LLMJacking UNC6993 + AI Phishing Ops: OTX Pulse Analysis — Credential Theft Detection Pack

---
title: LLMJacking Credential Access via Cloud Configuration Files
id: 7a3b9c2d-8e4f-4a1b-9c3d-5e6f7a8b9c0d
status: experimental
description: Detects access to cloud provider credential files consistent with LLMJacking operations targeting AI API keys and cloud service accounts
author: Security Arsenal Threat Intelligence
date: 2026/11/03
modified: 2026/11/03
tags:
    - attack.credential_access
    - attack.t1552
    - attack.t1552.001
logsource:
    category: file_access
    product: windows
    definition: 'Requires Sysmon or similar file access auditing'
detection:
    selection_paths:
        TargetFilename|contains:
            - '\.aws\credentials'
            - '\.azure\'
            - '\.config\gcloud\'
            - '\.kube\config'
            - '\.docker\config.json'
    selection_process:
        Image|endswith:
            - '\python.exe'
            - '\python3.exe'
            - '\bun.exe'
            - '\java.exe'
            - '\node.exe'
            - '\powershell.exe'
            - '\cmd.exe'
    condition: selection_paths and selection_process
falsepositives:
    - DevOps automation scripts accessing cloud credentials
    - Cloud SDK installations
level: high
---
title: PetitPotam NTLM Relay and AD CS Exploitation
id: 8b4c0d3e-9f5a-5b2c-0d4e-6f7a8b9c0d1e
status: experimental
description: Detects PetitPotam-style NTLM coercion and AD Certificate Services exploitation attempts observed in Teams AD hijacking campaigns
author: Security Arsenal Threat Intelligence
date: 2026/11/03
modified: 2026/11/03
tags:
    - attack.credential_access
    - attack.t1187
    - attack.t1557
    - attack.t1649
logsource:
    category: network_connection
    product: windows
detection:
    selection_rpc:
        Image|endswith: '\lsass.exe'
        DestinationPort: 445
        Initiated: 'true'
    selection_cert:
        Image|endswith:
            - '\certreq.exe'
            - '\certutil.exe'
        CommandLine|contains:
            - 'config'
            - 'template'
    selection_suspicious:
        Image|endswith:
            - '\python.exe'
            - '\bun.exe'
        CommandLine|contains:
            - 'petitpotam'
            - 'ntlmrelayx'
            - 'esc1'
            - 'esc8'
    condition: 1 of selection_*
falsepositives:
    - Administrative certificate management
    - Vulnerability scanning
level: critical
---
title: Quick Assist Execution Followed by Portable Runtime Deployment
id: 9c5d1e4f-0a6b-6c3d-1e5f-7a8b9c0d1e2f
status: experimental
description: Detects Quick Assist remote assistance sessions followed by execution of portable runtimes used in Teams AD hijacking campaigns
author: Security Arsenal Threat Intelligence
date: 2026/11/03
modified: 2026/11/03
tags:
    - attack.execution
    - attack.t1059
    - attack.t1218
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_quickassist:
        Image|endswith: '\quickassist.exe'
    selection_runtime:
        Image|endswith:
            - '\python.exe'
            - '\python3.exe'
            - '\bun.exe'
            - '\java.exe'
            - '\node.exe'
        ParentImage|endswith: '\quickassist.exe'
    selection_suspicious_path:
        Image|startswith:
            - 'C:\Users\Public\'
            - 'C:\Windows\Temp\'
            - 'C:\ProgramData\'
            - '%TEMP%'
            - '%APPDATA%'
    condition: selection_quickassist or (selection_runtime and selection_suspicious_path)
falsepositives:
    - Legitimate IT support using Quick Assist
    - Developer tools execution
level: high

// LLMJacking and Credential Theft Hunt - Security Arsenal
// Run with 7-day lookback minimum
let LLMC2Domains = dynamic(["jet-night.com", "newapi.pro", "artex.nhhh.de", "direct.465415.xyz"]);
let PhishDomains = dynamic(["authgpt.info", "ai-billing.info", "url-y.uk"]);
let SuspiciousIPs = dynamic(["31.57.201.201", "38.246.114.118"]);
let SuspiciousHashes = dynamic([
    "06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7",
    "85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17",
    "f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001",
    "6c1cfc02b4d1e31bf9bbdb0693340c94",
    "7151dc47580618f3b4b3c2254ded341c",
    "e24244445fd3686fcd49e35a78fb921e",
    "291db418fb4a6d24c797dc870d5a1cec9a00c0bc",
    "6c4be1f10290e994d926f1270aaf34a6fd3c6ad3"
]);
union isfuzzy=true
    (
    DeviceNetworkEvents
    | where RemoteUrl has_any (LLMC2Domains) or RemoteUrl has_any (PhishDomains) or RemoteIP in (SuspiciousIPs)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
    | extend HuntType = "NetworkIOC"
    ),
    (
    DeviceProcessEvents
    | where SHA256 in (SuspiciousHashes) or MD5 in (SuspiciousHashes) or SHA1 in (SuspiciousHashes)
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, SHA256, MD5, SHA1, InitiatingProcessFileName
    | extend HuntType = "FileHashIOC"
    ),
    (
    DeviceProcessEvents
    | where FileName in~ ("python.exe", "python3.exe", "bun.exe", "java.exe", "node.exe")
    | where ProcessCommandLine has_any ("petitpotam", "ntlmrelayx", "secretsdump", "dcsync", "esc1", "esc8")
       or ProcessCommandLine has_any ("rclone", "copy", "move") and ProcessCommandLine has_any ("config", "remote")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend HuntType = "ADAttackTooling"
    ),
    (
    DeviceProcessEvents
    | where InitiatingProcessFileName =~ "quickassist.exe"
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend HuntType = "QuickAssistAbuse"
    ),
    (
    SecurityEvent
    | where EventID == 4768 or EventID == 4769
    | where TargetUserName contains "krbtgt" or ServiceName contains "krbtgt"
    | where IpAddress in (SuspiciousIPs) or WorkstationName has_any (LLMC2Domains)
    | project Timestamp, Computer, TargetUserName, ServiceName, IpAddress, WorkstationName
    | extend HuntType = "DCSyncIndicator"
    )
| sort by Timestamp desc

#Requires -RunAsAdministrator
# Security Arsenal - LLMJacking & Credential Theft IOC Hunt
# Run on suspected compromised endpoints and domain controllers

param(
    [Parameter(Mandatory=$false)]
    [int]$DaysBack = 7,
    [Parameter(Mandatory=$false)]
    [switch]$ExportCSV
)

$ErrorActionPreference = 'SilentlyContinue'
$StartDate = (Get-Date).AddDays(-$DaysBack)
$Results = @()

Write-Host "[+] Security Arsenal IOC Hunt - $(Get-Date)" -ForegroundColor Cyan
Write-Host "[+] Hunting for LLMJacking, Phishing, and AD Compromise Indicators`n" -ForegroundColor Cyan

# Network IOCs
$SuspiciousDomains = @("jet-night.com", "newapi.pro", "authgpt.info", "ai-billing.info", "url-y.uk", "artex.nhhh.de", "direct.465415.xyz")
$SuspiciousIPs = @("31.57.201.201", "38.246.114.118")
$SuspiciousHashes = @(
    "06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7",
    "85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17",
    "f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001",
    "6c1cfc02b4d1e31bf9bbdb0693340c94",
    "7151dc47580618f3b4b3c2254ded341c",
    "e24244445fd3686fcd49e35a78fb921e"
)

# Check DNS Cache for malicious domains
Write-Host "[*] Checking DNS Cache..." -ForegroundColor Yellow
$DNSCache = Get-DnsClientCache | Where-Object { $_.Entry -match ($SuspiciousDomains -join '|') }
if ($DNSCache) {
    foreach ($Entry in $DNSCache) {
        $Results += [PSCustomObject]@{
            Type = "DNSCache"
            Indicator = $Entry.Entry
            Data = $Entry.Data
            Time = "N/A"
            Risk = "HIGH"
        }
        Write-Host "[!] DNS Cache Hit: $($Entry.Entry)" -ForegroundColor Red
    }
}

# Check active network connections
Write-Host "[*] Checking Active Network Connections..." -ForegroundColor Yellow
$Connections = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -in $SuspiciousIPs -or ($_.RemoteAddress -ne "0.0.0.0" -and $_.RemoteAddress -ne "::" -and $_.State -eq "Established") }
foreach ($Conn in $Connections) {
    $Process = Get-Process -Id $Conn.OwningProcess
    $DNS = Resolve-DnsName -Name $Conn.RemoteAddress -ErrorAction SilentlyContinue
    if ($Conn.RemoteAddress -in $SuspiciousIPs -or $DNS.NameHost -match ($SuspiciousDomains -join '|')) {
        $Results += [PSCustomObject]@{
            Type = "NetworkConnection"
            Indicator = $Conn.RemoteAddress
            Data = "$($Process.ProcessName) (PID: $($Conn.OwningProcess)) -> $($Conn.RemoteAddress):$($Conn.RemotePort)"
            Time = "Active"
            Risk = "CRITICAL"
        }
        Write-Host "[!] Suspicious Connection: $($Process.ProcessName) -> $($Conn.RemoteAddress)" -ForegroundColor Red
    }
}

# Check file system for suspicious hashes and cloud credential access
Write-Host "[*] Checking File System..." -ForegroundColor Yellow
$SearchPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "C:\Users\Public", "C:\Windows\Temp")
foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
            if ($Hash.Hash -in $SuspiciousHashes) {
                $Results += [PSCustomObject]@{
                    Type = "MaliciousFile"
                    Indicator = $Hash.Hash
                    Data = $_.FullName
                    Time = $_.LastWriteTime
                    Risk = "CRITICAL"
                }
                Write-Host "[!] Malicious File Found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# Check for cloud credential file access (LLMJacking indicator)
$CloudCredPaths = @(
    "$env:USERPROFILE\.aws\credentials",
    "$env:USERPROFILE\.azure\",
    "$env:USERPROFILE\.config\gcloud\",
    "$env:USERPROFILE\.kube\config"
)
foreach ($CredPath in $CloudCredPaths) {
    if (Test-Path $CredPath) {
        $RecentAccess = Get-ChildItem -Path $CredPath -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastAccessTime -gt $StartDate }
        if ($RecentAccess) {
            foreach ($File in $RecentAccess) {
                $Results += [PSCustomObject]@{
                    Type = "CloudCredentialAccess"
                    Indicator = $File.FullName
                    Data = "Last Access: $($File.LastAccessTime)"
                    Time = $File.LastAccessTime
                    Risk = "HIGH"
                }
            }
        }
    }
}

# Check for Quick Assist execution and suspicious child processes
Write-Host "[*] Checking Quick Assist Execution..." -ForegroundColor Yellow
$QuickAssistEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$StartDate} -ErrorAction SilentlyContinue | 
    Where-Object { $_.Message -match "quickassist.exe" }
foreach ($Event in $QuickAssistEvents) {
    $Results += [PSCustomObject]@{
        Type = "QuickAssistExecution"
        Indicator = "quickassist.exe"
        Data = $Event.Message.Substring(0, [Math]::Min(200, $Event.Message.Length))
        Time = $Event.TimeCreated
        Risk = "MEDIUM"
    }
}

# Check for portable runtime execution
$RuntimeEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=$StartDate} -ErrorAction SilentlyContinue | 
    Where-Object { $_.Message -match "python.exe|bun.exe|java.exe|node.exe" -and $_.Message -match "Temp|Public|AppData" }
foreach ($Event in $RuntimeEvents) {
    $Results += [PSCustomObject]@{
        Type = "PortableRuntime"
        Indicator = "python/bun/java/node"
        Data = $Event.Message.Substring(0, [Math]::Min(200, $Event.Message.Length))
        Time = $Event.TimeCreated
        Risk = "HIGH"
    }
}

# Check for certificate service abuse (ESC1/ESC8)
Write-Host "[*] Checking Certificate Service Events..." -ForegroundColor Yellow
$CertEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4886,4887,4888; StartTime=$StartDate} -ErrorAction SilentlyContinue
foreach ($Event in $CertEvents) {
    if ($Event.Message -match "template" -and ($Event.Message -match "client authentication" -or $Event.Message -match "domain controller")) {
        $Results += [PSCustomObject]@{
            Type = "CertificateAbuse"
            Indicator = "ADCS"
            Data = $Event.Message.Substring(0, [Math]::Min(300, $Event.Message.Length))
            Time = $Event.TimeCreated
            Risk = "CRITICAL"
        }
    }
}

# Check scheduled tasks for persistence
Write-Host "[*] Checking Scheduled Tasks..." -ForegroundColor Yellow
$SuspiciousTasks = Get-ScheduledTask | Where-Object { $_.TaskPath -notmatch "Microsoft" -and ($_.Actions.Execute -match "python|bun|java|node|powershell" -or $_.Actions.Arguments -match "http|https") }
foreach ($Task in $SuspiciousTasks) {
    $Results += [PSCustomObject]@{
        Type = "ScheduledTask"
        Indicator = $Task.TaskName
        Data = "$($Task.Actions.Execute) $($Task.Actions.Arguments)"
        Time = "Persistent"
        Risk = "HIGH"
    }
}

# Summary and Export
Write-Host "`n[+] Hunt Complete. Findings: $($Results.Count)" -ForegroundColor Cyan
$Results | Sort-Object Risk, Time | Format-Table -AutoSize

if ($ExportCSV -and $Results.Count -gt 0) {
    $ExportPath = "$env:USERPROFILE\Desktop\IOC_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
    $Results | Export-Csv -Path $ExportPath -NoTypeInformation
    Write-Host "[+] Results exported to: $ExportPath" -ForegroundColor Green
}

if ($Results.Count -eq 0) {
    Write-Host "[+] No IOCs detected. Continue monitoring." -ForegroundColor Green
}