Undead Inc. Review (PC)

My research was humming along, even if I had to sometimes hire some B-grade personnel. We mastered all legal and consumer-facing drugs, pumping them out of automated factories as quickly as our Wellspring pharmacies could sell them. Our doctors weren’t all brilliant but they certainly knew what an integrated business is and, when they got the diagnosis right, knew what to prescribe.

Sure, we’ve had a few incidents in the research lab, including one that resulted in one very zombie-looking researcher getting gunned down in the street by a police officer and one internal security guy. A  denial-of-service attack ensured that news was buried, and the media didn’t continuously air footage of the incident. Sure, the franchise payments keep going up, which feels abusive, but we’re a growing company that needs resources.

But I misjudged the capabilities of my director and his bodyguards. All illegal research is underground, and the gangs really don’t like mostly-legitimat...

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

find /var/www -type f -name "*.php" -mmin -120

ss -tunp | grep -E ":(4444|1337|8080|9001)"

apt update && apt --only-upgrade install <pkg>

title: Detect Exploitation - Undead Inc. Review (PC)
id: a120f6c1-9013-4cfc-adea-f3509f995223
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "Undead Inc. Review (PC)" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Undead Inc Review PC")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Undead Inc Review PC*"

CommonSecurityLog
| where Message has "Undead Inc Review PC"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc