---
title: Threat Hunting | ctxsec
url: https://ctxsec.com/hunting
---

# Threat Hunting

Hunt ideas and query sketches (KQL / Sigma-style) tied to current threats, with sources.

hunt idea

2026-10-13

### Hunt: SEO fake-PuTTY MSI → Node BYOI loader with EtherHiding C2

Unit 42 (Oct 12 TTI): SEO-poisoned "PuTTY" downloads serve Putty-x86_64.msi that drops a signed PuTTY 0.85 decoy plus a Node.js bring-your-own-interpreter loader. C2 URL is resolved via Ethereum eth_call (EtherHiding) and polled every 500 ms as fake static assets; operators push recon, cookie theft, and near-live screen streaming.// KQL sketch — AppData node + msiexec→curl Node zip DeviceProcessEvents | where FileName =~ "node.exe" and FolderPath has @"AppData\Local" | project Timestamp, DeviceName, FolderPath, ProcessCommandLine DeviceProcessEvents | where InitiatingProcessFileName =~ "msiexec.exe" | where FileName in~ ("curl.exe","cmd.exe") and ProcessCommandLine has "nodejs.org"Also watch eth_call from non-browser processes to public Ethereum RPCs. Sketch only; validate IOCs from Unit 42 before alerting.

Sources: [Unit 42 timely threat intel](https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-12-MSI-impersonating-PuTTY-delivers-malware.txt) · [@Unit42_Intel](https://x.com/Unit42_Intel/status/2110107318444499172)

hunt idea

2026-10-13

### Hunt: AhsayCBS / REDCap post-exploitation (webshell → miner)

Both campaigns end in web-server-spawned shells and miners. Look for the web service process spawning cmd/powershell/sh, new script files in web roots, and outbound connections to mining pools.// KQL (Defender) sketch DeviceProcessEvents | where InitiatingProcessFileName in~ ("java.exe","w3wp.exe","httpd","php-fpm") | where FileName in~ ("cmd.exe","powershell.exe","sh","bash") | project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLineTune the parent list to your stack. Sketch only; validate before alerting.

Sources: [Huntress](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) · [Unit 42 (via X)](https://x.com/Unit42_Intel/status/2109811397617992120)

hunt idea

2026-10-13

### Hunt: SonicWall SMA1000 SSRF abuse

Review SMA1000 access logs for unauthenticated requests to unusual Work Place paths, and investigate unexpected connections from the appliance to internal services. Rotate credentials for anything reachable through the appliance's trust context.

Sources: [SonicWall PSIRT](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017)