---
title: Potential PlugX Service Installation
id: 8f4a3b21-6c5d-4e9f-8a1b-2c3d4e5f6789
status: experimental
description: Detects the creation of a new service by PowerShell or cmd.exe, a technique often used by PlugX for persistence using arbitrary binary paths.
references:
  - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - 'New-Service'
      - 'sc create'
      - 'Create-Service'
  filter:
    ParentImage|contains:
      - '\System32\'
      - '\SysWOW64\'
falsepositives:
  - Legitimate administrative software installation
level: high
---
title: Suspicious PlugX Registry Persistence
id: 9a5b4c32-d7e6-5f0a-9b2c-3d4e5f6a7890
status: experimental
description: Detects registry modifications in Run keys that point to suspicious locations or DLLs, characteristic of PlugX persistence mechanisms.
references:
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_add
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
    Details|contains:
      - '.dll'
      - 'AppData'
falsepositives:
  - Legitimate software updates installed in user directories
level: medium
---
title: Browser Spawning Shell via OAuth Phishing
id: 0c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
status: experimental
description: Detects web browsers spawning command shells or PowerShell, often observed after a user clicks a malicious link in an OAuth phishing campaign leading to a download.
references:
  - https://attack.mitre.org/techniques/T1059/003/
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.execution
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
falsepositives:
  - Legitimate "Open in Terminal" features or web-based SSO launchers
level: medium

AuditLogs
| where OperationName == "Add OAuth2PermissionGrant" or OperationName == "Consent to application"
| extend AppName = tostring(TargetResources[0].DisplayName)
| extend Permissions = tostring(TargetResources[0].PermissionDetails)
| project TimeGenerated, OperationName, InitiatedBy, AppName, Permissions
| where Permissions contains "Mail.Read" or Permissions contains "Files.Read"


**Detect PlugX Process Anomalies:**
DeviceProcessEvents  
| where Timestamp > ago(7d)
| where FileName in~ ("rundll32.exe", "regsvr32.exe")
| where ProcessCommandLine has ".dll" and ProcessCommandLine has "-s"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName

-- Hunt for services pointing to non-standard paths (User profiles or temp)
SELECT Name, DisplayName, ImagePath, State
FROM services()
WHERE ImagePath =~ 'AppData'
   OR ImagePath =~ '\\Temp\\'
   OR ImagePath =~ 'Users\\'


**Hunt for PlugX Registry Persistence:**
-- Scan registry Run keys for suspicious DLL execution
SELECT Key.Path, Data.value AS Value, Key.ModTime
FROM glob(globs='C:\Users\*\NTUSER.DAT')
-- Parse registry hive to find Run keys (simplified glob approach)
-- In production, use the registry() plugin directly
WHERE Key.Path =~ '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'
  AND Value =~ '.dll'

# Connect to Microsoft Graph (required modules: Microsoft.Graph)
Connect-MgGraph -Scopes "Application.Read.All", "Directory.Read.All"

# Get all Service Principals with dangerous permissions
$Apps = Get-MgServicePrincipal -All

$RiskyApps = foreach ($App in $Apps) {
    $Permissions = Get-MgServicePrincipalAppRoleAssignment -ServicePrincipalId $App.Id
    if ($Permissions) {
        [PSCustomObject]@{
            AppName = $App.DisplayName
            AppId = $App.AppId
            PermissionCount = $Permissions.Count
            GrantedTo = ($Permissions | Select-Object -ExpandProperty PrincipalDisplayName) -join ", "
        }
    }
}

# Display apps with permissions
$RiskyApps | Format-Table -AutoSize