AgentTesla FTP Exfiltration + Storm-2561 Fake WatchGuard VPN Credential Phishing: OTX Pulse Analysis — Enterprise Detection Pack

---
title: AgentTesla FTP Exfiltration from Suspicious Process Path
id: 7a3f1c2e-9b4d-4e1a-8c5f-2d6e9a1b3f47
status: experimental
description: Detects outbound FTP (port 21) connections from processes executing in user-writable directories, consistent with AgentTesla infostealer FTP exfiltration observed in OTX pulse (anmarinee.it.com).
author: Security Arsenal
date: 2026/10/14
references:
    - https://asec.ahnlab.com/en/95840/
logsource:
    category: network_connection
    product: windows
detection:
    selection_port:
        DestinationPort: 21
    selection_path:
        Image|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Downloads\'
            - '\Users\Public\'
    filter_legit:
        Image|endswith:
            - '\ftp.exe'
            - '\FileZilla.exe'
            - '\WinSCP.exe'
    condition: selection_port and selection_path and not filter_legit
falsepositives:
    - Legitimate portable FTP clients run from user directories
level: high
tags:
    - attack.exfiltration
    - attack.t1048.003
    - attack.t1567
---
title: Executable Launched from Email Client or Archive Utility (Phishing Dropper)
id: 2b8e4d1f-6c3a-4f2b-9d7e-5a1c8e3b6d29
status: experimental
description: Detects executables spawned by email clients or archive utilities from temp/download locations, matching the AgentTesla business-proposal phishing delivery chain (ZIP attachment containing disguised EXE).
author: Security Arsenal
date: 2026/10/14
references:
    - https://asec.ahnlab.com/en/95840/
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\outlook.exe'
            - '\thunderbird.exe'
            - '\winrar.exe'
            - '\7zFM.exe'
            - '\explorer.exe'
    selection_child:
        Image|contains:
            - '\Temp\'
            - '\Downloads\'
            - '\AppData\Local\'
        Image|endswith: '.exe'
    filter_known:
        Image|contains:
            - '\AppData\Local\Microsoft\'
            - '\AppData\Local\Google\'
            - '\AppData\Local\Mozilla\'
    condition: selection_parent and selection_child and not filter_known
falsepositives:
    - Software updaters launched from user directories
    - Legitimate installer execution from Downloads
level: medium
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
---
title: DNS Query to WatchGuard Impersonation or AgentTesla C2 Infrastructure
id: 4c9d2e6a-1f7b-4a3c-8e2d-7b5f9c1a4e38
status: experimental
description: Detects DNS resolution of known fake WatchGuard VPN phishing domains (Storm-2561) and the AgentTesla FTP exfiltration hostname from OTX pulses dated 2026-10-14.
author: Security Arsenal
date: 2026/10/14
references:
    - https://www.huntress.com/blog/fake-watchguard-vpn-credential-phishing
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'watchguard-vpn.net'
            - 'watchguard-vpn.com'
            - 'watchguard-ssl.online'
            - 'anmarinee.it.com'
    condition: selection
falsepositives:
    - None expected; these are confirmed malicious impersonation/C2 domains
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.credential_access
    - attack.t1656

let MaliciousDomains = dynamic(["watchguard-vpn.net", "watchguard-vpn.com", "watchguard-ssl.online", "anmarinee.it.com"]);
let AgentTeslaHashes = dynamic(["6e89b13fea49ba2b98eb22fe59e16904e3225304c0a56546bb0c08b6959a8790", "9d5ca4e40dedfcdc58612e741433e571e82151ae9cade617250727b5ad3f7a49"]);
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (MaliciousDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType;
let DnsHits =
    DeviceEvents
    | where TimeGenerated > ago(14d)
    | where ActionType == "DnsQueryResponse"
    | extend AdditionalFields = parse_json(AdditionalFields)
    | where tostring(AdditionalFields.DnsQueryString) has_any (MaliciousDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, DnsQuery = tostring(AdditionalFields.DnsQueryString);
let HashHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where SHA256 has_any (AgentTeslaHashes) or InitiatingProcessSHA256 has_any (AgentTeslaHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, AccountName;
union NetworkHits, DnsHits, HashHits
| sort by TimeGenerated desc

# Security Arsenal - IOC Hunt: AgentTesla + Storm-2561 Fake WatchGuard Campaign
# Run elevated on endpoints or via remote execution (WinRM/Intune)

$MaliciousHosts = @("watchguard-vpn.net","watchguard-vpn.com","watchguard-ssl.online","anmarinee.it.com")
$MaliciousHashes = @("6e89b13fea49ba2b98eb22fe59e16904e3225304c0a56546bb0c08b6959a8790","9d5ca4e40dedfcdc58612e741433e571e82151ae9cade617250727b5ad3f7a49")

Write-Host "[1] Checking DNS client cache for malicious domains..." -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $n = $_.Name; $MaliciousHosts | Where-Object { $n -like "*$_*" } } | Format-Table Name, Entry, Data -AutoSize

Write-Host "[2] Checking active TCP/UDP connections (incl. FTP port 21 from user paths)..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $_.RemotePort -eq 21 } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{ RemoteIP = $_.RemoteAddress; Port = $_.RemotePort; Process = $proc.ProcessName; Path = $proc.Path }
} | Format-Table -AutoSize

Write-Host "[3] Hunting AgentTesla payload hashes in user-writable paths..." -ForegroundColor Cyan
$SearchPaths = @("$env:USERPROFILE\Downloads","$env:TEMP","$env:PUBLIC","$env:APPDATA")
foreach ($path in $SearchPaths) {
    Get-ChildItem -Path $path -Recurse -Include *.exe -ErrorAction SilentlyContinue | ForEach-Object {
        $hash = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($MaliciousHashes -contains $hash.ToLower()) {
            Write-Host "  [!] MALICIOUS FILE FOUND: $($_.FullName) - $hash" -ForegroundColor Red
        }
    }
}

Write-Host "[4] Checking persistence locations (Run keys / suspicious scheduled tasks)..." -ForegroundColor Cyan
$RunKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($key in $RunKeys) {
    Get-ItemProperty -Path $key -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | ForEach-Object {
        $val = (Get-ItemProperty -Path $key -Name $_.Name -ErrorAction SilentlyContinue).($_.Name)
        if ($val -match "Temp|AppData|Public") { Write-Host "  [?] Suspicious Run key: $($_.Name) = $val" -ForegroundColor Yellow }
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match "Temp|AppData|Public" } | Select-Object TaskName, TaskPath | Format-Table -AutoSize

Write-Host "[5] Checking for WatchGuard installs from untrusted sources (Storm-2561 lure)..." -ForegroundColor Cyan
Get-ChildItem "$env:USERPROFILE\Downloads" -Filter "*watchguard*" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    [PSCustomObject]@{ File = $_.FullName; Signed = $sig.Status; Signer = $sig.SignerCertificate.Subject }
} | Format-Table -AutoSize

Write-Host "[6] Reviewing recent outbound connections to impersonation IPs via DNS resolution..." -ForegroundColor Cyan
foreach ($h in $MaliciousHosts) {
    try { $ips = (Resolve-DnsName $h -ErrorAction Stop).IPAddress; Write-Host "  [RESOLVED] $h -> $($ips -join ', ')  (ACTIVE INFRASTRUCTURE - alert!)" -ForegroundColor Red } catch {}
}
Write-Host "Hunt complete. Escalate any DNS cache hits, port-21 connections from user paths, or hash matches to IR immediately." -ForegroundColor Green