CastleLoader RAT, TDS Malware Distribution, and Operation GriefLure: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential ClickFix Attack - Suspicious Finger Execution
description: Detects the use of the legacy finger.exe utility, which is abused in ClickFix campaigns to download payloads.
status: experimental
date: 2026/06/06
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\finger.exe'
  condition: selection
fields:
  - CommandLine
  - ParentCommandLine
falsepositives:
  - Legitimate administration (rare in modern environments)
level: high
---
title: Portable Python Execution - CastleLoader Indicator
description: Detects execution of portable python binaries (python.exe or pythonw.exe) from suspicious directories or spawned by cmd/powershell.
status: experimental
date: 2026/06/06
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - '\python.exe'
      - '\pythonw.exe'
  selection_parent:
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\mshta.exe'
  filter_legit:
    Image|contains:
      - '\Python39\'
      - '\Python310\'
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection_img and selection_parent and not filter_legit
falsepositives:
  - Developer workstations running scripts locally
level: medium
---
title: Suspicious Service Creation - GriefLure Pattern
description: Detects creation of services with suspicious names or binaries related to Operation GriefLure (sfsvc.exe).
status: experimental
date: 2026/06/06
author: Security Arsenal
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains: 'sfsvc.exe'
  condition: selection
level: critical

// Hunt for network connections to known TDS and ClickFix infrastructure
let IOCs = dynamic(["teamsvoicehub.com", "dapala.net", "staruxaproruha.com", "guiformat.com", "forestoaker.com", "194.150.220.218", "217.156.122.75"]);
DeviceNetworkEvents
| where RemoteUrl has_any (IOCs) or RemoteIP has_any (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc


kql
// Hunt for GriefLure File Hashes
let MalwareHashes = dynamic(["08a474368a2f94f347ad9e1a0a08d4258fcf49c6b9373214f7901bb770bacca4", "197f11a7b0003aa7da58a3302cfa2a96a670de91d39ddebc7a51ac1d9404a7e6", "35af2cf5494181920b8624c7b719d39590e2a5ff5eaa1a2fa1ba86b2b5aa9b43"]);
DeviceFileEvents
| where SHA256 in (MalwareHashes)
| project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessAccountName, SHA256

# IOC Scanner for CastleLoader and GriefLure
# Requires Admin privileges for full system scan

$TargetHashes = @(
    "08a474368a2f94f347ad9e1a0a08d4258fcf49c6b9373214f7901bb770bacca4",
    "197f11a7b0003aa7da58a3302cfa2a96a670de91d39ddebc7a51ac1d9404a7e6",
    "35af2cf5494181920b8624c7b719d39590e2a5ff5eaa1a2fa1ba86b2b5aa9b43"
)

$SuspiciousDomains = @(
    "teamsvoicehub.com",
    "guiformat.com",
    "forestoaker.com"
)

Write-Host "[+] Scanning for file indicators..." -ForegroundColor Cyan
# Scan common user directories for executables matching hashes
$PathsToScan = @("$env:USERPROFILE\Downloads", "$env:USERPROFILE\AppData", "C:\Temp")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue -Include *.exe, *.dll, *.py, *.rtf | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($Hash -in $TargetHashes) {
                Write-Host "[!] MALWARE FOUND: $($_.FullName) | Hash: $Hash" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking DNS Cache for TDS/ClickFix domains..." -ForegroundColor Cyan
$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($Domain in $SuspiciousDomains) {
    $Entries = $DnsCache | Where-Object { $_.Entry -like "*$Domain*" }
    if ($Entries) {
        Write-Host "[!] SUSPICIOUS DNS ENTRY FOUND: $Domain" -ForegroundColor Yellow
        $Entries | Format-List Entry, Data, Type
    }
}

Write-Host "[+] Scan Complete." -ForegroundColor Green