EtherHiding Blockchain C2, BlackHatSect0r/DXQRTXX Go C2, Balonx Spyroid PhaaS: OTX Enterprise Detection Pack

---
title: ClickFix FakeCaptcha Browser-Launched Script Execution
id: 9f18a2c1-etherhiding-clickfix-0001
status: experimental
description: Detects browser or explorer spawned mshta, powershell, rundll32, curl, or wscript consistent with ClickFix and FakeCaptcha lure execution used by EtherHiding-style campaigns.
author: Security Arsenal
date: 2026/09/18
logsource:
  category: process_creation
  product: windows
detection:
  parent_browser:
    ParentImage|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\explorer.exe'
  child_script:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\curl.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  suspicious_cli:
    CommandLine|contains:
      - ' -enc '
      - ' -encodedcommand '
      - ' -w hidden'
      - ' -windowstyle hidden'
      - ' invoke-webrequest'
      - ' iwr '
      - ' curl '
      - ' http://'
      - ' https://'
      - ' clipboard'
      - ' mshta http'
      - ' javascript:'
  condition: parent_browser and child_script and 1 of suspicious_cli
fields:
  - Image
  - ParentImage
  - CommandLine
  - ParentCommandLine
  - User
  - Hashes
falsepositives:
  - Admin automation launched from browser portals
  - Software deployment helper scripts
level: high
tags:
  - attack.t1204
  - attack.t1059
  - attack.t1218
references:
  - https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/
---
title: Script Process Querying Polygon RPC For Blockchain C2
id: 9f18a2c1-etherhiding-rpc-0002
status: experimental
description: Detects non-wallet script or LOLBin processes connecting to Polygon RPC endpoints associated with EtherHiding smart-contract C2 resolution.
author: Security Arsenal
date: 2026/09/18
logsource:
  category: network_connection
  product: windows
detection:
  rpc_dest:
    DestinationHostname|contains:
      - 'polygon.api.onfinality.io'
      - 'polygon.lava.build'
      - '1rpc.io'
      - 'polygon-rpc.com'
      - 'rpc.ankr.com'
  proc_susp:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\curl.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\regsvr32.exe'
      - '\msiexec.exe'
  condition: rpc_dest and proc_susp
fields:
  - Image
  - ProcessId
  - DestinationHostname
  - DestinationIp
  - DestinationPort
  - Initiated
falsepositives:
  - Web3 development tools
  - Browser wallet extensions
level: medium
tags:
  - attack.t1568
  - attack.t1071.001
  - attack.t1102
references:
  - https://www.guidepointsecurity.com/blog/etherhiding-exposed-deep-dive/
---
title: Balonx Sistema PhaaS Panel And Spyroid Infrastructure Access
id: 9f18a2c1-balonx-spyroid-0003
status: experimental
description: Detects endpoint or proxy access to Balonx Sistema phishing, callflow, and admin API infrastructure, including GraphQL, REST, and token endpoints.
author: Security Arsenal
date: 2026/09/18
logsource:
  category: network_connection
  product: windows
detection:
  balonx_host:
    DestinationHostname|contains:
      - 'balonx.online'
      - 'callbalonx.info'
      - 'panelbalonxfs.xyz'
      - 'soporte-aclaracion.xyz'
      - 'phishing-domain.xyz'
  api_path:
    DestinationHostname|contains: 'panelbalonxfs.xyz'
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\powershell.exe'
      - '\curl.exe'
  condition: balonx_host or api_path
fields:
  - Image
  - User
  - DestinationHostname
  - DestinationIp
  - DestinationPort
  - RemoteUrl
falsepositives:
  - Threat research in controlled lab
level: critical
tags:
  - attack.t1566
  - attack.t1557
  - attack.t1071.001
references:
  - https://www.group-ib.com/blog/balonx-sistema-mexico-phaas

let BadDomains = dynamic(['lanhd6549tdhse.top','soporte-aclaracion.xyz','balonx.online','callbalonx.info','panelbalonxfs.xyz','phishing-domain.xyz']);
let RpcHosts = dynamic(['polygon.api.onfinality.io','polygon.lava.build','1rpc.io','polygon-rpc.com','rpc.ankr.com']);
let ScriptProcs = dynamic(['powershell.exe','pwsh.exe','mshta.exe','rundll32.exe','curl.exe','wscript.exe','cscript.exe','regsvr32.exe','msiexec.exe']);
let Lookback = 14d;
let NetHits = DeviceNetworkEvents
| where TimeGenerated >= ago(Lookback)
| where RemoteUrl has_any (BadDomains) or RemoteUrl has_any (RpcHosts) or RemoteIP has_any (dynamic([]))
| extend RemoteHost = tostring(parse_url(tostring(RemoteUrl)).Host)
| where RemoteHost has_any (BadDomains) or RemoteHost has_any (RpcHosts) or isempty(RemoteHost)
| project NetTime=TimeGenerated, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName, RemoteUrl, RemoteIP, RemotePort, RemoteHost;
let ProcHits = DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where FileName in~ (ScriptProcs)
| where InitiatingProcessFileName has_any ('chrome.exe','msedge.exe','firefox.exe','brave.exe','explorer.exe') or ProcessCommandLine has_any ('-enc','-encodedcommand','-w hidden','-windowstyle hidden','invoke-webrequest',' iwr ','curl ','clipboard','javascript:')
| project ProcTime=TimeGenerated, DeviceName, DeviceId, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, SHA256;
ProcHits
| join kind=leftouter (NetHits) on DeviceId, $left.DeviceId == $right.DeviceId
| where abs(datetime_diff('second', ProcTime, NetTime)) <= 900 or isnull(NetTime)
| project ProcTime, NetTime, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteHost, RemoteUrl, RemoteIP, SHA256
| order by ProcTime desc;

$ErrorActionPreference = 'SilentlyContinue'
$bad = @('lanhd6549tdhse.top','soporte-aclaracion.xyz','balonx.online','callbalonx.info','panelbalonxfs.xyz','phishing-domain.xyz')
$rpc = @('polygon.api.onfinality.io','polygon.lava.build','1rpc.io','polygon-rpc.com','rpc.ankr.com')
$scriptProc = @('powershell.exe','pwsh.exe','mshta.exe','rundll32.exe','curl.exe','wscript.exe','cscript.exe','regsvr32.exe','msiexec.exe')
Write-Host '[*] DNS cache and resolver hits'
Get-DnsClientCache | Where-Object { $n=$_.Entry; ($bad+$rpc | ForEach-Object { $n -like ('*'+$_+'*') }) -contains $true } | Select-Object Entry,RecordName,Data,TimeToLive
Write-Host '[*] Active TCP connections to IOC-resolved addresses'
$ips = foreach ($d in ($bad+$rpc)) { try { (Resolve-DnsName $d -Type A -ErrorAction Stop).IPAddress } catch { $null } }
Get-NetTCPConnection | Where-Object { $_.RemoteAddress -in $ips -or $_.RemotePort -in @(80,443,8080,8443) } | ForEach-Object {
  $p = Get-Process -Id $_.OwningProcess
  if ($p.ProcessName -in $scriptProc -or $ips -contains $_.RemoteAddress) { [pscustomobject]@{Local=$_.LocalAddress+':'+$_.LocalPort; Remote=$_.RemoteAddress+':'+$_.RemotePort; State=$_.State; Process=$p.ProcessName; Path=$p.Path; Id=$_.OwningProcess} }
} | Format-Table -AutoSize
Write-Host '[*] Persistence locations'
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce','HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($k in $runKeys) { Get-ItemProperty $k | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match 'powershell|mshta|rundll32|curl|wscript|http://|https://|AppData|Temp' } | Select-Object @{n='Key';e={$k}},Name,Value } }
Get-ScheduledTask | Where-Object { ($_.Actions.Execute -match 'powershell|mshta|rundll32|curl|wscript') -or ($_.Actions.Arguments -match '-enc|-encodedcommand|hidden|invoke-webrequest| iwr |http://|https://') } | Select-Object TaskName,TaskPath,State,@{n='Action';e={($_.Actions.Execute+' '+$_.Actions.Arguments)}}
Write-Host '[*] Browser-launched process ancestry snapshot'
Get-CimInstance Win32_Process | Where-Object { $_.Name -in $scriptProc } | ForEach-Object { $parent = Get-CimInstance Win32_Process -Filter ('ProcessId='+$_.ParentProcessId); if ($parent.Name -match 'chrome|msedge|firefox|brave|explorer') { [pscustomobject]@{Time=$_.CreationDate; Proc=$_.Name; Cmd=$_.CommandLine; Parent=$parent.Name; ParentCmd=$parent.CommandLine} } } | Format-List
Write-Host '[*] Edge and app exposure check for listed CVE context'
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 25 HotFixID,Description,InstalledOn
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -match 'F5|Laravel|Spring|WordPress|PHP|OpenSSL|Android|ADB' } | Select-Object DisplayName,DisplayVersion,Publisher,InstallDate