title: Kimsuky KimJongRAT C2 Beacon Activity
id: b4a3e6c1-8a2f-4b2c-9e5d-1f6a7c8d9e0f
description: Detects potential KimJongRAT C2 communication to known suspicious infrastructure or specific URI patterns observed in recent campaigns.
status: experimental
date: 2026/07/26
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/67927d723b8b2b859d3e
logsource:
    category: proxy
definition:
    condition: selection
fields:
    - dest_ip
    - dest_port
    - url
falsepositives:
    - Unknown
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
selection:
    cs-method|contains: 'GET'
    cs-uri-query|contains:
        - '/agent.ashx'
    dest-host|endswith:
        - '.servequake.com'
        - '.corpsecs.com'
---
title: Langflow RCE Exploitation Attempt
id: a1b2c3d4-e5f6-7890-1234-567890abcdef
description: Detects exploitation attempts against Langflow CVE-2026-33017 involving specific paths or non-standard ports associated with the botnet deployment.
status: experimental
date: 2026/07/26
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66928d723b8b2b859d3e
logsource:
    category: web
product: apache
definition:
    condition: selection
fields:
    - client_ip
    - url
falsepositives:
    - Legitimate administrative access
level: critical
tags:
    - attack.initial_access
    - attack.t1190
selection:
    c-uri|contains: '/slt'
    c-port: 8084
---
title: Kimsuky Persistence via Scheduled Task
id: e5f6g7h8-i9j0-1234-5678-90abcdef1234
description: Identifies suspicious scheduled task creation patterns associated with XenoRAT and AutoIt backdoors used by Kimsuky.
status: experimental
date: 2026/07/26
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/65919d723b8b2b859d3e
logsource:
    category: process_creation
product: windows
definition:
    condition: selection
fields:
    - CommandLine
    - ParentImage
falsepositives:
    - Legitimate software updates
level: high
tags:
    - attack.persistence
    - attack.t1053.005
selection:
    Image|endswith:
        - '\schtasks.exe'
    CommandLine|contains:
        - '/create'
        - '/sc'
        - '/tn'
    CommandLine|contains:
        - 'AutoIt3'
        - 'PowerShell -EncodedCommand'

// Hunt for KimJongRAT and Langflow related network activity
let IOCs = dynamic([
    "googleoba.servequake.com", "lutkdd.corpsecs.com", "pxqtkc.corpsecs.com",
    "bohyeonsanvil.com", "kumhosports.com", "45.207.216.55"
]);
let MaliciousHashes = dynamic([
    "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470",
    "221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9"
]);
// Network Connections
DeviceNetworkEvents
| where RemoteUrl in (IOCs) or RemoteIP in (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc
| extend Alert = "C2 Communication Detected"
union (
    DeviceProcessEvents
    | where SHA256 in (MaliciousHashes) or MD5 in ("03e4bef86f3e3e6ea23eb6f017af0c98", "05c07339603994b36dcfefcce720d03d")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, SHA256, MD5
    | order by Timestamp desc
    | extend Alert = "Malware Execution Detected"
)

<#
.SYNOPSIS
    Hunt script for Kimsuky artifacts and scheduled tasks.
.DESCRIPTION
    Checks for scheduled tasks registered with AutoIt/PowerShell patterns and compares file hashes against the latest OTX pulse.
#>

$IndicatorHashes = @(
    "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470",
    "221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9",
    "107b5aa3c4ef30b9b832e0a10b1efb1dcf433158bc6af8d890d66c0c9ed50d21"
)

Write-Host "[+] Checking for suspicious Scheduled Tasks..." -ForegroundColor Cyan

$SuspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -like "*powershell*" -or 
    $_.Actions.Execute -like "*autoit*" -or
    $_.Actions.Arguments -like "*/sc*" -and $_.Actions.Arguments -like "*/tn*"
}

foreach ($Task in $SuspiciousTasks) {
    Write-Host "[!] Suspicious Task Found: $($Task.TaskName)" -ForegroundColor Yellow
    Write-Host "    Action: $($Task.Actions.Execute) $($Task.Actions.Arguments)"
}

Write-Host "[+] Scanning common drop directories for malware hashes..." -ForegroundColor Cyan

$Paths = @("$env:TEMP", "$env:USERPROFILE\Downloads", "C:\ProgramData", "C:\Windows\Temp")

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Get-FileHash -ErrorAction SilentlyContinue | Where-Object { $IndicatorHashes -contains $_.Hash } | ForEach-Object {
            Write-Host "[!] MALICIOUS FILE DETECTED: $($_.Path)" -ForegroundColor Red
            Write-Host "    Hash: $($_.Hash)"
        }
    }
}

Write-Host "[+] Hunt complete." -ForegroundColor Green


# Response Priorities

*   **Immediate:** Block all domains listed in the IOC Analysis section at the perimeter firewall and proxy. Isolate endpoints exhibiting connections to `45.207.216.55` or `servequake.com`.
*   **24h:** Conduct a credential audit for users who may have interacted with the phishing emails (shortened URLs/GitHub links). Reset credentials for accounts accessed from endpoints identified as infected.
*   **1 week:** Patch all instances of Langflow to address CVE-2026-55255 and CVE-2026-33017. Review GitHub access logs and implement stricter policies for the use of GitHub Releases in internal software deployment pipelines.