

// HUNT: PayoutsKing VM-launcher scheduled task
// MITRE: T1053.005, T1564.006 | CONF: high  FP: low  COST: low
#event_simpleName=ScheduledTaskRegistered
| (TaskName=/TPMProfiler/i or CommandLine=/qemu-system/i)
| table([@timestamp, ComputerName, UserName, TaskName, CommandLine], limit=200)

Looks for: a qemu-system command line referencing a disk image with a .db/.dll extension (disguised guest disk). Accomplishes: the disguised-disk indicator. FP: low — verify the file is a qcow2/raw image.

// HUNT: PayoutsKing disguised QEMU disk (.db/.dll as a VM image)
// MITRE: T1564.006, T1036 | CONF: medium  FP: medium  COST: low
// TUNING: confirm the referenced file is a qcow2/raw image (magic)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^qemu-system/i
| CommandLine=/(-drive|-hda|file=).+\.(db|dll|dat|bin)/i
| table([@timestamp, ComputerName, UserName, CommandLine], limit=200)

Looks for: reverse-SSH (ssh -R), Chisel, or QEMU hostfwd port-forwarding establishing a covert channel. Accomplishes: the tunnel. FP: some admin SSH — flag -R + external + a same-host Q1 hit.

// HUNT: PayoutsKing covert tunnel (reverse-SSH / Chisel / QEMU hostfwd)
// MITRE: T1572, T1090 | CONF: med-high  FP: medium  COST: low
// TUNING: correlate to Q1; flag ssh -R / chisel / hostfwd to external hosts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(ssh(\.exe)?\s+.*-R\s|chisel(\.exe)?\s+(client|server)|hostfwd=tcp::|netcat\s+-e)/i
| table([@timestamp, ComputerName, UserName, FileName, CommandLine], limit=200)

Looks for: vssuirun.exe/vssadmin shadow creation, or print/copy of NTDS.dit/SAM/SYSTEM over SMB. Accomplishes: domain-credential theft — escalate immediately. FP: very low.

// HUNT: PayoutsKing NTDS/SAM theft (VSS + SMB print)
// MITRE: T1003.003 | CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (CommandLine=/(vssuirun|vssadmin.+create\s+shadow|wmic\s+shadowcopy)/i
   or CommandLine=/(print|copy).+(ntds\.dit|\\SAM\b|\\SYSTEM\b|\\\\.+\\(C\$|ADMIN\$))/i)
| table([@timestamp, ComputerName, UserName, FileName, CommandLine], limit=200)

Looks for: the SolarWinds Web Help Desk process spawning shells/odd children (CVE-2025-26399 exploitation). Accomplishes: initial access. FP: verify; pair with N1 (VPN/WHD logs).

// HUNT: SolarWinds Web Help Desk exploitation (CVE-2025-26399)
// MITRE: T1190 | CONF: medium  FP: medium  COST: low
// TUNING: pair with N1 (SonicWall VPN / WHD logs); flag WHD/java spawning shells
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentImageFileName=/(WebHelpDesk|whd|tomcat|java)/i
| FileName=/^(cmd|powershell|pwsh|whoami|net|net1)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentImageFileName, FileName, CommandLine], limit=200)