Skip to content

APT 37 and The No Good Rustonotto #3686

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 8 commits into from
Oct 13, 2025
Merged

APT 37 and The No Good Rustonotto #3686

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
e4979b4
APT 37 and The No Good Rustonotto
MHaggis Sep 18, 2025
10f15a5
Create windows_expand_cabinet_file_extraction.yml
MHaggis Sep 19, 2025
2ba936d
Apply suggestion from @nasbench
MHaggis Sep 22, 2025
9b2977e
Update detections/endpoint/windows_expand_cabinet_file_extraction.yml
patel-bhavin Oct 13, 2025
789f3d8
Update detections/endpoint/windows_expand_cabinet_file_extraction.yml
patel-bhavin Oct 13, 2025
29a1dde
Update detections/endpoint/windows_expand_cabinet_file_extraction.yml
patel-bhavin Oct 13, 2025
cb07b5c
Merge branch 'develop' into APT37
patel-bhavin Oct 13, 2025
36e2017
updating conflicts
patel-bhavin Oct 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Merge branch 'develop' into APT37
  • Loading branch information
@patel-bhavin
patel-bhavin authored Oct 13, 2025
commit cb07b5cc9e4b12771eb4ae589138194f0c29491b
1 change: 1 addition & 0 deletions detections/endpoint/bitsadmin_download_file.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@ tags:
- Gozi Malware
- Scattered Spider
- APT37 Rustonotto and FadeStealer
- GhostRedirector IIS Module and Rungan Backdoor
asset_type: Endpoint
mitre_attack_id:
- T1197
Expand Down
4 changes: 3 additions & 1 deletion detections/endpoint/executables_or_script_creation_in_temp_path.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Executables Or Script Creation In Temp Path
id: e0422b71-2c05-4f32-8754-01fb415f49c9
version: 16
date: '2025-09-18'
date: '2025-09-30'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -107,6 +107,8 @@ tags:
- IcedID
- Interlock Rat
- APT37 Rustonotto and FadeStealer
- PromptLock
- Lokibot
asset_type: Endpoint
mitre_attack_id:
- T1036
Expand Down
3 changes: 2 additions & 1 deletion detections/endpoint/lolbas_with_network_traffic.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: LOLBAS With Network Traffic
id: 2820f032-19eb-497e-8642-25b04a880359
version: 12
date: '2025-09-18'
date: '2025-09-16'
author: Steven Dick
status: production
type: TTP
Expand Down Expand Up @@ -75,6 +75,7 @@ tags:
- Malicious Inno Setup Loader
- Water Gamayun
- APT37 Rustonotto and FadeStealer
- GhostRedirector IIS Module and Rungan Backdoor
asset_type: Endpoint
mitre_attack_id:
- T1105
Expand Down
1 change: 1 addition & 0 deletions detections/endpoint/powershell_4104_hunting.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,7 @@ tags:
- Interlock Ransomware
- 0bj3ctivity Stealer
- APT37 Rustonotto and FadeStealer
- GhostRedirector IIS Module and Rungan Backdoor
asset_type: Endpoint
mitre_attack_id:
- T1059.001
Expand Down
1 change: 1 addition & 0 deletions detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@ tags:
- XWorm
- 0bj3ctivity Stealer
- APT37 Rustonotto and FadeStealer
- GhostRedirector IIS Module and Rungan Backdoor
mitre_attack_id:
- T1027
- T1059.001
Expand Down
3 changes: 2 additions & 1 deletion detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Scheduled Task Deleted Or Created via CMD
id: d5af132c-7c17-439c-9d31-13d55340f36c
version: 21
date: '2025-09-18'
date: '2025-09-30'
author: Bhavin Patel, Splunk
status: production
type: TTP
Expand Down Expand Up @@ -106,6 +106,7 @@ tags:
- Scattered Spider
- 0bj3ctivity Stealer
- APT37 Rustonotto and FadeStealer
- Lokibot
asset_type: Endpoint
mitre_attack_id:
- T1053.005
Expand Down
3 changes: 2 additions & 1 deletion detections/endpoint/suspicious_curl_network_connection.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Suspicious Curl Network Connection
id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f
version: 7
date: '2025-09-18'
date: '2025-09-16'
author: Michael Haag, Splunk
status: experimental
type: TTP
Expand Down Expand Up @@ -54,6 +54,7 @@ tags:
- Ingress Tool Transfer
- Linux Living Off The Land
- APT37 Rustonotto and FadeStealer
- GhostRedirector IIS Module and Rungan Backdoor
asset_type: Endpoint
mitre_attack_id:
- T1105
Expand Down
3 changes: 2 additions & 1 deletion detections/endpoint/suspicious_process_executed_from_container_file.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Suspicious Process Executed From Container File
id: d8120352-3b62-411c-8cb6-7b47584dd5e8
version: 8
date: '2025-09-18'
date: '2025-09-16'
author: Steven Dick
status: production
type: TTP
Expand Down Expand Up @@ -75,6 +75,7 @@ rba:
tags:
analytic_story:
- APT37 Rustonotto and FadeStealer
- GhostRedirector IIS Module and Rungan Backdoor
- Unusual Processes
- Amadey
- Remcos
Expand Down
3 changes: 2 additions & 1 deletion detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Suspicious Scheduled Task from Public Directory
id: 7feb7972-7ac3-11eb-bac8-acde48001122
version: 16
date: '2025-09-18'
date: '2025-09-30'
author: Michael Haag, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -89,6 +89,7 @@ tags:
- China-Nexus Threat Activity
- Scattered Spider
- APT37 Rustonotto and FadeStealer
- Lokibot
asset_type: Endpoint
mitre_attack_id:
- T1053.005
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/windows_archived_collected_data_in_temp_folder.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Windows Archived Collected Data In TEMP Folder
id: cb56a1ea-e0b1-46d5-913f-e024cba40cbe
version: 6
date: '2025-09-18'
date: '2025-10-06'
author: Teoderick Contreras, Splunk
status: production
type: Anomaly
Expand Down
3 changes: 2 additions & 1 deletion detections/endpoint/windows_curl_download_to_suspicious_path.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Windows Curl Download to Suspicious Path
id: c32f091e-30db-11ec-8738-acde48001122
version: 16
date: '2025-09-18'
date: '2025-10-01'
author: Michael Haag, Nasreddine Bencherchali, Splunk
status: production
type: TTP
Expand Down Expand Up @@ -94,6 +94,7 @@ rba:
tags:
analytic_story:
- APT37 Rustonotto and FadeStealer
- GhostRedirector IIS Module and Rungan Backdoor
- Black Basta Ransomware
- China-Nexus Threat Activity
- Forest Blizzard
Expand Down
1 change: 1 addition & 0 deletions detections/endpoint/windows_file_download_via_powershell.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,6 +91,7 @@ rba:
tags:
analytic_story:
- APT37 Rustonotto and FadeStealer
- GhostRedirector IIS Module and Rungan Backdoor
- Winter Vivern
- Phemedrone Stealer
- Malicious PowerShell
Expand Down
3 changes: 2 additions & 1 deletion detections/endpoint/windows_http_network_communication_from_msiexec.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Windows HTTP Network Communication From MSIExec
id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99
version: 7
date: '2025-09-18'
date: '2025-09-16'
author: Michael Haag, Splunk
status: production
type: Anomaly
Expand Down Expand Up @@ -82,6 +82,7 @@ rba:
tags:
analytic_story:
- APT37 Rustonotto and FadeStealer
- GhostRedirector IIS Module and Rungan Backdoor
- Windows System Binary Proxy Execution MSIExec
- Water Gamayun
- Cisco Network Visibility Module Analytics
Expand Down
3 changes: 2 additions & 1 deletion detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: Windows Obfuscated Files or Information via RAR SFX
id: 4ab6862b-ce88-4223-96c0-f6da2cffb898
version: 5
date: '2025-09-18'
date: '2025-09-16'
author: Teoderick Contreras, Splunk
data_source:
- Sysmon EventID 11
Expand Down Expand Up @@ -54,6 +54,7 @@ tags:
analytic_story:
- Crypto Stealer
- APT37 Rustonotto and FadeStealer
- GhostRedirector IIS Module and Rungan Backdoor
asset_type: Endpoint
mitre_attack_id:
- T1027.013
Expand Down
1 change: 1 addition & 0 deletions detections/endpoint/windows_process_execution_from_programdata.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ tags:
- Salt Typhoon
- China-Nexus Threat Activity
- APT37 Rustonotto and FadeStealer
- GhostRedirector IIS Module and Rungan Backdoor
asset_type: Endpoint
mitre_attack_id:
- T1036.005
Expand Down
2 changes: 1 addition & 1 deletion detections/endpoint/winevent_scheduled_task_created_within_public_path.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
name: WinEvent Scheduled Task Created Within Public Path
id: 5d9c6eee-988c-11eb-8253-acde48001122
version: 19
date: '2025-09-18'
date: 2025-10-01
author: Michael Haag, Splunk
status: production
type: TTP
Expand Down
Loading
You are viewing a condensed version of this merge commit. You can view the full changes here.