title: StealC Infostealer Process Execution Pattern
id: 6c8b7d3e-f5a2-4f8c-9e1d-3b2a5c7d8e9f
description: Detects potential execution of StealC infostealer based on process characteristics and command-line patterns
status: experimental
author: Security Arsenal
date: 2026/06/25
references:
    - https://otx.alienvault.com/pulse/672e8f6c7c26c40812345678
tags:
    - attack.credential_access
    - attack.collection
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\stealc.exe'
            - '\client.exe'
            - '\build.exe'
        CommandLine|contains:
            - 'browser'
            - 'wallet'
            - 'password'
    condition: selection
falsepositives:
    - Legitimate password managers
    - Browser backup utilities
level: high
---
title: FortiBleed Credential Harvesting Activity
id: 8f9e0a1b-2c3d-4e5f-6a7b-8c9d0e1f2a3b
description: Detects potential FortiBleed credential harvesting activity targeting FortiGate devices
status: experimental
author: Security Arsenal
date: 2026/06/25
references:
    - https://otx.alienvault.com/pulse/672e8f6c7c26c40812345679
tags:
    - attack.initial_access
    - attack.credential_access
    - attack.exploitation
logsource:
    category: network_connection
    product: zeek
detection:
    selection_ip:
        DestinationIp:
            - '85.11.187.8'
            - '193.8.187.42'
    selection_port:
        DestinationPort: 443
    selection_ua:
        UserAgent|contains:
            - 'FortiGate'
            - 'SSL-VPN'
    condition: 1 of selection*
falsepositives:
    - Legitimate FortiGate management access
    - Known VPN connections
level: critical
---
title: Woodgnat Mistic Backdoor Sideloading
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects potential Backdoor.Mistic execution via DLL sideloading techniques used by Woodgnat
status: experimental
author: Security Arsenal
date: 2026/06/25
references:
    - https://otx.alienvault.com/pulse/672e8f6c7c26c4081234567a
tags:
    - attack.defense_evasion
    - attack.persistence
    - attack.execution
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|contains:
            - 'mistic'
            - 'modelorat'
            - 'nexshield'
        Image|endswith:
            - '\rundll32.exe'
            - '\svchost.exe'
            - '\explorer.exe'
    condition: selection
falsepositives:
    - Legitimate application updates
    - System maintenance activities
level: high


kql
// Hunt for StealC and Amadey infostealer activity
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessName has "stealc" or ProcessName has "amadey" or 
  CommandLine has "browser" and CommandLine has "wallet" or
  FileName has_any ("stealc", "amadey", "lumma", "vidar", "redline")
| project Timestamp, DeviceName, AccountName, ProcessName, CommandLine, InitiatingProcessFileName
| order by Timestamp desc

// FortiBleed credential harvesting detection
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("85.11.187.8", "193.8.187.42") or
  RemoteUrl has_any ("fortigate", "ssl-vpn", "fortibleed")
| project Timestamp, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName
| order by Timestamp desc

// Woodgnat backdoor and sideloading activity
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has_any ("mistic", "modelorat", "nexshield", "mintsloader") or
  (ProcessName in ("rundll32.exe", "regsvr32.exe") and ProcessCommandLine has ".dll")
| project Timestamp, DeviceName, AccountName, ProcessName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

// Steganographic loader campaign detection
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName has_any (".jpg", ".png", ".bmp", ".gif") and 
  (ProcessName has "powershell" or ProcessName has "cmd") or
  SHA256 in ("372f19a45d0eb4c8c52117c6ae2bb8040a91bc72be8670623f957a18c2166985")
| project Timestamp, DeviceName, FileName,FolderPath, SHA256, ProcessName
| order by Timestamp desc


powershell
# IOC Hunt Script for Infostealer and Credential Harvesting Campaigns
# Run with administrative privileges

param(
    [string]$OutputPath = "C:\Temp\IOCHunt_$(Get-Date -Format 'yyyyMMdd').csv"
)

$Results = @()

# Known malicious file hashes from OTX pulses
$MaliciousHashes = @(
    "f89ad7e92c7de6945ce0878e470e388b",
    "8cef760d11d24fc2e9bbd9f770dca5105854f7ece3b0e6948d7c8b7fdd1765ea",
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be",
    "ab5681266f70af7df24383f15de876e411fc18e35cb6f24603b12f580b05ccb3",
    "2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98",
    "372f19a45d0eb4c8c52117c6ae2bb8040a91bc72be8670623f957a18c2166985"
)

# Known malicious processes
$MaliciousProcesses = @(
    "stealc.exe",
    "amadey.exe",
    "mistic.exe",
    "modelorat.exe",
    "cyberstrike.exe"
)

# Known malicious domains in hosts file
$MaliciousDomains = @(
    "microsoft-telemetry.at",
    "svclsc.com",
    "goodpanelforgoodjob.com",
    "mail.authorized-logins.net",
    "mueleer.com",
    "grande-luna.top"
)

# Check for running malicious processes
Write-Host "[+] Checking for running malicious processes..." -ForegroundColor Yellow
$RunningProcesses = Get-Process | Where-Object { $MaliciousProcesses -contains $_.ProcessName }
if ($RunningProcesses) {
    foreach ($Process in $RunningProcesses) {
        $Results += [PSCustomObject]@{
            Type = "Running Process"
            Indicator = $Process.ProcessName
            PID = $Process.Id
            Path = $Process.Path
            Timestamp = Get-Date
        }
    }
}

# Scan common user directories for malicious files
Write-Host "[+] Scanning for malicious files..." -ForegroundColor Yellow
$UserFolders = @("C:\Users\*\AppData\Roaming", "C:\Users\*\AppData\Local", "C:\Users\*\Downloads")
foreach ($Folder in $UserFolders) {
    if (Test-Path $Folder) {
        Get-ChildItem -Path $Folder -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $FileHash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $FileHash) {
                $Results += [PSCustomObject]@{
                    Type = "Malicious File"
                    Indicator = $_.Name
                    Path = $_.FullName
                    Hash = $FileHash
                    Timestamp = $_.LastWriteTime
                }
            }
        }
    }
}

# Check for suspicious scheduled tasks
Write-Host "[+] Checking scheduled tasks..." -ForegroundColor Yellow
$SuspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.TaskName -match "update|service|system" -and 
    $_.Actions.Execute -match "\.exe$|\.dll$|\.ps1$" -and
    $_.Actions.Execute -notmatch "Windows|Program Files" 
}
foreach ($Task in $SuspiciousTasks) {
    $Results += [PSCustomObject]@{
        Type = "Suspicious Scheduled Task"
        Indicator = $Task.TaskName
        Path = $Task.Actions.Execute
        Arguments = $Task.Actions.Arguments
        Timestamp = Get-Date
    }
}

# Check for malicious entries in hosts file
Write-Host "[+] Checking hosts file..." -ForegroundColor Yellow
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($Domain in $MaliciousDomains) {
        if ($HostsContent -match $Domain) {
            $Results += [PSCustomObject]@{
                Type = "Hosts File Entry"
                Indicator = $Domain
                Path = $HostsPath
                Timestamp = Get-Date
            }
        }
    }
}

# Check for suspicious registry persistence
Write-Host "[+] Checking registry persistence..." -ForegroundColor Yellow
$RegistryPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($Path in $RegistryPaths) {
    if (Test-Path $Path) {
        Get-Item -Path $Path -ErrorAction SilentlyContinue | ForEach-Object {
            $_.Property | ForEach-Object {
                $Value = (Get-ItemProperty -Path $Path -Name $_ -ErrorAction SilentlyContinue).$_
                if ($MaliciousProcesses -contains (Split-Path $Value -Leaf) -or $Value -match "Temp|AppData|Downloads") {
                    $Results += [PSCustomObject]@{
                        Type = "Registry Persistence"
                        Indicator = $_
                        Path = $Value
                        RegistryPath = $Path
                        Timestamp = Get-Date
                    }
                }
            }
        }
    }
}

# Check for network connections to malicious IPs
Write-Host "[+] Checking network connections..." -ForegroundColor Yellow
$MaliciousIPs = @("85.11.187.8", "193.8.187.42")
$NetworkConnections = Get-NetTCPConnection -ErrorAction SilentlyContinue | 
    Where-Object { $MaliciousIPs -contains $_.RemoteAddress }
foreach ($Connection in $NetworkConnections) {
    $Process = Get-Process -Id $Connection.OwningProcess -ErrorAction SilentlyContinue
    if ($Process) {
        $Results += [PSCustomObject]@{
            Type = "Network Connection"
            Indicator = $Connection.RemoteAddress
            Process = $Process.ProcessName
            PID = $Connection.OwningProcess
            Port = $Connection.RemotePort
            Timestamp = Get-Date
        }
    }
}

# Output results
if ($Results) {
    $Results | Export-Csv -Path $OutputPath -NoTypeInformation
    Write-Host "[!] $($Results.Count) suspicious indicators found. Results saved to: $OutputPath" -ForegroundColor Red
    $Results | Format-Table -AutoSize
} else {
    Write-Host "[+] No suspicious indicators found." -ForegroundColor Green
}


---

# Response Priorities