Bluekit Phishing Kit: Automated Domains & AI Lures — Detection & Defense

---
title: Bluekit - Suspicious Registrar API Interaction
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects potential Bluekit or similar toolkit usage via process interaction with domain registrar APIs (GoDaddy, Namecheap, etc.) from user endpoints.
references:
  - https://www.securityweek.com/new-bluekit-phishing-kit-features-ai-assistant/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.resource-development
  - attack.t1583.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationHostname|contains:
      - 'api.godaddy.com'
      - 'api.namecheap.com'
      - 'api.cloudflare.com'
  filter_legit_admin:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
  condition: selection and not filter_legit_admin
falsepositives:
  - Legitimate IT administrators using CLI tools for domain management
level: high
---
title: Phishing Kit - Suspicious File Creation in Web Directories
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects the creation of files commonly associated with phishing kits (e.g., login.php, mail.php) in web root directories, indicative of a compromised web server.
references:
  - https://www.securityweek.com/new-bluekit-phishing-kit-features-ai-assistant/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: file_create
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\inetpub\wwwroot'
      - '\htdocs'
  selection_names:
    TargetFilename|contains:
      - 'login.php'
      - 'signin.php'
      - 'verify.php'
      - 'mail.php'
      - 'process.php'
  condition: all of selection_*
falsepositives:
  - Legitimate CMS installation or update
level: medium

// Hunt for users accessing potentially newly registered domains (NRDs)
// Note: Enrichment is required to determine 'IsNewlyRegistered'. 
// This query identifies high-risk patterns: User clicks on links with suspicious TLDs or entropy.
let HighRiskTLDs = pack_array(".xyz", ".top", ".zip", ".mov", ".tk", ".gq");
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemoteUrl has_any (HighRiskTLDs)
| where ActionType in ("ConnectionSuccess", "UrlBlocked")
| summarize Count = count(), DistinctURLs = dcount(RemoteUrl) by DeviceName, InitiatingProcessAccountName
| where Count > 5 // Tunable threshold for bulk access
| extend RiskScore = Count * DistinctURLs
| order by RiskScore desc

// Hunt for phishing kit artifacts on Linux web servers
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs="/var/www/html/**/*.php")
WHERE 
  // Common phishing kit filenames
   FullName =~ "login" 
   OR FullName =~ "signin" 
   OR FullName =~ "verify" 
   OR FullName =~ "process"
   // Check for obfuscated base64 content often found in single-file kits
   OR Mtime > now() - 7d // Modified recently
LIMIT 100

# Remediation Script: Scan IIS Web Directories for Common Phishing Kit Artifacts
# Run with elevated privileges on web servers.

$WebRoots = @("C:\inetpub\wwwroot", "D:\websites")
$SuspiciousFiles = @("login.php", "signin.php", "verify.php", "process.php", "mail.php")
$Findings = @()

foreach ($Root in $WebRoots) {
    if (Test-Path $Root) {
        Write-Host "Scanning $Root..."
        foreach ($Pattern in $SuspiciousFiles) {
            $Files = Get-ChildItem -Path $Root -Recurse -Filter $Pattern -ErrorAction SilentlyContinue
            foreach ($File in $Files) {
                # Basic content check for base64 encoded payloads or eval()
                $Content = Get-Content $File.FullName -Raw -ErrorAction SilentlyContinue
                if ($Content -match "eval\(base64" -or $Content -match "shell_exec") {
                    $Props = [ordered]@{
                        Path = $File.FullName
                        Created = $File.CreationTime
                        SuspiciousContent = $true
                    }
                    $Findings += New-Object -TypeName PSObject -Property $Props
                    
                    # Quarantine action (commented out for safety - review first)
                    # Remove-Item $File.FullName -Force
                }
            }
        }
    }
}

if ($Findings.Count -gt 0) {
    $Findings | Format-Table -AutoSize
    Write-Host "[ALERT] Potential phishing kit artifacts found. Review and remove manually."
} else {
    Write-Host "[OK] No obvious phishing kit artifacts found."
}