KarstoRAT, MioLab MaaS & ClickFix Campaigns: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential KarstoRAT FodHelper UAC Bypass
id: 45b0e9d6-7d4a-4a9b-9e1c-4f5a6b7c8d9e
status: experimental
description: Detects the usage of FodHelper.exe to bypass UAC, a technique associated with KarstoRAT and other commodity malware.
references:
    - https://www.levelblue.com/hubfs/Web/Library/Documents_pdf/TTR-Spotlight-Novel-KarstoRAT-Malware.pdf
author: Security Arsenal
date: 2026/05/07
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\fodhelper.exe'
        CommandLine|contains: 'powershell'
    condition: selection
falsepositives:
    - Legitimate administrative usage
level: high
tags:
    - attack.defense_evasion
    - attack.privilege_escalation
    - karstorat
---
title: ClickFix BackgroundFix Suspicious Finger.exe Usage
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects the execution of finger.exe triggered by a background process or script, characteristic of the ClickFix "BackgroundFix" lure loading CastleLoader.
references:
    - https://www.huntress.com/blog/clickfix-castleloader-backgroundfix
author: Security Arsenal
date: 2026/05/07
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\finger.exe'
    filter:
        ParentImage|endswith: '\\explorer.exe'
    condition: selection and not filter
falsepositives:
    - Rare legitimate usage
level: critical
tags:
    - attack.execution
    - clickfix
    - castleloader
---
title: TeamPCP Telnyx SDK Supply Chain MSBuild Compromise
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects suspicious MSBuild execution patterns often used in Python SDK supply chain attacks to execute code or fetch steganography payloads.
references:
    - https://hexastrike.com/resources/blog/threat-intelligence/ringing-in-chaos-how-teampcp-weaponized-the-telnyx-python-sdk
author: Security Arsenal
date: 2026/05/07
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\msbuild.exe'
        CommandLine|contains: ['http', 'ftp', 'tmp']
    condition: selection
falsepositives:
    - Legitimate developer builds using external resources
level: high
tags:
    - attack.initial_access
    - attack.supply_chain
    - teampcp

// Hunt for ClickFix, KarstoRAT, and TeamPCP Network Artifacts
let MaliciousDomains = dynamic(['trindastal.com', 'poronto.com', 'brionter.com', 'aquasecurtiy.org', 'chatgptforchrome.com', 'giovettiadv.com']);
let MaliciousIPs = dynamic(['38.146.28.30', '212.227.65.132']);
DeviceNetworkEvents
| where RemoteUrl in MaliciousDomains or RemoteIP in MaliciousIPs
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc

<#
    IOC Hunt Script for KarstoRAT, ClickFix, and Malicious Extensions
    Scans for specific file hashes provided in the OTX pulse.
#>

$TargetHashes = @(
    "65229ef9d09e4cbfae326d41c517576cc2143c259fd764f259f3925fc8917c8b",
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a",
    "0cbf101e96f6d5c4146812f07105f8b89bd76dd994f540470cd1c4bc37df37d5",
    "2422f04227fa86a149aed35d82f9a7fc"
)

Write-Host "[*] Starting scan for known malicious hashes..." -ForegroundColor Cyan

$DrivesToScan = @("C:\")

foreach ($Drive in $DrivesToScan) {
    Write-Host "[*] Scanning $Drive..." -ForegroundColor Yellow
    
    Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        $FilePath = $_.FullName
        try {
            $Hash = (Get-FileHash -Path $FilePath -Algorithm SHA256 -ErrorAction Stop).Hash
            if ($TargetHashes -contains $Hash) {
                Write-Host "[!] MATCH FOUND: $FilePath (Hash: $Hash)" -ForegroundColor Red
            }
        } catch {
            # Ignore access errors
        }
    }
}

Write-Host "[*] Scan complete." -ForegroundColor Green