---
title: Kimsuky XenoRAT LNK PowerShell Spear-Phish Execution
id: 8f2f7c6a-7d1c-4b1d-9a4a-3d5c2a9f1101
status: experimental
description: Detects LNK-driven command execution, PowerShell payload retrieval, curl-based HTA download, and AutoIt staging aligned to Kimsuky September 2026 South Korea activity.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_lnk:
    ParentImage|endswith: '\explorer.exe'
    CommandLine|contains:
      - '.lnk'
      - 'powershell'
      - 'mshta'
      - 'curl.exe'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '-enc'
      - '-encodedcommand'
      - 'downloadstring'
      - 'invoke-webrequest'
      - 'iex'
      - 'curl.exe'
      - '.hta'
  selection_autoit:
    Image|endswith:
      - '\autoit3.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
    CommandLine|contains:
      - 'appdata'
      - 'temp'
      - '.au3'
      - '.dll'
  condition: 1 of selection_*
falsepositives:
  - Admin scripts using encoded PowerShell or software deployment via curl
level: high
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1059.001
  - attack.t1204.002
  - attack.t1105
date: 2026/11/02
---
title: Scheduled Task Persistence for Keylogger Infostealer
id: 2f2c6b25-0dd3-4b9c-b2a2-11a3dd2388c7
status: experimental
description: Detects suspicious scheduled task creation from user-writable paths after script or LOLBin execution, consistent with Kimsuky keylogger and XenoRAT persistence.
author: Security Arsenal
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4698
    TaskContent|contains:
      - '\AppData\'
      - '\Temp\'
      - 'powershell'
      - 'mshta'
      - 'rundll32'
      - 'autoit'
      - '.hta'
      - '.au3'
  filter_enterprise:
    TaskContent|contains:
      - 'Microsoft\Windows\'
      - 'SoftwareDistribution'
  condition: selection and not filter_enterprise
falsepositives:
  - User logon scripts and IT-created update tasks
level: medium
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.privilege_escalation
date: 2026/11/02
---
title: AI Credential LLMjacking Egress to OTX IOC Infrastructure
id: 6b713792-91bd-4c07-bcf0-b9a52e447b20
status: experimental
description: Detects network connections to Black October AI platform abuse indicators and suspicious high-volume process egress commonly associated with token abuse or model brokering.
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection_ioc:
    DestinationIp|in:
      - '31.57.201.201'
      - '38.246.114.118'
    DestinationHostname|in:
      - 'artex.nhhh.de'
      - 'direct.465415.xyz'
      - 'lutkdd.corpsecs.com'
      - 'qykvdz.corpsecs.com'
  selection_ai_proc:
    Image|endswith:
      - '\python.exe'
      - '\node.exe'
      - '\curl.exe'
      - '\powershell.exe'
      - '\dotnet.exe'
      - '\java.exe'
    DestinationPort:
      - 80
      - 443
      - 8443
  condition: selection_ioc or (selection_ai_proc and selection_ioc)
falsepositives:
  - Developer tooling reaching legitimate AI endpoints; validate against IOC list and tenant allowlists
level: critical
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071.001
  - attack.t1041
date: 2026/11/02

let iocs = dynamic(["31.57.201.201","38.246.114.118","artex.nhhh.de","direct.465415.xyz","lutkdd.corpsecs.com","qykvdz.corpsecs.com"]);
let net = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP in~ (iocs) or RemoteUrl has_any (iocs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType;
let proc = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where (FileName =~ "explorer.exe" and ProcessCommandLine has_any (".lnk","powershell","mshta","curl.exe"))
   or (FileName in~ ("powershell.exe","pwsh.exe") and ProcessCommandLine has_any ("-enc","encodedcommand","downloadstring","iex","curl.exe",".hta"))
   or (FileName in~ ("schtasks.exe","cmd.exe") and ProcessCommandLine has_any ("AppData","Temp","autoit","mshta","rundll32"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
union net, proc
| sort by TimeGenerated desc

$ErrorActionPreference = 'SilentlyContinue'
$iocHosts = @('lutkdd.corpsecs.com','qykvdz.corpsecs.com','artex.nhhh.de','direct.465415.xyz')
$iocIPs   = @('31.57.201.201','38.246.114.118')
Write-Host '[+] Scheduled tasks with user-writable script paths'
Get-ScheduledTask | ForEach-Object {
  $xml = [xml](Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath)
  $cmd = ($xml.Task.Actions.Exec | ForEach-Object { "$($_.Command) $($_.Arguments)" }) -join ' '
  if ($cmd -match 'AppData|Temp|powershell|mshta|curl|autoit|rundll32|regsvr32|\.hta|\.au3') {
    [pscustomobject]@{Task=$_.TaskName; Path=$_.TaskPath; Command=$cmd}
  }
} | Format-List
Write-Host '[+] Run key persistence entries'
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) { Get-ItemProperty $k | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|Temp|powershell|mshta|autoit|curl|\.hta|\.au3' } | Select-Object @{n='Key';e={$k}}, Name, Value } }
Write-Host '[+] Active and recent DNS/network IOC hits'
Get-NetTCPConnection | Where-Object { $iocIPs -contains $_.RemoteAddress } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
foreach ($h in $iocHosts) { Resolve-DnsName $h | Select-Object Name,IPAddress,Type }
Write-Host '[+] Suspicious LNK and recent script artifacts'
Get-ChildItem "$env:USERPROFILE\Desktop","$env:USERPROFILE\Downloads","$env:TEMP" -Recurse -Include *.lnk,*.hta,*.au3,*.ps1 -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | Select-Object FullName,Length,LastWriteTime