CastleLoader/NeedleStealer, MCP AI-Agent Exploitation and RecruitTrap Mobile OAuth Theft: OTX Enterprise Detection Pack

---
title: CastleLoader NeedleStealer Script Stager to Stealer or RAT Execution
id: 8f0d6f5e-7a9f-4a9d-9f10-0a5castle001
status: experimental
description: Detects PowerShell/IronPython style staging and child processes consistent with CastleLoader campaigns delivering CastleStealer, NeedleStealer, PythonRAT, Lobshot, BoryptGrab or NetSupport RAT.
references:
  - https://arcticwolf.com/resources/blog/castleloader-new-campaigns-new-tooling-and-the-needlestealer-connection/
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  selection_child:
    Image|endswith:
      - '\python.exe'
      - '\ipy.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\netsupport*.exe'
      - '\nsclient*.exe'
  selection_cmd:
    CommandLine|contains:
      - 'FromBase64String'
      - 'IEX'
      - 'DownloadString'
      - 'IronPython'
      - 'shellcode'
      - 'Reflective'
      - 'castle'
      - 'needle'
  condition: selection_parent and selection_child and 1 of selection_cmd
falsepositives:
  - Admin automation using PowerShell to invoke Python or installers
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1105
  - attack.t1204
---
title: Suspicious MCP Secrets Enumeration and Shell Execution
id: 7a2mcp00-2026-4c4f-9a11-mcpsecrets022
status: experimental
description: Flags rapid MCP tool enumeration followed by shell commands, file reads and secrets-store lookups against AI agent infrastructure.
references:
  - https://beelzebub.ai/blog/it-thought-it-had-won/
author: Security Arsenal
logsource:
  product: kubernetes
  service: audit
detection:
  selection_api:
    verb:
      - list
      - get
      - create
    objectRef.resource:
      - secrets
      - pods
      - serviceaccounts
      - configmaps
  selection_exec:
    verb: create
    objectRef.subresource: exec
  keywords:
    - 'mcp'
    - 'modelcontextprotocol'
    - 'bedrock'
    - 'aws'
    - 'token'
  condition: selection_exec or (selection_api and keywords)
falsepositives:
  - Platform operators debugging agent frameworks
level: critical
tags:
  - attack.discovery
  - attack.credential_access
  - attack.t1552
  - attack.t1613
---
title: RecruitTrap Enterprise OAuth Phishing Domain Resolution
id: 9b1rec00-2026-4d5b-9c22-recruittrap033
status: experimental
description: Detects DNS or proxy access to recruitment-themed credential harvesting domains reported in OTX for RecruitTrap.
references:
  - https://zimperium.com/blog/extended-rapid-response-zimperium-identifies-recruittrap-recruit-scams-are-targeting-enterprise-credentials-on-mobile
author: Security Arsenal
logsource:
  category: dns
detection:
  selection_domain:
    query|contains:
      - 'hbc-careers.com'
      - 'fifahr-careers.com'
      - 'mckinsey-careers.com'
      - 'aa-careers.com'
      - 'levis-careers.com'
      - 'andmore-global.com'
      - 'expedia-careers.com'
  condition: selection_domain
falsepositives:
  - Threat research and sandbox detonation
level: high
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1557

let bad_domains = dynamic(["teamsvoicepremium.com","italianhitech.com","ebedidance.com","drrajivparti.com","p-rala.com","hbc-careers.com","fifahr-careers.com","mckinsey-careers.com","aa-careers.com","levis-careers.com","andmore-global.com","expedia-careers.com"]);
let suspect_hash = "d26ea6828cc01ae151d99bbee78c4e6d132e9077842a558bce3901fa0970d9be";
union isfuzzy=true
(DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has_any (bad_domains) or RemoteIP in ()
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType),
(DeviceProcessEvents
| where Timestamp > ago(14d)
| where SHA256 == suspect_hash or ProcessCommandLine has_any ("FromBase64String","IEX","DownloadString","IronPython","shellcode","NeedleStealer","CastleLoader","NetSupport","BoryptGrab","Lobshot")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine),
(DeviceEvents
| where Timestamp > ago(14d)
| where ActionType has_any ("ScheduledTaskCreated","RegistryValueSet","BrowserExtensionInstalled")
| where AdditionalFields has_any ("Run\\","Needle","Castle","careers","oauth","token")
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, RegistryKey, RegistryValueName, RegistryValueData, AdditionalFields)

$ErrorActionPreference='SilentlyContinue'
$domains=@('teamsvoicepremium.com','italianhitech.com','ebedidance.com','drrajivparti.com','p-rala.com','hbc-careers.com','fifahr-careers.com','mckinsey-careers.com','aa-careers.com','levis-careers.com','andmore-global.com','expedia-careers.com')
$hash='d26ea6828cc01ae151d99bbee78c4e6d132e9077842a558bce3901fa0970d9be'
Write-Host '[*] DNS cache hits'
Get-DnsClientCache | Where-Object {$domains -contains $_.Entry -or $_.Data -match ($domains -join '|')} | Select-Object Entry,Data,TimeToLive
Write-Host '[*] Established/remembered connections to suspect infrastructure'
Get-NetTCPConnection | Where-Object {$_.State -eq 'Established'} | ForEach-Object { try { $h=[System.Net.Dns]::GetHostEntry($_.RemoteAddress).HostName; if($domains -contains $h){[pscustomobject]@{Local=$_.LocalPort;Remote=$_.RemoteAddress;Host=$h;OwningPid=$_.OwningProcess}} } catch {} }
Write-Host '[*] Hash sweep in common execution locations'
$paths=@($env:TEMP,$env:LOCALAPPDATA,$env:APPDATA,"$env:ProgramData","$env:USERPROFILE\Downloads")
foreach($p in $paths){ Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | Where-Object {$_.Length -lt 75MB} | ForEach-Object { $fh=(Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower(); if($fh -eq $hash){[pscustomobject]@{Path=$_.FullName;SHA256=$fh;Created=$_.CreationTime;Modified=$_.LastWriteTime}} } }
Write-Host '[*] Persistence artifacts'
$runKeys=@('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce')
foreach($k in $runKeys){ Get-ItemProperty $k | ForEach-Object { $_.PSObject.Properties | Where-Object {$_.Value -match 'powershell|python|ipy|netsupport|needle|castle|lobshot|borypt|AppData|ProgramData'} | Select-Object @{n='Key';e={$k}},Name,Value } }
Get-ScheduledTask | Where-Object {$_.Actions.Execute -match 'powershell|python|wscript|mshta|rundll32' -and $_.TaskPath -notlike '\Microsoft\*'} | Select-Object TaskName,TaskPath,@{n='Action';e={$_.Actions.Execute}},@{n='Args';e={$_.Actions.Arguments}}
Write-Host '[*] Browser extension roots for manual review'
Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions","$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions" -Directory -ErrorAction SilentlyContinue | Select-Object FullName,LastWriteTime