GRIMWEDGE Chrome 0-Day Chain, Vwork Work-Profile Evasion & PREY-0058 MFA-Bypass Extortion: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Chrome Exploit Chain Post-Exploitation - Suspicious Chrome Child Process
description: Detects chrome.exe spawning process-creation or script-execution children consistent with the CVE-2026-85046/CVE-2026-87491 renderer escape delivering GRIMWEDGE/SUPERSTOMP/LONGTALE (UTA0560, JungleBamboo)
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
date: 2026/09/10
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\chrome.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\certutil.exe'
            - '\msiexec.exe'
    filter_renderer:
        CommandLine|contains:
            - '--type='
            - '--utility-sub-type='
    condition: selection_parent and selection_child and not filter_renderer
fields:
    - Image
    - CommandLine
    - ParentImage
    - User
falsepositives:
    - Enterprise browser extensions invoking installers (rare)
level: high
tags:
    - attack.initial_access
    - attack.t1189
    - attack.execution
    - attack.t1059
---
title: Windows Kernel Exploitation Privilege Escalation - Suspicious Driver or Service Install
description: Detects service/driver installation following browser exploitation consistent with CVE-2026-85880 Windows kernel privilege escalation used by UTA0560 and JungleBamboo
status: experimental
author: Security Arsenal Threat Intelligence
date: 2026/09/10
logsource:
    product: windows
    service: system
    definition: Event ID 7045 - A service was installed in the system
detection:
    selection:
        EventID: 7045
    filter_known:
        ServiceFileName|contains:
            - '\Program Files\'
            - '\Windows\'
            - 'Windows Defender'
    condition: selection and not filter_known
fields:
    - ServiceName
    - ServiceFileName
    - ServiceType
    - ServiceStartType
falsepositives:
    - Legitimate software deployment outside Program Files
level: high
tags:
    - attack.privilege_escalation
    - attack.t1068
    - attack.persistence
    - attack.t1543.003
---
title: AiTM Phishing Portal Access - PREY-0058 Passkey and MFA Lure Domains
description: Detects DNS resolution or network connection to PREY-0058 adversary-in-the-middle phishing domains themed around passkey and MFA registration used in Microsoft 365 vishing campaign
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://arcticwolf.com/resources/blog/security-bulletin-active-cloud-data-theft-and-extortion-campaign-targeting-microsoft-365-and-saas-platforms/
date: 2026/09/10
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'setpasskey.com'
            - 'assignpasskey.com'
            - 'oskeysetup.com'
            - 'oskeyconnect.com'
            - 'secure-passkey.com'
            - 'mfaregister.com'
            - 'passkey-mfa.com'
            - 'registermymfa.com'
            - 'msbenefit.com'
    condition: selection
fields:
    - query
    - answer
    - src_ip
falsepositives:
    - None expected - these are dedicated phishing and C2 domains
level: critical
tags:
    - attack.initial_access
    - attack.t1566
    - attack.credential_access
    - attack.t1557
    - attack.command_and_control

// PREY-0058 AiTM phishing + UTA0560/JungleBamboo C2 domain hunt (30-day lookback)
let lookback = 30d;
let maliciousDomains = dynamic([
    "setpasskey.com", "assignpasskey.com", "oskeysetup.com", "oskeyconnect.com",
    "secure-passkey.com", "mfaregister.com", "passkey-mfa.com", "registermymfa.com",
    "msbenefit.com"
]);
let NetworkHits = DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any (maliciousDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let DnsHits = DeviceEvents
    | where TimeGenerated > ago(lookback)
    | where ActionType == "DnsQueryResponse"
    | where Name has_any (maliciousDomains)
    | project TimeGenerated, DeviceName, Name, InitiatingProcessFileName, InitiatingProcessAccountName;
// Post-AiTM-compromise behavior: impossible-travel-style sign-ins and mass downloads
let SuspiciousSignins = SigninLogs
    | where TimeGenerated > ago(lookback)
    | where ResultType == 0
    | summarize FirstSeen=min(TimeGenerated), Locations=make_set(Location), IPs=make_set(IPAddress),
                Apps=make_set(AppDisplayName) by UserPrincipalName, bin(TimeGenerated, 1h)
    | where array_length(Locations) > 1;
NetworkHits
| union DnsHits
| join kind=leftouter (SuspiciousSignins) on $left.InitiatingProcessAccountName == $right.UserPrincipalName
| project-away UserPrincipalName1
| order by TimeGenerated desc

# Security Arsenal - OTX Pulse IOC Hunt (2026-09-10)
# Targets: UTA0560/JungleBamboo GRIMWEDGE chain, PREY-0058 AiTM infrastructure
# Run elevated on Windows endpoints; outputs findings to console + CSV

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# --- 1. File hash hunt (GRIMWEDGE / SUPERSTOMP / LONGTALE) ---
$badHashes = @(
    '337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d',
    '3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f',
    '51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc',
    '56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951'
)
Write-Host "[*] Hunting GRIMWEDGE/SUPERSTOMP/LONGTALE file hashes in user-writable paths..." -ForegroundColor Cyan
$searchPaths = @("$env:TEMP", "$env:LOCALAPPDATA\Temp", "$env:APPDATA", "$env:USERPROFILE\Downloads", "$env:LOCALAPPDATA\Google\Chrome\User Data")
foreach ($path in $searchPaths) {
    Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash
        if ($badHashes -contains $h.ToLower()) {
            $findings += [PSCustomObject]@{Type='MaliciousFile'; Path=$_.FullName; SHA256=$h; Detail='GRIMWEDGE family hash match'}
            Write-Host "[!] HIT: $($_.FullName)" -ForegroundColor Red
        }
    }
}

# --- 2. Suspicious scheduled tasks / services (kernel privesc persistence) ---
Write-Host "[*] Checking for suspicious services outside standard paths..." -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -and $_.PathName -notmatch 'Program Files|Windows\\system32|Windows\\SysWOW64'
} | ForEach-Object {
    $findings += [PSCustomObject]@{Type='SuspiciousService'; Path=$_.PathName; SHA256=''; Detail="Service: $($_.Name)"}
    Write-Host "[!] Suspicious service: $($_.Name) -> $($_.PathName)" -ForegroundColor Yellow
}

Get-ScheduledTask | Where-Object {
    $_.TaskPath -notlike '\Microsoft*' -and
    ($_.Actions.Execute -match 'powershell|wscript|mshta|rundll32|regsvr32')
} | ForEach-Object {
    $findings += [PSCustomObject]@{Type='SuspiciousTask'; Path=$_.Actions.Execute; SHA256=''; Detail="Task: $($_.TaskName)"}
    Write-Host "[!] Suspicious task: $($_.TaskName)" -ForegroundColor Yellow
}

# --- 3. DNS cache hunt for PREY-0058 / espionage C2 domains ---
Write-Host "[*] Checking DNS cache for phishing/C2 domain resolutions..." -ForegroundColor Cyan
$c2Domains = @('msbenefit.com','setpasskey.com','assignpasskey.com','oskeysetup.com','oskeyconnect.com','secure-passkey.com','mfaregister.com','passkey-mfa.com','registermymfa.com')
$dnsCache = Get-DnsClientCache
foreach ($d in $c2Domains) {
    $hits = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hits) {
        foreach ($hit in $hits) {
            $findings += [PSCustomObject]@{Type='DNSResolution'; Path=$hit.Entry; SHA256=''; Detail="Resolved to: $($hit.Data)"}
            Write-Host "[!] DNS cache hit: $($hit.Entry) -> $($hit.Data)" -ForegroundColor Red
        }
    }
}

# --- 4. Chrome extension audit (browser-extension staging vector) ---
Write-Host "[*] Auditing Chrome extensions..." -ForegroundColor Cyan
$extBase = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions"
if (Test-Path $extBase) {
    Get-ChildItem $extBase -Directory | ForEach-Object {
        $manifest = Get-ChildItem $_.FullName -Recurse -Filter 'manifest.json' | Select-Object -First 1
        if ($manifest) {
            $m = Get-Content $manifest.FullName -Raw | ConvertFrom-Json
            if ($m.permissions -match 'webRequest|nativeMessaging|management' -or $m.host_permissions -match '\*://\*/\*') {
                $findings += [PSCustomObject]@{Type='RiskyExtension'; Path=$manifest.FullName; SHA256=''; Detail="Ext: $($_.Name) perms: $($m.permissions -join ',')"}
                Write-Host "[!] High-permission extension: $($_.Name)" -ForegroundColor Yellow
            }
        }
    }
}

# --- Output ---
$outFile = "$env:USERPROFILE\Desktop\OTX_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$findings | Export-Csv -Path $outFile -NoTypeInformation
Write-Host "`n[*] Hunt complete. $($findings.Count) finding(s). Results: $outFile" -ForegroundColor Green