title: Potential KarstoRAT FodHelper UAC Bypass
id: 5f8b5a0e-6c8f-4b9a-8d0d-4b9f9e1c6b1d
description: Detects registry modification associated with KarstoRAT utilizing the FodHelper UAC bypass technique.
status: experimental
date: 2026/05/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660f7c8d5c0e4b4d8c0e4b4d
logsource:
    product: windows
    registry:
        object: *
detection:
    selection_key:
        TargetObject|contains: 'Software\Classes\ms-settings\Shell\Open\command'
    selection_data:
        Details|contains: 'fodhelper.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate system administration (rare)
level: critical
tags:
    - attack.privilege_escalation
    - attack.t1548.002
    - karstorat
---
title: Suspicious Finger.exe Execution (ClickFix)
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects the execution of finger.exe, often abused by ClickFix campaigns to fetch payloads.
status: experimental
date: 2026/05/06
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\finger.exe'
    filter_legit:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    condition: selection and not filter_legit
falsepositives:
    - Rare administrative usage
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - clickfix
---
title: TeamPCP Malicious PyPI Package Activity
id: b2c3d4e5-6789-01bc-def2-345678901234
description: Detects msbuild.exe or python.exe spawning processes associated with steganography or suspicious network connections indicative of the TeamPCP supply chain attack.
status: experimental
date: 2026/05/06
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\msbuild.exe'
            - '\python.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\certutil.exe'
    selection_network:
        CommandLine|contains:
            - 'aquasecurtiy.org'
            - 'raw.icp0.io'
    condition: selection_parent and (selection_child or selection_network)
falsepositives:
    - Legitimate developer build processes
level: medium
tags:
    - attack.initial_access
    - attack.t1195.002
    - supply-chain


kql
// Hunt for ClickFix Finger.exe activity and TeamPCP network indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl hasAny ("trindastal.com", "poronto.com", "brionter.com", "aquasecurtiy.org", "giovettiadv.com") 
   or RemoteIP == "38.146.28.30" or RemoteIP == "212.227.65.132"
| extend DeviceCustom = strcat(DeviceName, " : ", InitiatingProcessFileName)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, DeviceCustom

// Hunt for suspicious process creation patterns
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("finger.exe", "fodhelper.exe") 
   or (InitiatingProcessFileName in~ ("msbuild.exe", "python.exe") and FileName in~ ("powershell.exe", "cmd.exe"))
| project Timestamp, DeviceName, AccountName, FileName, InitiatingProcessFileName, CommandLine


powershell
# KarstoRAT & ClickFix IOC Hunt Script
# Checks for FodHelper registry keys and presence of specific file hashes.

Write-Host "Checking for KarstoRAT FodHelper persistence..."
$regPath = "HKCU:\Software\Classes\ms-settings\Shell\Open\command"
if (Test-Path $regPath) {
    $value = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue
    if ($value) {
        Write-Warning "Potential FodHelper UAC Bypass detected at $regPath"
        Write-Host $value
    }
} else {
    Write-Host "No registry persistence found."
}

Write-Host "\nChecking for ClickFix Finger.exe executions in Event Logs..."
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 1000 -ErrorAction SilentlyContinue | 
    Where-Object { $_.Message -match 'finger.exe' }
if ($events) {
    Write-Warning "Found finger.exe executions."
    $events | Select-Object TimeCreated, Message | Format-List
}

Write-Host "\nScanning for KarstoRAT & TeamPCP file hashes (Check C:\Users\Public or Downloads)..."
$hashes = @(
    "65229ef9d09e4cbfae326d41c517576cc2143c259fd764f259f3925fc8917c8b",
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a"
)

foreach ($hash in $hashes) {
    $result = Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | Where-Object { $_.Hash -eq $hash }
    if ($result) {
        Write-Warning "Malicious file found: $($result.Path) with hash $hash"
    }
}


# Response Priorities

*   **Immediate:** Block all listed domains and IPs at the network perimeter. Initiate a hunt for `finger.exe` and `fodhelper.exe` execution across endpoints. Quarantine any systems matching the provided file hashes.
*   **24h:** Audit developer environments for the malicious Telnyx Python SDK versions. If KarstoRAT is suspected, force reset of Discord tokens and credentials used on infected machines.
*   **1 week:** Implement strict allow-listing for Python package repositories (PyPI) in developer pipelines. Review and restrict the use of `finger.exe` and other legacy binaries via AppLocker or SRP.