ClickFix RAT, Malware TDS, and Gamaredon's GammaSteel: OTX Pulse Analysis — Enterprise Detection Pack

title: Gamaredon Registry Persistence via Printers
id: 4b1c3a7d-8e9f-4a1b-9c2d-3e5f6a7b8c9d
description: Detects modification of the HKCU\Printers registry key, a known persistence mechanism used by Gamaredon Group (GammaSteel).
status: experimental
date: 2026/06/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64283...
tags:
    - attack.persistence
    - attack.t1112
logsource:
    product: windows
    registry:
        - add
        - modify
detection:
    selection:
        TargetObject|contains: 'Software\Microsoft\Windows NT\CurrentVersion\Printers'
    condition: selection
falsepositives:
    - Legitimate printer driver installations
level: high
---
title: Potential ClickFix LOLBin Execution (Finger to Python)
id: 5d2e4b8c-9f0a-1b2d-3c4e-5f6a7b8c9d0e
description: Detects the execution of finger.exe spawning a python process, indicative of ClickFix campaigns delivering Python RATs.
status: experimental
date: 2026/06/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64282...
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
detection:
    selection_parent:
        Image|endswith: '\finger.exe'
    selection_child:
        Image|contains:
            - '\python.exe'
            - '\pythonw.exe'
    condition: all of selection_*
falsepositives:
    - Rare legacy administrative tasks
level: critical
---
title: Connection to Gamaredon C2 Infrastructure
id: 6e3f5c9d-0a1b-2c3d-4e5f-6a7b8c9d0e1f
description: Detects network connections to known Gamaredon IP infrastructure observed in OTX pulses.
status: experimental
date: 2026/06/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64284...
tags:
    - attack.c2
    - attack.t1071.001
logsource:
    category: network_connection
detection:
    selection_ip:
        DestinationIp|contains:
            - '165.22.170.129'
            - '194.150.220.218'
    selection_domain:
        DestinationHostname|contains:
            - 'justsstop.ru'
            - 'forestoaker.com'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

// Hunt for connections to IOCs from Pulse Data
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("165.22.170.129", "194.150.220.218", "217.156.122.75")
    or RemoteUrl has_any ("justsstop.ru", "teamsvoicehub.com", "dapala.net", "forestoaker.com")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort
| extend IOCSrc = "OTX_Pulse_20260605"

<#
.SYNOPSIS
    Hunt script for Gamaredon persistence and ClickFix IOCs.
.DESCRIPTION
    Checks HKCU\Printers for unexpected values and DNS cache for malicious domains.
#>

# Check for Gamaredon Persistence (GammaSteel)
Write-Host "Checking HKCU\Printers for Gamaredon Persistence..."
$RegPath = "HKCU:\Software\Microsoft\Windows NT\CurrentVersion\Printers"
if (Test-Path $RegPath) {
    $Values = Get-ItemProperty -Path $RegPath
    if ($Values -and ($Values.PSObject.Properties.Count -gt 0)) {
        Write-Host "[ALERT] Values found in Printers key. Investigate:" -ForegroundColor Red
        $Values | Format-List *
    } else {
        Write-Host "No values found."
    }
}

# Check DNS Cache for Malicious Domains
$MaliciousDomains = @("teamsvoicehub.com", "dapala.net", "justsstop.ru", "forestoaker.com")
Write-Host "Checking DNS Cache..."
Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry } | ForEach-Object {
    Write-Host "[ALERT] Malicious domain found in DNS Cache: $($_.Entry) - Data: $($_.Data)" -ForegroundColor Red
}