Knight Office M365 AiTM Kit + Tampered Exodus Modular RAT: OTX Pulse Analysis — Session Token Theft and Credential Access Detection Pack

---
title: Knight Office AiTM M365 Session Token Theft and Device Registration
id: 9f1d2a0b-6d7e-4c4a-9a2f-knight-office-aitm
status: experimental
description: Detects identity-side artifacts consistent with M365 AiTM phishing, token replay, suspicious OAuth consent, or device registration after phishing-lure exposure.
author: Security Arsenal
date: 2026/09/03
references:
  - https://www.huntress.com/blog/inside-knight-office-m365-aitm-attack
logsource:
  product: azure
  service: signinlogs
  definition: Requires Microsoft Entra ID sign-in, audit, and risk events forwarded to SIEM.
detection:
  selection_domain:
    DestinationHostname|contains:
      - '.vu'
      - 'monday.com'
      - 'joomla'
  selection_signin:
    - RiskEventTypes_v2|contains:
        - 'anonymizedIPAddress'
        - 'unfamiliarFeatures'
        - 'unlikelyTravel'
    - AuthenticationRequirement: 'multiFactorAuthentication'
    - Status: 'Success'
  selection_audit:
    OperationName|contains:
      - 'Add OAuth2PermissionGrant'
      - 'Consent to application'
      - 'Add device'
      - 'Register device'
      - 'Add registered owner to device'
      - 'Update device'
  condition: selection_signin and (selection_audit or selection_domain)
falsepositives:
  - Administrators registering compliant devices during onboarding.
  - Legitimate OAuth grants to approved enterprise apps.
level: high
tags:
  - attack.t1557
  - attack.t1528
  - attack.t1539
  - attack.t1078.004
---
title: Tampered Exodus Installer JavaScript Dropper and MSI Staging
id: 7b4c9e21-8a66-4f1b-b6f2-exodus-tampered-msi
status: experimental
description: Detects JavaScript-launched MSI installs and suspicious Exodus wallet process trees consistent with a tampered cryptocurrency wallet installer deploying modular RAT components.
author: Security Arsenal
date: 2026/09/03
references:
  - https://www.huntress.com/blog/exodus-crypto-wallet-installer-rat
logsource:
  category: process_creation
  product: windows
  definition: Sysmon Event ID 1 or Windows Security Event ID 4688 with command line auditing.
detection:
  selection_js_dropper:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
    Image|endswith:
      - '\msiexec.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  selection_exodus:
    Image|contains:
      - '\Exodus'
      - '\exodus.exe'
    CommandLine|contains:
      - 'Exodus'
      - '24.33.4'
  selection_msi:
    Image|endswith: '\msiexec.exe'
    CommandLine|contains:
      - '/i'
      - 'http'
      - '.msi'
      - 'Temp'
      - 'AppData'
  selection_module_names:
    CommandLine|contains:
      - 'Dll4_cmd'
      - 'Dll4_fileman'
      - 'Dll4_browser'
      - 'Dll4_socks'
      - 'Dll4_vnc'
      - 'Dll4_script'
  condition: (selection_js_dropper and selection_msi) or (selection_exodus and selection_module_names) or (selection_js_dropper and selection_exodus)
falsepositives:
  - Managed software deployment of Exodus in approved crypto labs.
  - Enterprise MSI installs using JavaScript wrappers.
level: high
tags:
  - attack.t1059.007
  - attack.t1218
  - attack.t1102.002
  - attack.t1555.003
---
title: Suspicious Azure Table Storage or SOCKS/VNC Beacon From Endpoint
id: 3c7a1d55-90ab-4e2f-9c44-azure-socks-vnc-rat
status: experimental
description: Detects endpoints making unusual connections to Azure Table Storage endpoints or exposing local SOCKS/VNC listeners after installer or browser credential-theft activity.
author: Security Arsenal
date: 2026/09/03
logsource:
  category: network_connection
  product: windows
  definition: Sysmon Event ID 3 and process creation correlation.
detection:
  selection_azure_table:
    DestinationHostname|contains:
      - '.table.core.windows.net'
      - 'azconfig.io'
      - '.blob.core.windows.net'
    Image|endswith:
      - '\exodus.exe'
      - '\rundll32.exe'
      - '\dllhost.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cmd.exe'
  selection_proxy_vnc:
    DestinationPort:
      - 1080
      - 5900
      - 5901
      - 3389
    Image|endswith:
      - '\exodus.exe'
      - '\rundll32.exe'
      - '\dllhost.exe'
      - '\powershell.exe'
  condition: selection_azure_table or selection_proxy_vnc
falsepositives:
  - Legitimate Azure applications using Table Storage.
  - Approved VNC/remote support tools with signed binaries and known service accounts.
level: medium
tags:
  - attack.t1102.002
  - attack.t1090
  - attack.t1021.005

let Lookback = 14d;
let BadDomains = dynamic([
  "kleepxrnlinecorporation.vu","advancedplacyncement.vu","amstardmzsmc.vu","arandasoftzfdware.vu",
  "avisoretentiunionllc.vu","capitalflwxinancialpartners.vu","certififiycationedge.vu","connectivnqzityltd.vu","us05.org"
]);
let BadHashes = dynamic([
  "2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d",
  "5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603",
  "5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a",
  "7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8",
  "84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756",
  "8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a",
  "c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485"
]);
let Net =
DeviceNetworkEvents
| where TimeGenerated >= ago(Lookback)
| where RemoteUrl has_any (BadDomains) or RemoteIP in ()
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType;
let Proc =
DeviceProcessEvents
| where TimeGenerated >= ago(Lookback)
| where SHA256 in~ (BadHashes)
   or ProcessCommandLine has_any ("Dll4_cmd","Dll4_fileman","Dll4_browser","Dll4_socks","Dll4_vnc","Dll4_script","Exodus","24.33.4","table.core.windows.net")
   or (InitiatingProcessFileName in~ ("wscript.exe","cscript.exe","mshta.exe","rundll32.exe") and FileName in~ ("msiexec.exe","powershell.exe","cmd.exe"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine;
union Net, Proc
| sort by TimeGenerated desc

$ErrorActionPreference = 'SilentlyContinue'
$BadDomains = @(
 'kleepxrnlinecorporation.vu','advancedplacyncement.vu','amstardmzsmc.vu','arandasoftzfdware.vu',
 'avisoretentiunionllc.vu','capitalflwxinancialpartners.vu','certififiycationedge.vu','connectivnqzityltd.vu','us05.org'
)
$BadHashes = @(
 '2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d',
 '5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603',
 '5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a',
 '7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8',
 '84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756',
 '8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a',
 'c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485'
)
$findings = @()

# 1) DNS cache / client artifacts for phishing and C2 domains
$dns = Get-DnsClientCache | Where-Object { $n=$_.Name.ToLower(); $BadDomains | ForEach-Object { $n -like "*$_*" } }
if ($dns) { $findings += $dns | Select-Object @{n='Type';e={'DNSCache'}}, Name, Entry, Data, TimeToLive }

# 2) Running processes and loaded modules for Exodus/Dll4 artifacts
$procs = Get-CimInstance Win32_Process | Where-Object {
  ($_.Name -match 'exodus|msiexec|wscript|cscript|mshta|rundll32|powershell') -or
  ($_.CommandLine -match 'Dll4_cmd|Dll4_fileman|Dll4_browser|Dll4_socks|Dll4_vnc|Dll4_script|table.core.windows.net|Exodus|24\.33\.4')
}
foreach ($p in $procs) {
  $path = $p.ExecutablePath
  $sha = if ($path -and (Test-Path $path)) { (Get-FileHash $path -Algorithm SHA256).Hash.ToLower() } else { $null }
  if ($BadHashes -contains $sha -or $p.CommandLine -match 'Dll4_|table.core.windows.net|Exodus') {
    $findings += [pscustomobject]@{ Type='Process'; Name=$p.Name; PID=$p.ProcessId; Path=$path; SHA256=$sha; CommandLine=$p.CommandLine }
  }
}

# 3) Persistence locations: Run keys, services, scheduled tasks mentioning Exodus or modules
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
  Get-ItemProperty $k | ForEach-Object {
    $_.PSObject.Properties | Where-Object { $_.Value -match 'Exodus|Dll4_|msiexec|wscript|cscript|table.core.windows.net' } | ForEach-Object {
      $findings += [pscustomobject]@{ Type='RunKey'; Name=$_.Name; Path=$k; SHA256=''; CommandLine=($_.Value | Out-String) }
    }
  }
}
Get-ScheduledTask | Where-Object { ($_.Actions.Execute -match 'exodus|wscript|cscript|mshta|msiexec|powershell') -or ($_.Actions.Arguments -match 'Dll4_|table.core.windows.net|Exodus') } | ForEach-Object {
  $findings += [pscustomobject]@{ Type='ScheduledTask'; Name=$_.TaskName; Path=$_.TaskPath; SHA256=''; CommandLine=($_.Actions | Out-String) }
}

# 4) Network listeners for SOCKS/VNC and Azure endpoint connections
Get-NetTCPConnection -State Listen,Established | Where-Object { $_.LocalPort -in 1080,5900,5901,3389 -or $_.RemotePort -in 443,1080,5900 } | ForEach-Object {
  $proc = Get-Process -Id $_.OwningProcess
  if ($proc.ProcessName -match 'exodus|rundll32|dllhost|powershell|wscript|cmd') {
    $findings += [pscustomobject]@{ Type='Network'; Name=$proc.ProcessName; PID=$_.OwningProcess; Path=$proc.Path; SHA256=''; CommandLine="$($_.LocalAddress):$($_.LocalPort)->$($_.RemoteAddress):$($_.RemotePort) $($_.State)" }
  }
}

$findings | Sort-Object Type, TimeGenerated -ErrorAction SilentlyContinue | Format-List
if ($findings.Count -gt 0) { $findings | Export-Csv -NoTypeInformation -Path "$env:TEMP\otx_knight_exodus_hunt.csv" }