MadApe Device Code Phishing Kit + njRAT QuickBooks Scam + Star Blizzard APT: OTX Credential-Theft Intelligence Bulletin — Enterprise Detection Pack

---
title: Microsoft Device Code Phishing - MadApe Kit Token Request
description: Detects device authorization grant initiation and token polling patterns consistent with the MadApe phishing kit abusing the Microsoft Device Code flow.
status: experimental
date: 2026/10/30
author: Security Arsenal Threat Intelligence
logsource:
    product: azure
    service: signinlogs
detection:
    selection_flow:
        AuthenticationProtocol: 'deviceCode'
    selection_risk:
        - 'new country'
        - 'anonymous IP'
        - 'unfamiliar sign-in properties'
    condition: selection_flow and 1 of selection_risk
falsepositives:
    - Legitimate device code flows on TVs, IoT, CLI tooling from expected geographies
level: high
tags:
    - attack.credential_access
    - attack.t1528
    - attack.t1550.001
---
title: njRAT / Bladabindi Registry Run Key Persistence
description: Detects .NET RAT persistence via registry Run keys with suspicious value names or paths consistent with njRAT, Njw0rm, and DarkKometa deployments observed in the QuickBooks scam cluster.
status: experimental
date: 2026/10/30
author: Security Arsenal Threat Intelligence
logsource:
    category: registry_set
    product: windows
detection:
    selection_key:
        TargetObject|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Run'
            - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
    selection_suspicious:
        TargetObject|contains:
            - '\Temp\'
            - '\AppData\Roaming\'
            - '\Public\'
        Details|endswith:
            - '.exe'
            - '.vbs'
            - '.ps1'
    filter_known:
        Image|startswith:
            - 'C:\Program Files'
            - 'C:\Windows'
    condition: selection_key and selection_suspicious and not filter_known
falsepositives:
    - Software updaters writing to Run keys from user-writable paths (rare, investigate)
level: high
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.execution
    - attack.t1059
---
title: ESXi Ransomware Execution - Aurora ChaCha20 Encryptor Behavior
description: Detects mass VM termination and datastore encryption patterns on ESXi hosts consistent with Aurora ransomware Linux variant.
status: experimental
date: 2026/10/30
author: Security Arsenal Threat Intelligence
logsource:
    product: linux
    service: auditd
detection:
    selection_vmkill:
        a0:
            - 'esxcli'
            - 'vim-cmd'
        a2|contains:
            - 'vm process kill'
            - 'vmsvc/power.off'
    selection_rename:
        a0:
            - 'mv'
            - 'openssl'
            - 'chacha'
    timeframe: 5m
    condition: selection_vmkill or selection_rename
falsepositives:
    - Legitimate VM power operations by virtualization administrators
level: critical
tags:
    - attack.impact
    - attack.t1486
    - attack.t1489

// Security Arsenal - MadApe / njRAT / Star Blizzard / PHP2Shell IOC + Behavior Hunt
// Run across Microsoft Sentinel workspace

let PhishDomains = dynamic(["sucdens.com","cepoffices.com","zakosta.info","nsboards.com","adastraerrans.com","travestiilan.com","nysndigital.com","powerlivings.com","qbcares.com","chanret.com","captchanom.top","preentootmist.org","swp23.com"]);
let BadIPs = dynamic(["96.126.130.81","146.19.125.36","81.177.215.15","89.106.83.49","157.173.29.133","103.245.231.248"]);
let BadHashes = dynamic(["28f046d9f985e58cbc8b245b54d4179feacecc12f41e2f6594306867ce3e8727","9e1a679ca45a149d2bd681cbb8ec3b1cc3d271fad51b092a3db5e5642eb6676b","a4af136d159a8eb96b54924fa80355ca52874913301300f55af7d67ae97edcfe","87138f63974a8ccbbf5840c31165f1a4bf92a954bacccfbf1e7e5525d750aa48"]);
union isfuzzy=true
(DeviceNetworkEvents
 | where TimeGenerated > ago(14d)
 | where RemoteUrl has_any (PhishDomains) or RemoteIP in (BadIPs)
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, ActionType),
(DeviceProcessEvents
 | where TimeGenerated > ago(14d)
 | where SHA256 in (BadHashes)
 | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessCommandLine),
(DeviceRegistryEvents
 | where TimeGenerated > ago(14d)
 | where RegistryKey has_any (@"CurrentVersion\Run", @"CurrentVersion\RunOnce")
 | where RegistryValueData has_any (@"\Temp\", @"\AppData\Roaming\", @"\Public\")
 | where RegistryValueData endswith ".exe" or RegistryValueData endswith ".ps1" or RegistryValueData endswith ".vbs"
 | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName),
(AADSignInEventsBeta
 | where TimeGenerated > ago(14d)
 | where AuthenticationProtocol == "deviceCode"
 | where RiskLevelDuringSignIn in ("high","medium") or Country !in ("US","IL")  // tune to tenant baseline
 | project TimeGenerated, UserPrincipalName, IPAddress, Country, ApplicationDisplayName, RiskLevelDuringSignIn)

# Security Arsenal - Credential-Theft IOC Hunt (njRAT / MadApe / PHP2Shell pivots)
# Run as Administrator on endpoints or via RMM/EDR remote shell. Output: CSV per host.

$BadHashes = @(
    "28f046d9f985e58cbc8b245b54d4179feacecc12f41e2f6594306867ce3e8727",
    "9e1a679ca45a149d2bd681cbb8ec3b1cc3d271fad51b092a3db5e5642eb6676b",
    "a4af136d159a8eb96b54924fa80355ca52874913301300f55af7d67ae97edcfe",
    "87138f63974a8ccbbf5840c31165f1a4bf92a954bacccfbf1e7e5525d750aa48",
    "a607384ce68144f2061a8b30cc65a6b8"
)
$BadIPs = @("96.126.130.81","146.19.125.36","81.177.215.15","89.106.83.49","157.173.29.133","103.245.231.248")
$BadDomains = @("sucdens.com","cepoffices.com","qbcares.com","chanret.com","captchanom.top","preentootmist.org","swp23.com")

$results = @()

# 1) njRAT-style Run-key persistence in user-writable paths
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($k in $runKeys) {
    if (Test-Path $k) {
        (Get-Item $k).Property | ForEach-Object {
            $v = (Get-ItemProperty -Path $k -Name $_).$_
            if ($v -match 'Temp|AppData|Public' -and $v -match '\.(exe|ps1|vbs)$') {
                $results += [pscustomobject]@{Type="RunKeyPersistence"; Detail="$k :: $_ = $v"}
            }
        }
    }
}

# 2) Hash sweep on common njRAT drop locations
$dropDirs = @("$env:TEMP","$env:APPDATA","$env:PUBLIC","$env:USERPROFILE\Downloads")
foreach ($d in $dropDirs) {
    Get-ChildItem -Path $d -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($BadHashes -contains $h) {
            $results += [pscustomobject]@{Type="MaliciousFileHash"; Detail="$($_.FullName) SHA256=$h"}
        }
    }
}

# 3) Active/recent network connections to C2 and staging IPs
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $BadIPs -contains $_.RemoteAddress } |
    ForEach-Object {
        $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        $results += [pscustomobject]@{Type="C2Connection"; Detail="$($_.RemoteAddress):$($_.RemotePort) via $($p.ProcessName) (PID $($_.OwningProcess))"}
    }

# 4) DNS cache hits for phishing kit / tracking domains
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($dom in $BadDomains) {
    $dns | Where-Object { $_.Entry -like "*$dom*" } | ForEach-Object {
        $results += [pscustomobject]@{Type="PhishingDomainDNS"; Detail="$($_.Entry) -> $($_.Data)"}
    }
}

# 5) Scheduled tasks referencing user-writable paths (Star Blizzard / njRAT pattern)
Get-ScheduledTask | ForEach-Object {
    $t = $_
    $t.Actions | Where-Object { $_.Execute -match 'Temp|AppData|Public' } | ForEach-Object {
        $results += [pscustomobject]@{Type="SuspiciousScheduledTask"; Detail="$($t.TaskName) -> $($_.Execute) $($_.Arguments)"}
    }
}

$results | Export-Csv -Path "$env:TEMP\SA_IOC_Hunt_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
if ($results.Count -gt 0) { $results | Format-Table -AutoSize; Write-Host "[!] $($results.Count) findings - escalate to IR." -ForegroundColor Red }
else { Write-Host "[+] No hits on this host." -ForegroundColor Green }