Watcher-NetAI / skn - Detection Brief [Part 2/2]

Single-page SOC-facing summary. Full analysis in the main report .

Rule packs

Top IOCs to load into your stack today

Network

Historical Stage-2 IPs (rotation cadence ~1-3 months) for retrospective hunts over the past 7 months: 88[.]214[.]57[.]157, 5[.]249[.]160[.]243, 103[.]179[.]44[.]146, 194[.]5[.]97[.]15. Full details in the main report’s IOCs table .

Files (post-compromise)

Hashes

Hunts to triage first

1. Non-root systemd-user persistence + cron cascade (file_event)

file.path : "*/.config/systemd/user/watcher-netai.service"
   OR file.path : "*/.config/systemd/user/default.target.wants/watcher-netai.service"

Also pull current cron entries on hosts where you suspect compromise:

for u in $(cut -d: -f1 /etc/passwd); do
  crontab -u "$u" -l 2>/dev/null \
    | grep -F '/w.sh "astats" "netai" "kstats" "ssh 2 ranges"' \
    && echo "operator cron entry on user $u"
done

The exact filename is cluster-specific in our corpus and should be low-noise; validate against environments with custom user-systemd services. Triage: check creator process (should be bash or sh spawned from sshd), uid (should be ≥ 1000), and creation time (within last 24 h on a recent compromise). Note: filesystem * wildcards may be slow on Elastic indices without wildcard field type - anchor on the literal filename where possible.

2. Scanner process + launcher argv (process_creation)

Two AND-separated forms, more portable across SPL / Sigma backends than nested-quote escapes:

process.command_line : *astats* AND process.command_line : *netai*
   AND process.command_line : *kstats* AND process.command_line : "*ssh 2 ranges*"

process.executable : "*/astats"
   AND (process.command_line : *-watchdog* OR process.command_line : *-scan*)
   AND process.command_line : "*ssh 2 ranges*"

The four-token launcher arg list is operator-defined and is not expected on benign hosts. The scanner runs as a long-lived process tree (watchdog parent + scan worker child).

3. Stage-1 loader-delivery C2 (network_connection / proxy logs)

destination.ip : "64.89.161.144" AND destination.port : 28816
   OR url.original : /http:\/\/64\.89\.161\.144:28816\/[A-Za-z0-9_]{32}/

Plaintext HTTP on an unusual high port. The URL path is per-session random but the host:port pair is stable across the kit’s observed lifetime (URLhaus 3793559, plus operator-executed curl commands 60+ days later).

4. Stage-2 scanner-operational C2 (network_connection)

destination.ip : "194.5.97.46"
   OR destination.domain : ("connexionlost.net" OR "connexionlost.zip")
   OR (destination.port : 443
       AND url.path : ("/update/scanfiles/*" OR "/update/pass/*"
                       OR "/harvest/sshsv" OR "/harvest/users" OR "/harvest/sshlist"))

Infrastructure matches (IP or domain) are high-confidence on their own. URL-path-only matches are gated by destination.port : 443 to keep noise low.

FP-testing status

YARA tested green. Zero false positives on a benign Linux Go corpus (kubectl, gh, jq, yq, hugo, caddy, helm, minikube, kind, fzf). True-positive match on each of the 5 intended targets. Validate against your own corpus before broad EDR rollout.

Sigma - pending. Field-developed signatures awaiting community validation.

Investigative pivot

If you confirm a hit on any tier-1 IOC, the most useful pivots are:

1. Bash history of the compromised account - the seven-step recon sequence (uname -s -v -n -r -m → nproc → … → lspci VGA) plus the cat > w.sh and cat > watcher-netai.service writes will be there if the operator’s session has not yet wiped history. A useful disambiguator: a lspci | grep VGA | grep Radeon | wc -l | head -c 1 line - the AMD-aware variant - appears in roughly a third of the captured sessions. If history -c && history -w ran (the operator does this on cleanup), the recon will be lost - the recovered launcher and systemd unit on disk are enough on their own.
2. Outbound flow to 194[.]5[.]97[.]46:443 in NetFlow/Zeek - the scanner’s operational C2 traffic is the longer-lived network artefact and the easiest to fingerprint once persistence has landed.
3. /etc/shadow last-changed timestamp on the compromised account - if it changed during the SSH session and the legitimate user did not authenticate the change, the changePasswordSmart cascade has fired and the account is now operator-owned.

Controlled sharing

Verified CERTs, law-enforcement teams, hosting-provider abuse desks, and incident responders working a confirmed case may request extended C2 indicators, protocol notes, and the observed deployment timeline. Contact: research@ohiiho.com.

Full analysis, capability map, and threat-cluster context in the main report [Part 1/2] .