LLMjacking (UNC6993) + Kimsuky 'Operation GitPower': Dual OTX Pulse Analysis — Cloud API Key Theft and GitHub-Abuse Espionage Detection Pack

---
title: LLMjacking - Cloud Credential Access Followed by LLM API Egress
id: 8f3a2c1e-9b4d-4e7a-a1c2-llmjack00001
status: experimental
description: Detects processes reading cloud credential stores followed by egress to known LLMjacking proxy infrastructure associated with UNC6993.
author: Security Arsenal
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname:
            - jet-night.com
            - newapi.pro
    selection_port:
        DestinationPort:
            - 443
            - 8443
    condition: selection_domain and selection_port
falsepositives:
    - Legitimate API relay services (validate against sanctioned vendor list)
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.credential_access
---
title: Kimsuky GitPower - CHM or LNK Spawning PowerShell
id: 7d2b1a9f-4c3e-4f8b-b2d1-gitpower0002
status: experimental
description: Detects hh.exe (CHM) or explorer-launched LNK files spawning PowerShell, consistent with Kimsuky Operation GitPower spear phishing delivery.
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\hh.exe'
            - '\explorer.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cmd:
        CommandLine|contains:
            - 'DownloadString'
            - 'IEX'
            - 'Invoke-Expression'
            - 'github.com'
            - 'raw.githubusercontent.com'
            - 'FromBase64String'
    condition: selection_parent and selection_child and selection_cmd
falsepositives:
    - Software deployment via help files is rare; validate developer workstation activity
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204.002
    - attack.phishing
    - attack.t1566.001
---
title: Kimsuky GitPower - Dynamic DNS Staging Communication
id: 3e9c5d7b-1a2f-4e6c-c3e2-gitpower0003
status: experimental
description: Detects DNS resolution of dynamic-DNS hostnames used by Kimsuky for Operation GitPower C2 staging.
author: Security Arsenal
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - '.mywebcommunity.org'
            - '.mygamesonline.org'
            - '.getenjoyment.net'
            - '.sportsontheweb.net'
            - '.medianewsonline.com'
    condition: selection
falsepositives:
    - Rare in enterprise environments; consumer DDNS usage should be investigated regardless
level: medium
tags:
    - attack.command_and_control
    - attack.t1071.004
    - attack.t1568.002

// Kimsuky GitPower + UNC6993 LLMjacking unified hunt — Microsoft Sentinel
let DdnsZones = dynamic(["mywebcommunity.org","mygamesonline.org","getenjoyment.net","sportsontheweb.net","medianewsonline.com"]);
let LlmjackDomains = dynamic(["jet-night.com","newapi.pro"]);
let KimsukyHashes = dynamic(["297292d46d4f11fc801f5d6d01251735698a8419aa3196db7b3aa7bb8ea85cad","d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (DdnsZones) or RemoteUrl has_any (LlmjackDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
    | extend HuntType = "NetworkIOC"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where (InitiatingProcessFileName =~ "hh.exe" and FileName in~ ("powershell.exe","pwsh.exe"))
       or (ProcessCommandLine has_any ("raw.githubusercontent.com","DownloadString","FromBase64String") and FileName has "powershell")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
    | extend HuntType = "GitPowerExecution"),
    (DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where SHA256 has_any (KimsukyHashes)
    | project TimeGenerated, DeviceName, FolderPath, FileName, SHA256
    | extend HuntType = "HashMatch")
| sort by TimeGenerated desc

# Security Arsenal — GitPower / LLMjacking IOC Hunt Script
# Run elevated on endpoints or deploy via Intune/SCCM. Outputs findings to CSV.

$findings = @()

# 1. Hunt Kimsuky payload hashes across common staging paths
$targetHashes = @(
    "297292d46d4f11fc801f5d6d01251735698a8419aa3196db7b3aa7bb8ea85cad",
    "d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a"
)
$searchPaths = @("$env:TEMP", "$env:USERPROFILE\Downloads", "C:\Users\Public", "$env:APPDATA")
foreach ($path in $searchPaths) {
    Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue |
        Where-Object { $_.Length -lt 50MB } |
        ForEach-Object {
            $h = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($targetHashes -contains $h) {
                $findings += [PSCustomObject]@{Type="HashMatch"; Path=$_.FullName; Detail=$h}
            }
        }
}

# 2. Check recent LNK files in recent-items & startup (Kimsuky persistence vector)
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Recent" -Filter *.lnk -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    ForEach-Object { $findings += [PSCustomObject]@{Type="RecentLNK"; Path=$_.FullName; Detail=$_.LastWriteTime} }

# 3. Network connections to DDNS / LLMjacking infrastructure
$suspicious = "mywebcommunity.org","mygamesonline.org","getenjoyment.net","sportsontheweb.net","medianewsonline.com","jet-night.com","newapi.pro"
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $rdns = (Resolve-DnsName -Name $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost
    foreach ($s in $suspicious) {
        if ($rdns -like "*$s*") {
            $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
            $findings += [PSCustomObject]@{Type="C2Connection"; Path=$proc.Path; Detail="$($_.RemoteAddress) -> $rdns"}
        }
    }
}

# 4. Cloud credential file access artifacts (LLMjacking staging)
$credPaths = @("$env:USERPROFILE\.aws\credentials", "$env:USERPROFILE\.azure", "$env:USERPROFILE\.config\gcloud")
foreach ($cp in $credPaths) {
    if (Test-Path $cp) {
        $item = Get-Item $cp -ErrorAction SilentlyContinue
        if ($item.LastAccessTime -gt (Get-Date).AddDays(-7) -and $item.LastAccessTime -gt $item.LastWriteTime) {
            $findings += [PSCustomObject]@{Type="CredAccess"; Path=$cp; Detail="Accessed $($item.LastAccessTime) after last write $($item.LastWriteTime)"}
        }
    }
}

# 5. Scheduled tasks with PowerShell/GitHub references (persistence)
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match "powershell|github|hh.exe") {
        $findings += [PSCustomObject]@{Type="SuspiciousTask"; Path=$_.TaskName; Detail=$actions.Trim()}
    }
}

$findings | Export-Csv -Path "C:\Intel_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "[+] Hunt complete. $($findings.Count) findings." -ForegroundColor Cyan
$findings | Format-Table -AutoSize