ClingSTUN Mirai Botnet + Luna Moth Token Theft + Windows Webshell Campaigns: OTX Pulse Analysis — Enterprise Detection Pack

---
title: ClingSTUN Proxy Backdoor Persistence and Execution
id: 7f3a9b2e-4c1d-4e5f-8a9b-1c2d3e4f5a6b
status: experimental
description: Detects ClingSTUN malware persistence mechanisms and process termination behaviors on Linux systems
references:
    - https://blog.polyswarm.io/clingstun-turns-vulnerable-edge-devices-into-attacker-infrastructure
author: Security Arsenal Threat Intelligence
date: 2026/11/14
modified: 2026/11/14
tags:
    - attack.persistence
    - attack.t1543.002
    - attack.t1059.004
logsource:
    product: linux
    service: auditd
detection:
    selection_init:
        - type: 'execve'
          a0: '*sh*'
          a1: '*rc.local*'
        - type: 'execve'
          a0: '*systemctl*'
          a1: '*enable*'
          a2: '*.service'
    selection_pkill:
        type: 'execve'
        a0: '*pkill*'
        a1: '*-9*'
    selection_watchdog:
        type: 'execve'
        a0: '*echo*'
        a1: '*watchdog*'
    condition: 1 of selection_*
falsepositives:
    - System administration scripts
    - Docker container orchestration
level: high
---
title: Windows Godzilla Webshell with Potato Privilege Escalation
id: 8a4b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
status: experimental
description: Detects Godzilla webshell execution followed by SweetPotato/PrintSpoofer privilege escalation attempts
references:
    - https://asec.ahnlab.com/ko/95811/
author: Security Arsenal Threat Intelligence
date: 2026/11/14
modified: 2026/11/14
tags:
    - attack.privilege_escalation
    - attack.t1068
    - attack.t1055
    - attack.t1505.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_w3wp:
        ParentImage|endswith: '\w3wp.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
    selection_potato:
        Image|endswith:
            - '\SweetPotato.exe'
            - '\PrintSpoofer.exe'
            - '\Godzilla.dll'
        CommandLine|contains:
            - 'SeImpersonatePrivilege'
            - 'nc64.exe'
            - 'whoami /priv'
    timeframe: 5m
    condition: selection_w3wp and selection_potato
falsepositives:
    - Legitimate IIS debugging
    - System Center Operations Manager
level: critical
---
title: Luna Moth Microsoft Graph Token Theft via Browser DevTools
id: 9b5c6d7e-8f9a-0b1c-2d3e-4f5a6b7c8d9e
status: experimental
description: Detects suspicious browser DevTools usage targeting Microsoft 365 Copilot and subsequent Graph API access from anomalous locations
references:
    - https://reliaquest.com/blog/threat-spotlight-luna-moth-returns-re-targeting-law-firms-through-access-tokens/
author: Security Arsenal Threat Intelligence
date: 2026/11/14
modified: 2026/11/14
tags:
    - attack.credential_access
    - attack.t1552.001
    - attack.t1566
logsource:
    product: azure
    service: signinlogs
detection:
    selection_copilot:
        AppDisplayName: 'Microsoft 365 Copilot'
    selection_devtools:
        - UserAgent|contains: 'Mozilla'
        - IPAddress: '104.37.184.195'
    selection_suspicious:
        - ResultType: 0
        - RiskLevelDuringSignIn: 'high'
        - AuthenticationRequirement: 'singleFactorAuthentication'
    condition: selection_copilot and (selection_devtools or selection_suspicious)
falsepositives:
    - Developers testing Copilot integrations
    - VPN exit nodes
level: high

// Hunt for Luna Moth token theft infrastructure and ClingSTUN C2 communications
let SuspiciousIPs = dynamic(["104.37.184.195"]);
let SuspiciousDomains = dynamic(["justsendtext.xyz"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where RemoteIP in~ (SuspiciousIPs) or RemoteUrl in~ (SuspiciousDomains)
    | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, Protocol
    | extend ThreatIndicator = "LunaMoth"),
    (DeviceNetworkEvents
    | where RemotePort == 3478 and Protocol == "Udp"
    | where not(RemoteIP has_any ("stun.l.google.com", "stun.services.mozilla.com", "global.stun.twilio.com"))
    | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, Protocol
    | extend ThreatIndicator = "ClingSTUN-STUN-Abuse"),
    (DeviceProcessEvents
    | where FileName =~ "w3wp.exe"
    | where ProcessCommandLine has_any ("SweetPotato", "PrintSpoofer", "Godzilla")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
    | extend ThreatIndicator = "Potato-Godzilla")
| order by Timestamp desc
| take 100

# ClingSTUN & Luna Moth IOC Hunt Script - Run on endpoints and domain controllers
# Requires: Administrative privileges, PowerShell 5.1+

$ErrorActionPreference = "SilentlyContinue"
$ReportPath = "C:\Temp\ThreatHunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').log"

function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    "$Timestamp [$Level] $Message" | Out-File -FilePath $ReportPath -Append
    Write-Host $Message
}

Write-Log "Starting threat hunt for ClingSTUN, Godzilla, and Luna Moth artifacts..."

# Check for ClingSTUN persistence (Linux artifacts if WSL present, otherwise check for suspicious services)
Write-Log "Checking for suspicious systemd services and init scripts..."
$SuspiciousServices = Get-Service | Where-Object {$_.Name -match "(stun|proxy|tunnel|cling)" -and $_.Status -eq "Running"}
if ($SuspiciousServices) {
    Write-Log "ALERT: Suspicious services detected: $($SuspiciousServices.Name -join ', ')" "WARNING"
}

# Check for Potato tool artifacts in common webshell locations
Write-Log "Scanning IIS directories for Godzilla/webshell indicators..."
$IISPaths = @("C:\inetpub\wwwroot", "C:\inetpub\wwwroot\aspnet_client", "C:\Windows\Temp")
$WebShellPatterns = @("*.aspx;*.asmx;*.ashx", "SweetPotato*", "PrintSpoofer*", "Godzilla*")

foreach ($Path in $IISPaths) {
    if (Test-Path $Path) {
        $Files = Get-ChildItem -Path $Path -Recurse -Include $WebShellPatterns -ErrorAction SilentlyContinue | 
                 Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-30)}
        if ($Files) {
            Write-Log "ALERT: Suspicious files in $Path : $($Files.FullName -join '; ')" "CRITICAL"
        }
    }
}

# Check for recent privilege escalation attempts
Write-Log "Checking Security Event Log for privilege escalation patterns..."
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4672,4673; StartTime=(Get-Date).AddDays(-7)} -MaxEvents 100
$SuspiciousEvents = $Events | Where-Object {$_.Message -match "SeImpersonatePrivilege|SeDebugPrivilege"}
if ($SuspiciousEvents) {
    Write-Log "ALERT: Suspicious privilege assignments detected. Review Event IDs 4672/4673 for w3wp.exe or unexpected service accounts." "WARNING"
}

# Check network connections for Luna Moth IOCs
Write-Log "Checking active network connections for Luna Moth C2 (104.37.184.195)..."
$Connections = Get-NetTCPConnection -State Established | Where-Object {$_.RemoteAddress -eq "104.37.184.195"}
if ($Connections) {
    Write-Log "CRITICAL: Active connection to Luna Moth C2 detected!" "CRITICAL"
    $Connections | Format-Table | Out-File -FilePath $ReportPath -Append
}

# Check browser artifacts for token theft indicators (Edge/Chrome)
Write-Log "Checking browser history for Developer Tools usage targeting Microsoft 365..."
$BrowserPaths = @(
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History",
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History"
)

foreach ($Path in $BrowserPaths) {
    if (Test-Path $Path) {
        # Copy for analysis (browser locks DB)
        $TempCopy = "$env:TEMP\browser_history_$(Get-Random).db"
        Copy-Item $Path $TempCopy -Force
        
        # Simple string search for Copilot + F12 indicators
        $Content = Get-Content $TempCopy -Raw -ErrorAction SilentlyContinue
        if ($Content -match "copilot.microsoft.com" -and $Content -match "devtools") {
            Write-Log "WARNING: Possible Luna Moth social engineering - Browser history shows Copilot + DevTools usage" "WARNING"
        }
        Remove-Item $TempCopy -Force
    }
}

# Registry persistence check
Write-Log "Checking registry Run keys for suspicious entries..."
$RunKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($Key in $RunKeys) {
    $Items = Get-ItemProperty -Path $Key -ErrorAction SilentlyContinue
    if ($Items) {
        $Props = $Items.PSObject.Properties | Where-Object {$_.Value -match "(powershell.*-enc|cmd.*start|wscript|mshta)"}
        if ($Props) {
            Write-Log "ALERT: Suspicious registry persistence in $Key : $($Props.Name -join ', ')" "WARNING"
        }
    }
}

Write-Log "Threat hunt completed. Report saved to $ReportPath"
Write-Host "`nHunt Summary Complete. Check $ReportPath for details." -ForegroundColor Green