Kirim Rantai Bersih & CDR Steril
Mengirim surat dinas bersih berjenjang (Kodim 0606 → Korem 061 → PUSSIBERAD Pusat), mensterilkan dokumen lewat Content Disarm & Reconstruction (CDR), lalu mencatat 3 blok hash SHA-256 ke Ledger.
Pilih CVE di blok tersorot atas, lalu klik tombol hijau ini.
Mengirim surat dinas bersih berjenjang (Kodim 0606 → Korem 061 → PUSSIBERAD Pusat), mensterilkan dokumen lewat Content Disarm & Reconstruction (CDR), lalu mencatat 3 blok hash SHA-256 ke Ledger.
Menyimulasikan perubahan paksa pada baris Ledger di Korem 061 untuk membuktikan deteksi anti-tamper. Jika ledger masih 0 blok, sistem otomatis menjalankan Langkah 1 dulu sebelum menguji manipulasi.
eval( • Vaksin: SandiSeal_Vaccine_f3d6b5a8app.alerteval(WScript.ShellString.fromCharCode
eval(String.fromCharCode(97, 112, 112, 46, 97, 108, 101, 114, 116, 40, 39, 83, 73, 77, 85, 76, 65, 83, 73, 32, 69, 88, 80, 76, 79, 73, 84, 58, 32, 87, 83, 99, 114, 105, 112, 116, 46, 83, 104, 101, 108, 108, 32, 45, 62, 32, 104, 116, 116, 112, 58, 47, 47, 99, 50, 45, 97, 116, 116, 97, 99, 107, 101, 114, 46, 108, 111, 99, 97, 108, 47, 98, 101, 97, 99, 111, 110, 39, 41))app.alert('SIMULASI EXPLOIT: WScript.Shell -> http://c2-attacker.local/beacon')app.alert('SIMULASI EXPLOIT: WScript.Shell -> http://c2-attacker.local/beacon')
eval(rule SandiSeal_Vaccine_f3d6b5a8 {
meta:
author = "Kertopati AI Threat Analyst"
created = "2026-11-14T06:53:26.501921+00:00"
source_unit = "Hacker Uploader (CVE-2026-91814)"
file_format = "PDF"
severity = "CRITICAL"
mitre_attack = "T1027 Obfuscated Files or Information, T1553.002 Code Signing, T1059.007 JavaScript, T1204.002 Malicious File"
sample_sha256 = "f3d6b5a8c97fcf19576a7cc397731f82bbfd9505a4e6841c79b887e6b0fe3ea1"
strings:
$ioc = "eval(" ascii nocase
$decoded_cmd = "app.alert('SIMULASI EXPLOIT: WScript.Shell -> http://c2-attacker.local/beacon')" ascii wide nocase
condition:
uint32(0) == 0x46445025 and ($ioc or $decoded_cmd)
}
title: Kertopati Auto-Sigma - SandiSeal_Vaccine_f3d6b5a8
id: 5526745a-4add-5fcb-a7b8-397438cbff14
status: experimental
description: Aturan SIEM/Firewall otomatis dari Auto-Sandbox Kertopati untuk sampel sim_cve_2026_91814_shadow.pdf
author: Kertopati AI Threat Analyst
date: 2026/11/14
tags:
- attack.t1027
- attack.t1553.002
- attack.t1059.007
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: 'eval('
DecodedPayload|contains: 'app.alert(SIMULASI EXPLOIT: WScript.Shell -> http: c2-attacker.local beacon)'
condition: selection
falsepositives:
- Tidak ada pada korpus baseline bersih Kertopati
level: critical