---
title: KarstoRAT FodHelper UAC Bypass
id: 7b7b8b8b-8b8b-8b8b-8b8b-8b8b8b8b8b8b
description: Detects registry modification used by KarstoRAT for FodHelper UAC bypass via HKCU Environment registry keys.
status: experimental
date: 2026/05/06
author: Security Arsenal
logsource:
  product: windows
  registry:
    eventid: 13
detection:
  selection:
    EventType: SetValue
    TargetObject|contains: 'Environment\Debug'
    Details|contains: 'fodhelper.exe'
  condition: selection
falsepositives:
  - Legitimate administration usage (rare)
level: critical
tags:
  - attack.privilege_escalation
  - attack.t1548.002
---
title: Suspicious Finger.exe Execution (ClickFix)
id: 9c9c9c9c-9c9c-9c9c-9c9c-9c9c9c9c9c9c
description: Detects the execution of finger.exe, which is abused by ClickFix campaigns to retrieve malicious payloads.
status: experimental
date: 2026/05/06
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\finger.exe'
  filter_legit:
    ParentImage|contains:
      - '\System32\'
      - '\SysWOW64\'
  condition: selection and not filter_legit
falsepositives:
  - Rare legitimate administrative usage
level: high
tags:
  - attack.execution
  - attack.t1059.001
---
title: TeamPCP PyPI Supply Chain Steganography Loader
id: 1a1a1a1a-1a1a-1a1a-1a1a-1a1a1a1a1a1a
description: Detects Python processes downloading .wav files or suspicious network connections indicative of the TeamPCP steganography payload.
status: experimental
date: 2026/05/06
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection_python:
    Image|endswith: '\python.exe'
  selection_suspicious:
    Initiated: 'true'
    DestinationHostname|contains:
      - 'raw.icp0.io'
      - 'aquasecurtiy.org'
  condition: selection_python and selection_suspicious
falsepositives:
  - Legitimate developer tool usage (rare for these domains)
level: critical
tags:
  - attack.initial_access
  - attack.t1195.002

// Hunt for KarstoRAT and ClickFix Network Indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("212.227.65.132", "38.146.28.30") 
   or RemoteUrl has_any ("trindastal.com", "poronto.com", "brionter.com", "giovettiadv.com", "aquasecurtiy.org")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| extend ThreatLogic = case(
    RemoteIP == "212.227.65.132", "KarstoRAT C2",
    RemoteUrl has_any ("trindastal.com", "poronto.com", "brionter.com"), "ClickFix CastleLoader",
    RemoteUrl has "aquasecurtiy.org", "TeamPCP C2",
    "Unknown Indicator"
)

# IOC Hunter for KarstoRAT, ClickFix, and TeamPCP
# Checks for specific file hashes on the system.

$TargetHashes = @(
    "65229ef9d09e4cbfae326d41c517576cc2143c259fd764f259f3925fc8917c8b",
    "07131e3fcb9e65c1e4d2e756efdb9f263fd90080d3ff83fbcca1f31a4890ebdb",
    "839e882551258bf34e5c5105147f7198af2daf7e579d7d4a8c5f1f105966fd7e",
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9",
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a"
)

$PathsToScan = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp")

Write-Host "Starting IOC Scan..." -ForegroundColor Cyan

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $FileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $FileHash) {
                Write-Host "[MALWARE FOUND] $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# Check for TeamPCP Typosquat Domain Connection via DNS Cache
Write-Host "Checking DNS Cache for TeamPCP Typosquat..." -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $_.Entry -like "*aquasecurtiy*" } | ForEach-Object {
    Write-Host "[SUSPICIOUS DNS] Resolved typosquat domain: $($_.Entry)" -ForegroundColor Yellow
}


# Response Priorities

*   **Immediate:**
    *   Block all listed IOCs (IPs, Domains, Hashes) at the network perimeter and endpoint (EDR) level.
    *   Initiate a hunt for processes matching `finger.exe` (ClickFix) and `fodhelper.exe` (KarstoRAT).
*   **24 Hours:**
    *   **Identity Audit:** Given the prevalence of credential theft (KarstoRAT/TeamPCP/CastleStealer), force a password reset and MDE check for accounts associated with infected endpoints.
    *   **Software Supply Chain:** Audit Python environments (`pip list`) for the malicious `telnyx` versions or suspicious packages.
*   **1 Week:**
    *   **Application Control:** Implement strict allow-listing for `finger.exe` and `msbuild.exe` to prevent abuse by loaders.
    *   **Supply Chain Policy:** Enforce GPG signature verification for internal Python package usage and block access to typosquatted domains.