Argamal RAT, RemusStealer, and Operation GriefLure: OTX Pulse Analysis — Enterprise Detection Pack

title: Potential Argamal RAT COM Hijacking Persistence
id: 1a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
description: Detects modifications to InprocServer32 registry keys often associated with Argamal COM hijacking via Windows Color System Calibration Loader.
status: experimental
date: 2026/06/07
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/12345678 # Placeholder for Argamal Pulse
tags:
    - attack.persistence
    - attack.t1574.001
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'CLSID'
        TargetObject|contains: 'InprocServer32'
        Details|contains:
            - '.dll'
    filter_legit:
        Details|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate software installing custom handlers
level: high
---
title: Suspicious Connection to Fake Freeware/TDS Domains
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
description: Detects network connections to domains associated with the SessionGate/RemusStealer TDS ecosystem (e.g., guiformat.com impersonation).
status: experimental
date: 2026/06/07
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/87654321 # Placeholder for TDS Pulse
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|endswith:
            - 'guiformat.com'
            - 'freeddns.org'
            - 'maxdatahost1.cyou'
    condition: selection
falsepositives:
    - Legitimate access to these specific domains if owned by authorized entities (unlikely for listed IOCs)
level: critical
---
title: MacOS ClickFix Terminal Download Execution
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Detects macOS suspicious Terminal commands often used in ClickFix campaigns to download payloads from external domains.
status: experimental
date: 2026/06/07
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/11223344 # Placeholder for ClickFix Pulse
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/bin/bash'
        CommandLine|contains:
            - 'curl '
            - 'wget '
        CommandLine|contains:
            - ' | bash'
            - ' > /dev/null'
    filter_tech:
        ParentImage|endswith:
            - '/Terminal.app/Contents/MacOS/Terminal'
            - '/iTerm2'
    condition: selection and not filter_tech
falsepositives:
    - Admins running curl manually for updates (rare)
level: medium

// Hunt for connections to known TDS and Argamal infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in (
    "guiformat.com",
    "asper1.freeddns.org",
    "www.whatsappcenter.com",
    "jihiz.com",
    "kayeart.com",
    "bintail.com",
    "forestoaker.com"
) or RemoteIP in (
    "194.150.220.218",
    "217.156.122.75"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| extend IoC_Type = iff(RemoteUrl != "", "Domain", "IP")

<#
.SYNOPSIS
    Hunt for Argamal COM Hijacking persistence indicators.
.DESCRIPTION
    Checks for suspicious InprocServer32 modifications under CLSID keys.
#>

$SuspiciousPaths = @()
$CLSIDPaths = @("HKLM:\SOFTWARE\Classes\CLSID", "HKCU:\SOFTWARE\Classes\CLSID")

foreach ($Path in $CLSIDPaths) {
    if (Test-Path $Path) {
        $CLSIDs = Get-ChildItem -Path $Path -ErrorAction SilentlyContinue
        foreach ($CLSID in $CLSIDs) {
            $ServerPath = Join-Path -Path $CLSID.PSPath -ChildPath "InprocServer32"
            if (Test-Path $ServerPath) {
                $DefaultVal = Get-ItemProperty -Path $ServerPath -Name "(default)" -ErrorAction SilentlyContinue
                if ($DefaultVal -and $DefaultVal."(default)" -match ".dll") {
                    $DllPath = $DefaultVal."(default)"
                    # Check if not in system32 or syswow64
                    if ($DllPath -notmatch "^C:\\Windows\\(System32|SysWOW64)") {
                        $SuspiciousPaths += [PSCustomObject]@{
                            CLSID = $CLSID.PSChildName
                            Path = $DllPath
                            Risk = "High"
                        }
                    }
                }
            }
        }
    }
}

if ($SuspiciousPaths.Count -gt 0) {
    Write-Host "[!] Potential COM Hijacking detected:" -ForegroundColor Red
    $SuspiciousPaths | Format-Table -AutoSize
} else {
    Write-Host "[+] No suspicious CLSID InprocServer32 entries found." -ForegroundColor Green
}