Threat-Hunting

My firewall said Iran. The servers were in Amsterdam. Both statements were defensible. Neither meant what I first thought. What started as 49 blocked firewall events led from a handful of scanning IPs, through several autonomous systems, into RIPE registry data, and eventually to twelve LIR memberships sharing the same company registration number. Along the way, three heuristics I had been relying on broke: Dense address space did not mean hostile infrastructure. An ASN did not define an operator. A registry country field did not tell me where the packets came from. That ended up being more useful than the original finding. ...

In part one I built a KVM malware lab: PFSense routing everything through Mullvad, Remnux doing static triage and transparent TLS interception, a FLARE-VM Windows box for detonation, and Wazuh agents on every VM reporting to a manager on the home network. That post ended with a working pipeline. This one starts with a problem the pipeline creates: Wazuh captures everything, and “everything” is a lot. Process creations, file integrity events, registry changes, network connections — across every VM, continuously. Most of it is noise. Buried in it are the indicators that actually matter: the hash of a dropped payload, the IP a sample beaconed to, the domain a loader resolved. ...

Why Build Your Own Lab? When you start getting serious about malware analysis, your options are usually a cloud sandbox like Any.run or Cuckoo, or a locally spun-up VM with Windows Defender disabled. Both work for basic analysis, but neither gives you the level of control and visibility a dedicated lab provides. A proper lab lets you: See exactly what a sample does at the network level, including decrypted HTTPS traffic Correlate behavioral events across process, registry, file system, and network simultaneously Protect your real IP from appearing in malware C2 infrastructure logs Restore to a clean state in seconds and run the next sample Feed everything into a open-source SIEM for long-term pattern analysis This post walks through building exactly that, from bare metal to a fully operational lab with VPN routing, transparent TLS interception, and Wazuh monitoring across all VMs. ...

TL;DR On 11 June 2026, attackers hijacked more than 400 Arch User Repository (AUR) packages and rewrote their build scripts to pull a malicious npm package that executed a Rust credential stealer — analyst-named deps — during the build. Sonatype calls the campaign Atomic Arch. Independent researcher Whanos reverse-engineered the payload, and that analysis is the source for most of the indicators here. I run Arch with a Wazuh agent, so I built a hunt around the IOCs and ran it against my own machine. The host came back clean. The interesting part isn’t the verdict — it’s that two checks looked like findings and weren’t: a PID-listing diff that screamed “hidden process,” and a loopback listener on a random high port that had exactly the shape of the malware’s local proxy. Both were artifacts of how the checks work, not evidence. This post is the hunt, why each check is trustworthy or not, the two head-fakes, and how to wire durable detections into Wazuh so the next variant trips an alert on its own. ...