RustDuck Botnet — Rust-Rebuilt IoT & Server DDoS Swarm

Looks for: a web/app service process (php/httpd/nginx/java/tomcat/couchdb) spawning a Unix shell or download tool. Accomplishes: catches the ThinkPHP/Jenkins/Hadoop YARN/CouchDB RCE foothold. FP: medium — some apps legitimately shell out; exclude known deploy/health-check scripts and CI agents.

// HUNT: exposed app service spawning a shell / download tool (RustDuck RCE ingress)
// MITRE: T1190, T1059.004 | CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2 (Linux)
// TUNING: exclude known deploy/health-check scripts, CI/Jenkins build steps, container init
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(php|php-fpm|httpd|apache2|nginx|java|tomcat|catalina|couchdb|beam\.smp)$/i
| FileName=/^(sh|bash|dash|ash|curl|wget|tftp|busybox)$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: curl/wget/tftp pulling from a bare-IP HTTP URL (no domain), including the known delivery node. Accomplishes: the loader download. FP: medium — some infra pulls from IPs; the bare-IP-URL pattern plus a server context is the discriminator.

// HUNT: download tool fetching from a raw-IP URL (RustDuck loader delivery)
// MITRE: T1105 | CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2 (Linux)
// TUNING: allow-list sanctioned internal mirrors / package hosts by IP
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(curl|wget|tftp|busybox)$/i
| CommandLine=/176\.65\.139\.204|https?:[\\/][\\/][0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: a process image running out of /tmp, /var/tmp, /dev/shm or /run/shm — where the loader stages and unpacks the Rust core. FP: medium — some installers/CI use temp dirs; correlate to Q1/Q2 lineage on the same host.

// HUNT: ELF execution from a world-writable dir (RustDuck loader/core stage)
// MITRE: T1564, T1059.004 | CONF: high  FP: medium  COST: low | REQUIRES: ProcessRollup2 (Linux)
// TUNING: baseline installers/CI that legitimately execute from /tmp; correlate to Q1/Q2
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/^[\\/](tmp|var[\\/]tmp|dev[\\/]shm|run[\\/]shm)[\\/]/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData], limit=200)

Looks for: chmod granting execute (+x or a 7-mode) on a file under a world-writable dir — the classic drop-and-run step. FP: medium — build tooling does this; anchor on the temp path + correlate to Q2 download.

// HUNT: chmod +x on a temp-dir payload (RustDuck drop-and-run)
// MITRE: T1222.002 | CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2 (Linux)
// TUNING: build/install tooling also chmods in /tmp; require the temp path + correlate to Q2
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^chmod$/i
| CommandLine=/(\+x|[0-7]*7[0-7]*)\s.*(tmp|dev[\\/]shm)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: resolution of a *.duckdns.org name from a server. Accomplishes: RustDuck C2 lookup. FP: medium — duckdns is a legitimate free DDNS service; a server resolving it on an interval is the discriminator, not the TLD alone.

// HUNT: duckdns dynamic-DNS C2 lookup (RustDuck)
// MITRE: T1071.001, T1568.002 | CONF: medium  FP: medium  COST: low | REQUIRES: DnsRequest
// TUNING: duckdns is a legit DDNS TLD; scope to servers and look for interval beaconing
#event_simpleName=DnsRequest
| DomainName=/\.duckdns\.org$/i
| table([@timestamp, ComputerName, ContextBaseFileName, DomainName], limit=200)

Looks for: any managed host connecting to the busiest reported delivery node. Accomplishes: confirms contact with RustDuck infrastructure. FP: low, but XLab lists 20+ delivery IPs — a miss here is not "clean"; refresh the IP set from current intel.

// HUNT: connection to the busiest RustDuck delivery IP (one of 20+, perishable)
// MITRE: T1105 | CONF: medium  FP: low  COST: low | REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: 20+ delivery IPs reported; add the rest from current threat intel
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=["176.65.139.204"])
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)