title: Suspicious LuaJIT Execution - Potential Infostealer
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
description: Detects the execution of LuaJIT processes often associated with TroyDen campaigns distributing Redline and LummaStealer.
status: experimental
date: 2026/05/12
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6654321...
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\luajit.exe'
            - '\lua51.exe'
            - '\lua52.exe'
        CommandLine|contains:
            - '-e'
            - 'load'
    condition: selection
falsepositives:
    - Legitimate developer tools using LuaJIT
level: high
---
title: File Extension Masquerading via AutoIt
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
description: Detects suspicious file execution where .dot or .doc files are executed as .bat or scripts, a technique used by Vidar loaders.
status: experimental
date: 2026/05/12
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6654322...
tags:
    - attack.defense_evasion
    - attack.t1036.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
        CommandLine|contains:
            - '.dot'
            - '.doc'
        CommandLine|endswith:
            - '.bat'
            - '.vbs'
    condition: selection
falsepositives:
    - Administrative script errors
level: medium
---
title: Potential EtherHiding or Blockchain C2 Traffic
id: c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f
description: Detects processes making outbound connections to Ethereum RPC ports or known public nodes, indicative of EtherRAT activity.
status: experimental
date: 2026/05/12
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6654323...
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 8545
            - 30303
        Initiated: 'true'
    filter:
        Image|contains:
            - '\Ethereum\'
            - '\MetaMask\'
    condition: selection and not filter
falsepositives:
    - Legitimate Ethereum wallet software
level: high


kql
// Hunt for Indicators of Compromise (IOCs) related to May 2026 Pulses
// Includes Network connections and File hashes
let IOCIps = dynamic(["89.169.12.241", "213.176.73.80", "213.176.73.130", "217.119.129.121", "217.119.129.76", "94.156.154.6", "213.176.73.159", "217.119.129.118"]);
let IOCDomains = dynamic(["dns-providersa2.com", "git.justdotrip.com", "g8way.io", "witch-skins-lip-coal.trycloudflare.com", "gz.technicalprorj.xyz", "wrned.com", "wpsock.com"]);
let IOCHashes = dynamic(["efb675de4b3af3dac3c9cae91075fd7cc2f4f98e", "019e6c2cf58386039133981f3377b085fbd70c98ae8613c7c6a4f10a9f2d9824", "73ce2438d4ed475e03727b7b000d2794", "7ac9278876c83c9b597fae68acb6fbf9", "02a5990b11293236e01f174f5999df20"]);
// Network Hunt
DeviceNetworkEvents
| where RemoteIP in (IOCIps) or RemoteUrl has_any (IOCDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort
| union (
    DeviceProcessEvents
    | where SHA1 in~ (IOCHashes) or SHA256 in~ (IOCHashes) or MD5 in~ (IOCHashes)
    | project Timestamp, DeviceName, AccountName, FileName, SHA1, SHA256, MD5, FolderPath
)


powershell
# IOC Hunter for Lumma/Vidar/TroyDen Artifacts
# Checks for suspicious processes and file modifications

$suspiciousHashes = @(
    "efb675de4b3af3dac3c9cae91075fd7cc2f4f98e",
    "019e6c2cf58386039133981f3377b085fbd70c98ae8613c7c6a4f10a9f2d9824",
    "73ce2438d4ed475e03727b7b000d2794"
)

$suspiciousIPs = @(
    "89.169.12.241",
    "213.176.73.80",
    "217.119.129.76"
)

Write-Host "Checking for established network connections to known C2 IPs..."
$netConnections = Get-NetTCPConnection -State Established | Where-Object { $suspiciousIPs -contains $_.RemoteAddress }
if ($netConnections) {
    Write-Warning "[ALERT] Found connection to malicious IP:"
    $netConnections | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess -AutoSize
} else {
    Write-Host "No suspicious connections found."
}

Write-Host "\nScanning for processes matching known malicious hashes..."
$processes = Get-Process | Where-Object { $_.Path -ne $null }
foreach ($proc in $processes) {
    $fileHash = (Get-FileHash -Path $proc.Path -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($suspiciousHashes -contains $fileHash) {
        Write-Warning "[ALERT] Malicious process detected: $($proc.ProcessName) ($($proc.Id))"
    }
}

Write-Host "\nChecking for suspicious startup registry keys..."
$regPaths = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($path in $regPaths) {
    if (Test-Path $path) {
        Get-ItemProperty $path | Where-Object { $_.PSObject.Properties.Name -match "LuaJIT|AutoIt3|MicrosoftToolkit" } | Format-List
    }
}


# Response Priorities