Albabat WMI Recon and GitHub/Supabase Connection

Daniel Jeremiah@daniyyell

•updated Mar 30, 2026•9•0•78

This rule detects a suspicious sequence of events indicative of the Albabat malware. It looks for instances where a device performs WMI-based reconnaissance (querying CPU, csproduct, OS, or NIC information) followed by or preceded by network communication with either a GitHub repository containing 'billdev' or a Supabase instance. The time window for these events is set to 30 minutes, suggesting a contextual link between the reconnaissance and subsequent network activity.