---
title: Midnight Blizzard CaptiveCrunch ClickFix Execution Chain
id: 8f2a1c3e-7b1d-4e5f-9a6c-captivecrunch01
status: experimental
description: Detects ClickFix-style user-initiated execution of PowerShell/mshta spawning from browser or Run dialog context, consistent with CornFlake/ChocoShell delivery via compromised captive portals.
author: Security Arsenal Threat Intel
date: 2026/08/13
references:
    - https://www.zscaler.com/blogs/security-research/captivecrunch-midnight-blizzard-weaponizes-hotel-wi-fi-captive-portals
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    selection_cmd:
        CommandLine|contains:
            - 'Invoke-Expression'
            - 'IEX'
            - 'DownloadString'
            - 'FromBase64String'
            - 'ms365-'
            - 'm365-owa'
            - '38.146.28.75'
    condition: selection_parent and selection_child and selection_cmd
falsepositives:
    - Rare legitimate admin scripts launched manually from Run dialog
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204
    - attack.t1105
---
title: Microsoft 365 Lookalike Domain Network Connection
id: 9c3b2d4f-8c2e-5f6a-0b7d-captivecrunch02
status: experimental
description: Detects outbound connections to Midnight Blizzard CaptiveCrunch phishing and C2 infrastructure, including M365/OWA lookalike domains and known C2 IP 38.146.28.75.
author: Security Arsenal Threat Intel
date: 2026/08/13
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'm365-owa.com'
            - 'ms365-device.com'
            - 'ms365-live.com'
            - 'owa-ms365.com'
    selection_ip:
        DestinationIp:
            - '38.146.28.75'
    filter_legit:
        Initiated: 'false'
    condition: 1 of selection_* and not filter_legit
falsepositives:
    - Threat research and sandbox detonation
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1566
---
title: UNC6671 Okta and Passkey Lookalike Domain Access
id: 0d4c3e5a-9d3f-6a7b-1c8e-unc6671vik03
status: experimental
description: Detects DNS or web proxy requests to UNC6671 vishing/AiTM spoofed Okta and passkey enrollment portals used in helpdesk impersonation campaigns.
author: Security Arsenal Threat Intel
date: 2026/08/13
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/unc6671-targets-financial-services-and-enterprise-cloud-environments
logsource:
    category: dns
    product: windows
detection:
    selection:
        QueryName|contains:
            - 'oktaenroll.com'
            - 'idokta.com'
            - 'myoktasso.com'
            - 'mypasskeysso.com'
            - 'setupssopasskey.com'
            - 'passkeyms.com'
            - 'keyokta.com'
            - 'portalpasskey.com'
    condition: selection
falsepositives:
    - Security researcher lookups
level: critical
tags:
    - attack.credential_access
    - attack.t1566.004
    - attack.t1557
    - attack.t1078

// Security Arsenal — CaptiveCrunch + UNC6671 Unified Hunt (Microsoft Sentinel)
// Hunt 1: Network connections to known phishing/C2 infrastructure
let PhishDomains = dynamic(["m365-owa.com","ms365-device.com","ms365-live.com","owa-ms365.com",
    "oktaenroll.com","idokta.com","myoktasso.com","mypaskeysso.com","setupssopasskey.com",
    "passkeyms.com","keyokta.com","portalpasskey.com"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (PhishDomains) or RemoteIP == "38.146.28.75"
| project NetworkTime=TimeGenerated, DeviceName, InitiatingProcessFileName,
    InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType;
// Hunt 2: ClickFix-style process chains (browser/explorer spawning script interpreters)
let ClickFixProcs = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("explorer.exe","chrome.exe","msedge.exe","firefox.exe")
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","wscript.exe","cscript.exe")
| where ProcessCommandLine has_any ("IEX","Invoke-Expression","DownloadString","FromBase64String")
| project ProcTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine,
    InitiatingProcessFileName, SHA256, AccountName;
// Hunt 3: Known CornFlake/ChocoShell payload hashes
let HashHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where SHA256 in ("918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593",
    "be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c")
| project HashTime=TimeGenerated, DeviceName, FileName, FolderPath, SHA256;
union NetworkHits, ClickFixProcs, HashHits
| sort by DeviceName

# Security Arsenal — CaptiveCrunch / CornFlake / ChocoShell Host IOC Hunt
# Run via EDR remote shell or as administrative script across endpoints

$Report = @()

# 1. Known payload hashes
$Hashes = @(
    '918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593',
    'be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c'
)

# 2. Suspicious persistence — Run keys with script interpreters or odd paths
$RunKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-ItemProperty $Key | ForEach-Object {
            $_.PSObject.Properties | Where-Object {
                $_.Value -match 'powershell|mshta|wscript|cscript|AppData|Temp' -and
                $_.Name -notmatch '^PS'
            } | ForEach-Object {
                $Report += [PSCustomObject]@{Type='RunKey'; Path=$Key; Name=$_.Name; Value=$_.Value}
            }
        }
    }
}

# 3. Scheduled tasks executing script interpreters (ClickFix persistence)
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'powershell|mshta|wscript|cscript'
} | ForEach-Object {
    $Report += [PSCustomObject]@{Type='ScheduledTask'; Path=$_.TaskPath;
        Name=$_.TaskName; Value=($_.Actions.Execute + ' ' + $_.Actions.Arguments)}
}

# 4. Active/recent connections to C2 IP
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq '38.146.28.75' } | ForEach-Object {
    $Proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $Report += [PSCustomObject]@{Type='NetworkC2'; Path=$Proc.Path;
        Name=$Proc.ProcessName; Value="$($_.RemoteAddress):$($_.RemotePort) [$($_.State)]"}
}

# 5. Hash-sweep common staging directories
$ScanPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:PUBLIC\Downloads")
foreach ($Dir in $ScanPaths) {
    if (Test-Path $Dir) {
        Get-ChildItem $Dir -Recurse -File -ErrorAction SilentlyContinue |
            Where-Object { $_.Length -lt 50MB } | ForEach-Object {
            $H = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($Hashes -contains $H) {
                $Report += [PSCustomObject]@{Type='HashMatch'; Path=$_.FullName; Name=$_.Name; Value=$H}
            }
        }
    }
}

# 6. DNS cache check for lookalike domains
$BadDomains = 'm365-owa|ms365-device|ms365-live|owa-ms365|oktaenroll|idokta|myoktasso|mypaskeysso|setupssopasskey|passkeyms|keyokta|portalpasskey'
Get-DnsClientCache | Where-Object { $_.Entry -match $BadDomains } | ForEach-Object {
    $Report += [PSCustomObject]@{Type='DNSCache'; Path=''; Name=$_.Entry; Value=$_.Data}
}

if ($Report.Count -gt 0) {
    $Report | Format-Table -AutoSize
    $Report | Export-Csv -Path "$env:TEMP\arsenal_captivecrunch_hunt.csv" -NoTypeInformation
    Write-Host "[!] $($Report.Count) suspicious artifacts found — escalate to IR" -ForegroundColor Red
} else {
    Write-Host "[+] No CaptiveCrunch/UNC6671 host artifacts detected" -ForegroundColor Green
}