Kimsuky 'Operation GitPower' Evolves: AI-Generated Decoys, GitHub PAT C2, and LNK-Based PowerShell Loaders — OTX Detection Pack

---
title: Kimsuky Operation GitPower - Malicious LNK Spawning PowerShell Loader
id: 9c2a1f44-7b3e-4d51-9a01-6f2b8c4d5e10
status: experimental
description: Detects LNK-driven execution chains consistent with Kimsuky Operation GitPower where a shortcut file launches hidden or encoded PowerShell loaders
author: Security Arsenal Threat Intelligence
references:
  - https://www.genians.co.kr/blog/threat_intelligence/ai-agent-opencode
  - https://otx.alienvault.com/pulse/
date: 2026/09/08
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\cmd.exe'
      - '\msedge.exe'
      - '\chrome.exe'
      - '\OUTLOOK.EXE'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_flags:
    CommandLine|contains:
      - ' -enc '
      - ' -e '
      - ' -w hidden'
      - ' -WindowStyle Hidden'
      - 'FromBase64String'
      - 'IEX'
      - 'DownloadString'
  condition: selection_parent and selection_image and 1 of selection_flags
falsepositives:
  - Administrative scripts launched manually via shortcuts
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204.002
---
title: Kimsuky Operation GitPower - Non-Browser Process Contacting GitHub API (PAT-Based C2)
id: 3e7b9d12-5c4a-4f68-8b22-1a9c0d6e7f31
status: experimental
description: Detects script interpreters and LOLBins establishing connections to GitHub API/raw endpoints, consistent with Kimsuky's GitHub PAT-based C2 channel
author: Security Arsenal Threat Intelligence
references:
  - https://www.genians.co.kr/blog/threat_intelligence/ai-agent-opencode
date: 2026/09/08
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\curl.exe'
      - '\wget.exe'
  selection_domain:
    DestinationHostname|contains:
      - 'api.github.com'
      - 'raw.githubusercontent.com'
      - 'gist.github.com'
      - 'objects.githubusercontent.com'
  condition: selection_process and selection_domain
falsepositives:
  - Developer tooling, package managers, and CI agents on engineering workstations - baseline per host role
level: high
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1071.001
---
title: Kimsuky Operation GitPower - Encoded or Obfuscated PowerShell with Custom Decoder Patterns
id: 7f1d5a83-2e9b-4c74-b133-8d4e6f0a2c59
status: experimental
description: Detects obfuscated PowerShell command lines containing string-manipulation and decoding routines matching Kimsuky custom decoder behavior, including anti-analysis sleep/delay patterns
author: Security Arsenal Threat Intelligence
references:
  - https://www.genians.co.kr/blog/threat_intelligence/ai-agent-opencode
date: 2026/09/08
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_obfuscation:
    CommandLine|contains:
      - '-replace'
      - '[char]'
      - 'Join-String'
      - '-join'
      - 'Reverse'
      - 'Start-Sleep'
      - 'FromBase64String'
      - '.Substring('
      - 'GetEnumerator'
  condition: selection_image and 2 of selection_obfuscation
falsepositives:
  - Legitimate administrative one-liners with string manipulation; tune per environment
level: medium
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.t1059.001

// Kimsuky Operation GitPower Hunt: LNK-launched PowerShell + GitHub PAT C2
// Microsoft Sentinel / Microsoft 365 Defender
let ioc_hashes = dynamic([
  "f1bd5817678f498966f033f61b617dee5c8e81191901fea7c4a89146bfe91091",
  "10780939962b54addc9d31f57d80edfc",
  "1523a2fcc901965ab4568d9fe829e4af",
  "500e0bc0d7579fb338912770964076fe",
  "685bfc6b2c29fbc16cfad908894add55",
  "7a53089053b1381742856a5cf2b95f8b",
  "8db2f20b719dcb7029d6296505622093",
  "900e832c10d851bbdef3fb191a15db0e"
]);
let github_c2 = dynamic(["api.github.com", "raw.githubusercontent.com", "gist.github.com", "objects.githubusercontent.com"]);
// Part 1: Known-bad hash sightings in file events
let HashHits =
  DeviceFileEvents
  | where TimeGenerated > ago(14d)
  | where SHA256 in~ (ioc_hashes) or MD5 in~ (ioc_hashes)
  | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, MD5, InitiatingProcessFileName;
// Part 2: LNK-triggered PowerShell with obfuscation flags
let LnkChains =
  DeviceProcessEvents
  | where TimeGenerated > ago(14d)
  | where FileName in~ ("powershell.exe", "pwsh.exe")
  | where InitiatingProcessCommandLine has_any (".lnk")
     or ProcessCommandLine has_any (" -enc ", "FromBase64String", " -w hidden", "WindowStyle Hidden", "IEX")
  | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;
// Part 3: Non-browser processes talking to GitHub API (PAT C2 behavior)
let GithubC2 =
  DeviceNetworkEvents
  | where TimeGenerated > ago(14d)
  | where RemoteUrl has_any (github_c2)
  | where InitiatingProcessFileName in~ ("powershell.exe","pwsh.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","curl.exe","wget.exe")
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
HashHits
| union LnkChains, GithubC2
| sort by TimeGenerated desc

# Kimsuky Operation GitPower - Endpoint IOC & Behavior Hunt
# Run elevated across endpoints (or via EDR Live Response / GPO scheduled task)
# Checks: known-bad hashes, suspicious LNK files, encoded PowerShell artifacts, GitHub API connections

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

$badMD5 = @(
  '10780939962b54addc9d31f57d80edfc','1523a2fcc901965ab4568d9fe829e4af',
  '500e0bc0d7579fb338912770964076fe','685bfc6b2c29fbc16cfad908894add55',
  '7a53089053b1381742856a5cf2b95f8b','8db2f20b719dcb7029d6296505622093',
  '900e832c10d851bbdef3fb191a15db0e'
)
$badSHA256 = @('f1bd5817678f498966f033f61b617dee5c8e81191901fea7c4a89146bfe91091')

Write-Host "[1] Hash sweep of user-writable directories..."
$searchPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:USERPROFILE\Downloads","$env:USERPROFILE\Desktop","C:\ProgramData")
foreach ($p in $searchPaths) {
  Get-ChildItem -Path $p -Recurse -File -Include *.lnk,*.ps1,*.zip -ErrorAction SilentlyContinue | ForEach-Object {
    $m = (Get-FileHash $_.FullName -Algorithm MD5).Hash.ToLower()
    $s = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
    if ($badMD5 -contains $m -or $badSHA256 -contains $s) {
      $report += [PSCustomObject]@{Check='HashMatch'; Path=$_.FullName; MD5=$m; SHA256=$s; Detail='KNOWN KIMSUKY IOC'}
    }
  }
}

Write-Host "[2] Scanning .lnk files for PowerShell targets..."
$wsh = New-Object -ComObject WScript.Shell
foreach ($p in $searchPaths) {
  Get-ChildItem -Path $p -Recurse -Filter *.lnk -ErrorAction SilentlyContinue | ForEach-Object {
    $sc = $wsh.CreateShortcut($_.FullName)
    if ($sc.TargetPath -match 'powershell|pwsh|mshta|wscript' -or $sc.Arguments -match '-enc|FromBase64String|IEX|hidden') {
      $report += [PSCustomObject]@{Check='SuspiciousLNK'; Path=$_.FullName; MD5=''; SHA256=''; Detail="Target=$($sc.TargetPath) Args=$($sc.Arguments)"}
    }
  }
}

Write-Host "[3] Checking active connections to GitHub API endpoints..."
$conns = Get-NetTCPConnection -State Established | Where-Object { $_.RemotePort -eq 443 }
foreach ($c in $conns) {
  $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
  if ($proc.ProcessName -match 'powershell|pwsh|cmd|wscript|cscript|mshta|rundll32|curl|wget') {
    try {
      $dns = (Resolve-DnsName $c.RemoteAddress -ErrorAction Stop).NameHost
    } catch { $dns = '' }
    if ($dns -match 'github|githubusercontent' -or $c.RemoteAddress -match '^140\.82\.|^185\.199\.') {
      $report += [PSCustomObject]@{Check='GithubC2'; Path=$proc.Path; MD5=''; SHA256=''; Detail="$($proc.ProcessName) -> $($c.RemoteAddress):443 ($dns)"}
    }
  }
}

Write-Host "[4] Checking PowerShell history for obfuscation artifacts..."
Get-ChildItem "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine" -Filter *.txt -Recurse | ForEach-Object {
  $hits = Select-String -Path $_.FullName -Pattern '-enc |FromBase64String|Start-Sleep|-replace|\[char\]' -AllMatches
  if ($hits) { $report += [PSCustomObject]@{Check='PSHistory'; Path=$_.FullName; MD5=''; SHA256=''; Detail="$(($hits | Measure-Object).Count) suspicious lines"} }
}

Write-Host "`n===== KIMSUKY GITPOWER HUNT RESULTS ====="
if ($report.Count -eq 0) { Write-Host "No indicators found on $env:COMPUTERNAME" }
else { $report | Format-Table -AutoSize; $report | Export-Csv ".\kimsuky_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation }