UAT-10147 — Agentic-AI-Augmented Post-Compromise: SPECTRE, Specter Rootkit & BadIIS

Looks for: EfsPotato/GodPotato/JuicyPotato/RustPotato, or the renamed prcc1.rar/prcc2.rar, executing — UAT-10147's SeImpersonatePrivilege-abuse privilege-escalation step.

// HUNT: "Potato"-family privilege-escalation tool execution (EfsPotato/GodPotato/JuicyPotato/RustPotato or renamed prcc1/prcc2)
// MITRE: T1068, T1134
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legitimate penetration-test/red-team engagements running these same public GitHub tools by their stock name
#event_simpleName = ProcessRollup2
| FileName = /^(efspotato|godpotato|juicypotato|rustpotato)(\.exe)?$|^prcc[12]\.(exe|rar)$/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName], limit=200)
| sort(@timestamp, order=desc)

Looks for: certutil.exe referencing the two known Windows-chain staging domains/IP in its command line.

// HUNT: certutil.exe download referencing published UAT-10147 staging infrastructure
// MITRE: T1105
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: none expected for these specific domains/IP; to hunt for NEW infrastructure broaden this to a generic certutil -urlcache -split -f pattern (higher FP, admin tooling also uses it)
#event_simpleName = ProcessRollup2
| FileName = /^certutil(\.exe)?$/i
| CommandLine = /(adminapi\.tippusoni\.in|kl21177\.com|139\.180\.197\.150)/i
| table([@timestamp, aid, ComputerName, CommandLine, UserName, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: a PowerShell Add-MpPreference -ExclusionPath or reg add to the Defender exclusions key, targeting inetsrv. FP: legitimate IIS extension installers occasionally add scoped Defender exclusions.

// HUNT: Windows Defender exclusion added for System32\inetsrv / SysWOW64\inetsrv (BadIIS defense-evasion staging)
// MITRE: T1562.001
// CONF: high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legitimate IIS module/extension installers occasionally add scoped Defender exclusions during setup
// TUNING: cross-check the source ComputerName/UserName against your change-management or patch-ticket system before treating a hit as malicious
#event_simpleName = ProcessRollup2
| FileName = /^(powershell|reg)(\.exe)?$/i
| CommandLine = /(ExclusionPath.*inetsrv|Exclusions.Paths.*inetsrv)/i
| table([@timestamp, aid, ComputerName, FileName, CommandLine, UserName, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: the exact deceptive scheduled-task name UAT-10147 uses to run QuasarRAT/Gh0stCringe/SPECTRE at every logon with the highest privileges.

// HUNT: Scheduled task registered under the deceptive name "Google Chrome Start"
// MITRE: T1053.005
// CONF: high
// FP: low
// COST: low
// REQUIRES: ScheduledTaskRegistered
// FALSE POSITIVES: none expected — this exact literal task name is not created by any legitimate Chrome installer or Windows component
#event_simpleName = ScheduledTaskRegistered
| TaskName = /^Google Chrome Start$/i
| table([@timestamp, aid, ComputerName, TaskName, TaskExecutable, UserName], limit=200)
| sort(@timestamp, order=desc)

Looks for: a process literally named svchosts.exe (plural) — the legitimate Windows filename is singular svchost.exe; this exact typosquat never ships natively.

// HUNT: Process named svchosts.exe (extra "s") — QuasarRAT payload masquerade
// MITRE: T1036.005, T1105
// CONF: high
// FP: low
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: none expected — no legitimate Windows component or common third-party software ships a binary named svchosts.exe
#event_simpleName = ProcessRollup2
| FileName = /^svchosts\.exe$/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, FileName, CommandLine, ImageFileName, UserName], limit=200)
| sort(@timestamp, order=desc)

Looks for: net/net1 adding a user and/or adding an account to Administrators or Remote Desktop Users — the user.bat persistence step. FP: legitimate IT provisioning also uses these commands.

// HUNT: Local account created and added to Administrators / Remote Desktop Users (user.bat persistence)
// MITRE: T1136.001, T1098
// CONF: high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legitimate IT onboarding/provisioning scripts also use net user and net localgroup commands
// TUNING: correlate with a preceding Q1/Q2/Q3 hit on the same aid within a short window before treating as malicious; exclude known provisioning service accounts
#event_simpleName = ProcessRollup2
| FileName = /^net1?(\.exe)?$/i
| CommandLine = /(localgroup.*(Administrators|Remote Desktop Users).*\/add|user\s+\S+\s+\S+\s+\/add)/i
| table([@timestamp, aid, ComputerName, CommandLine, UserName, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: reg.exe save against the SAM, SYSTEM, or SECURITY hives — SPECTRE's offline credential-theft step (equivalent to its internal RegSaveKeyA usage). FP: legitimate backup/AD-recovery tooling also runs this.

// HUNT: reg.exe save against SAM/SYSTEM/SECURITY hives (SPECTRE hashdump / offline NT-hash extraction staging)
// MITRE: T1003.002
// CONF: high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legitimate backup or AD-recovery/DR tooling also runs reg save against these hives on a schedule
// TUNING: allow-list known backup/DR service accounts and their scheduled maintenance windows; treat any hit on an internet-facing IIS/web-adjacent host as high priority regardless
#event_simpleName = ProcessRollup2
| FileName = /^reg(\.exe)?$/i
| CommandLine = /save.*HKLM.(SAM|SYSTEM|SECURITY)/i
| table([@timestamp, aid, ComputerName, CommandLine, UserName, ParentBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: a process other than chrome.exe/msedge.exe opening the browser's "Login Data" file — SPECTRE's chromedump function. FP: legitimate credential-migration/backup tools do the same.

// HUNT: Non-browser process opening Chrome/Edge "Login Data" credential store (SPECTRE chromedump)
// MITRE: T1555.003
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: FileOpenInfo — validate this event is enabled for your sensor policy; file-open telemetry is an optional/premium data source in some Falcon configurations
// FALSE POSITIVES: legitimate password-migration or endpoint-backup tooling also opens this file from a non-browser process; chrome.exe/msedge.exe opening their own store is expected and must be filtered at triage (CQL/LogScale regex has no negative-lookahead support, so the exclusion is not done in-query)
// TUNING: baseline your approved credential-migration/backup tools and exclude by ContextBaseFileName before promoting; correlate with a Q1/Q7 hit on the same aid; at triage, drop rows where ContextBaseFileName is chrome.exe or msedge.exe
#event_simpleName = FileOpenInfo
| TargetFileName = /\\(Google\\Chrome|Microsoft\\Edge)\\User Data\\.*\\Login Data$/i
| table([@timestamp, aid, ComputerName, TargetFileName, ContextBaseFileName, UserName], limit=200)
| sort(@timestamp, order=desc)

Looks for: cmdkey.exe /list — SPECTRE's LSASS-free Credential Manager enumeration. FP: helpdesk/IT troubleshooting commonly runs this exact command.

// HUNT: cmdkey.exe /list execution (SPECTRE vaultdump — Windows Credential Manager enumeration)
// MITRE: T1555.004
// CONF: medium
// FP: high
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: helpdesk/IT troubleshooting and some backup-credential tooling run this exact command routinely
// TUNING: this is too noisy to alert on alone — correlate with a Q1/Q7/Q10 hit on the same aid within a short window before triage
#event_simpleName = ProcessRollup2
| FileName = /^cmdkey(\.exe)?$/i
| CommandLine = /\/list/i
| table([@timestamp, aid, ComputerName, CommandLine, ParentBaseFileName, UserName], limit=200)
| sort(@timestamp, order=desc)

Looks for: the two named vulnerable kernel drivers SPECTRE uses for its EDR-killing BYOVD attack, written to disk.

// HUNT: RTCore64.sys or DBUtil_2_3.sys written to disk (SPECTRE BYOVD EDR-killer staging, CVE-2019-16098 / CVE-2021-21551)
// MITRE: T1068, T1562.001
// CONF: high
// FP: low
// COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten
// FALSE POSITIVES: none expected for a fresh write on an endpoint that does not run legitimate MSI Afterburner (RTCore64.sys) or Dell BIOS-update tooling (DBUtil_2_3.sys) — treat ANY hit on a server as a priority-1 EDR-blinding event
#event_simpleName = /PeFileWritten|NewExecutableWritten/
| TargetFileName = /\\(RTCore64|DBUtil_2_3)\.sys$/i
| table([@timestamp, aid, ComputerName, TargetFileName, SHA256HashData, ContextBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: w3wp.exe spawning a command/script interpreter or csc.exe — the first host-visible moment of Zimbra/AjaxPro/Nacos/Telerik ViewState exploitation or the CodeDomProvider-based web shell's dynamic compilation. FP: some legitimate ASP.NET apps shell out; first-request JIT compilation also spawns csc.exe.

// HUNT: IIS worker process (w3wp.exe) spawning a shell/script interpreter or the C# compiler
// MITRE: T1190, T1059, T1505.003
// CONF: high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: a small number of legitimate ASP.NET applications intentionally shell out; ASP.NET's own first-request dynamic compilation can spawn csc.exe
// TUNING: baseline known-legitimate w3wp.exe child processes per application pool for 7-14 days before promoting to a block-capable IOA; exclude AppPool identities tied to known build/CI-integrated web apps
#event_simpleName = ProcessRollup2
| ParentBaseFileName = /^w3wp\.exe$/i
| FileName = /^(cmd|powershell|pwsh|cscript|wscript|csc|mshta|rundll32)(\.exe)?$/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName], limit=200)
| sort(@timestamp, order=desc)

Looks for: a DLL matching the [10 digits].[7 digits].dll naming pattern — the distinctive artifact of reverse-shell payloads dropped via the Telerik UI ViewState exploitation chain.

// HUNT: Reverse-shell DLL matching the [10-digit].[7-digit].dll naming convention (CVE-2019-18935 / Telerik exploitation)
// MITRE: T1505.003, T1027
// CONF: high
// FP: low
// COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten
// FALSE POSITIVES: none expected — this exact 10-digit-dot-7-digit naming is not a standard .NET temp-file or ASP.NET compilation-cache convention
#event_simpleName = /PeFileWritten|NewExecutableWritten/
| TargetFileName = /.\d{10}\.\d{7}\.dll$/i
| table([@timestamp, aid, ComputerName, TargetFileName, SHA256HashData, ContextBaseFileName], limit=200)
| sort(@timestamp, order=desc)

Looks for: PowerShell's [IO.File]::WriteAllBytes writing an .ashx file — the AI-generated deploy_shell.py script's two-step web-shell drop technique. FP: legitimate deployment/config-management tooling occasionally writes handlers this way.

// HUNT: PowerShell [IO.File]::WriteAllBytes writing a .ashx file into an IIS webroot (AI-generated web-shell deploy script)
// MITRE: T1505.003, T1140
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legitimate deployment/config-management scripts occasionally write .ashx handlers using the same WriteAllBytes technique
// TUNING: correlate with a preceding w3wp.exe-parented hit (Q11) or a recent exploitation-window alert before treating as malicious; exclude known CI/CD deployment service accounts
#event_simpleName = ProcessRollup2
| FileName = /^powershell(\.exe)?$/i
| CommandLine = /WriteAllBytes.*\.ashx/i
| table([@timestamp, aid, ComputerName, CommandLine, ParentBaseFileName, UserName], limit=200)
| sort(@timestamp, order=desc)

Looks for: an explicit insmod/modprobe acpi_pad invocation — the legitimate acpi_pad module is normally auto-loaded by the kernel at boot, not manually invoked by name, so an explicit invocation is itself the anomaly.

// HUNT: Manual insmod/modprobe invocation naming acpi_pad (Specter Linux rootkit disguise)
// MITRE: T1014, T1547.006
// CONF: medium
// FP: low
// COST: low
// REQUIRES: ProcessRollup2 on Linux hosts
// FALSE POSITIVES: environments with custom ACPI/power-management tooling that manually reloads this module by name (rare)
#event_simpleName = ProcessRollup2
| FileName = /^(insmod|modprobe)$/i
| CommandLine = /acpi_pad/i
| table([@timestamp, aid, ComputerName, CommandLine, ParentBaseFileName, UserName], limit=200)
| sort(@timestamp, order=desc)

Looks for: systemctl enable/start for the fraudulent hardware-monitor.service unit that loads Specter before security tooling initializes (Before=sysinit.target).

// HUNT: systemd service enabled/started for the Specter rootkit's fraudulent "hardware-monitor.service" unit
// MITRE: T1543.002, T1036.005
// CONF: medium
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 on Linux hosts
// FALSE POSITIVES: a generically-named "hardware monitor" service could coincidentally exist in some environments' custom tooling
// TUNING: verify the underlying unit file's ExecStart binary path and the loaded kernel module against the legitimate acpi_pad.ko location under /lib/modules/ before treating a hit as malicious
#event_simpleName = ProcessRollup2
| FileName = /^systemctl$/i
| CommandLine = /(enable|start).*hardware-monitor/i
| table([@timestamp, aid, ComputerName, CommandLine, UserName], limit=200)
| sort(@timestamp, order=desc)

Looks for: a shell running as root whose parent is a web-server or JVM process — the post-privilege-escalation follow-on indicator covering the six Linux LPE CVEs (CVE-2022-0995, CVE-2021-3156, CVE-2015-5287, CVE-2015-3246, CVE-2010-3904, CVE-2022-0847). FP: some legitimate wrapper scripts shell out from these parents.

// HUNT: Root-context shell spawned from a web-server/JVM parent process (post-LPE follow-on)
// MITRE: T1190, T1068, T1059.004
// CONF: high
// FP: medium
// COST: low
// REQUIRES: ProcessRollup2 on Linux hosts
// FALSE POSITIVES: some legitimate application health-check/wrapper scripts shell out from these parents; root-context is the key discriminator since these services rarely run as root in a hardened deployment
// TUNING: exclude known service-management wrapper scripts by CommandLine pattern; expected to be rare if the web server process itself is not configured to run as root
#event_simpleName = ProcessRollup2
| ParentBaseFileName = /^(httpd|nginx|java|tomcat|catalina)$/i
| FileName = /^(sh|bash|dash)$/i
| UserName = /^root$/i
| table([@timestamp, aid, ComputerName, ParentBaseFileName, FileName, CommandLine, UserName], limit=200)
| sort(@timestamp, order=desc)

Looks for: outbound connections to any of the 5 published UAT-10147/SPECTRE C2 IPs across both Talos IOC releases.

// HUNT: Outbound connection to published UAT-10147/SPECTRE C2 infrastructure IP addresses
// MITRE: T1071.001, T1105
// CONF: high
// FP: low
// COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: none expected — re-verify each IP is still live/attacker-controlled before enabling a block action, as shared hosting providers can reassign IPs over time
#event_simpleName = NetworkConnectIP4
| in(RemoteAddressIP4, values=["139.180.197.150","18.140.163.186","27.124.2.46","27.124.2.48","27.124.2.52"])
| table([@timestamp, aid, ComputerName, RemoteAddressIP4, RemotePort, ContextBaseFileName, CommandLine], limit=max)
| sort(@timestamp, order=desc)

Looks for: DNS resolution of any of the 9 published high-confidence C2/staging domains across both Talos IOC releases. The two "generic-looking" domains (§2/§4) are deliberately excluded from this block-grade query; hunt them separately via §10.

// HUNT: DNS resolution of published UAT-10147/SPECTRE/BadIIS C2 domains
// MITRE: T1071.001
// CONF: high
// FP: low
// COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: none expected for these specific domains; re-verify liveness periodically
#event_simpleName = DnsRequest
| DomainName = /^(adminapi\.tippusoni\.in|kl21177\.com|js\.jyzyps\.com|vn\.mma888\.cc|thceshi\.healthsave\.net|vip8888vn\.xyz|b\.niupilao\.vip|vip\.niupilao\.vip|udvyiwvfs\.cyou)$/i
| table([@timestamp, aid, ComputerName, DomainName, ContextProcessId], limit=200)
| sort(@timestamp, order=desc)