MarkiRAT Surveillance Operations + Pink Vishing Campaign + Global Smishing Network: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Suspicious Android Package Installation Related to TAG-182 Campaign
id: 8d7b9a3c-5e2f-4a1d-9b7e-6f8d4e5c9b1a
description: Detects installation of suspicious Android applications associated with TAG-182 MarkiRAT campaign, specifically fake VPN or media player apps
author: Security Arsenal
date: 2026/07/05
modified: 2026/07/05
references:
    - https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat
tags:
    - attack.initial_access
    - attack.mobile
    - attack.t1190
logsource:
    product: android
    category: package_installation
detection:
    selection:
        EventType|contains: 'install'
    filter_common:
        PackageName|contains:
            - 'com.android'
            - 'com.google'
            - 'com.microsoft'
            - 'com.facebook'
    filter_legitimate_vpn:
        PackageName:
            - 'com.openvpn.android'
            - 'net.openvpn.openvpn'
            - 'org.torproject.android'
    condition: selection and not 1 of filter_*
falsepositives:
    - Installation of legitimate VPN or media applications
level: high
---
title: Cloud Credential Theft and Data Exfiltration - Pink Campaign
id: 7a6c5b4d-3e2f-4a1d-9b7e-6f8d4e5c9b1a
description: Detects potential credential theft and data exfiltration activity associated with Pink extortion group targeting SharePoint and OneDrive
author: Security Arsenal
date: 2026/07/05
modified: 2026/07/05
references:
    - https://www.theregister.com/cyber-crime/2026/06/04/pink-is-the-latest-goon-squad-to-use-fake-helpdesk-calls-to-steal-creds/5251434
tags:
    - attack.credential_access
    - attack.exfiltration
    - attack.t1110
    - attack.t1530
logsource:
    product: azure
    service: security
detection:
    selection_access:
        Category: 'SignInLogs'
        AuthenticationRequirement|contains: 'multiFactorAuthentication'
    selection_mfa_bypass:
        ConditionalAccessStatus: 'failure'
        ConditionalAccessPolicies: 'null'
    selection_exfil:
        Category: 'ThreatManagement'
        Operation|contains:
            - 'MailItemsAccessed'
            - 'FileCheckedOut'
            - 'FileDownloaded'
    condition: selection_access and selection_mfa_bypass or selection_exfil
falsepositives:
    - Legitimate access from new devices
    - Valid file access patterns
level: high
---
title: Connection to Typosquatting Domains - Global Smishing Operation
id: 9d8e7a6c-5e2f-4a1d-9b7e-6f8d4e5c9b1a
description: Detects network connections to domains exhibiting typosquatting patterns associated with global smishing operations and phishing campaigns
author: Security Arsenal
date: 2026/07/05
modified: 2026/07/05
tags:
    - attack.command_and_control
    - attack.t1102
logsource:
    category: network_connection
detection:
    selection_typosquatting:
        DestinationHostname|contains:
            - 'comi-site'
            - 'come-site'
            - 'isignin.online'
    selection_brands:
        DestinationHostname|contains:
            - 'microsoft'
            - 'google'
            - 'facebook'
            - 'apple'
            - 'amazon'
    condition: selection_typosquatting and selection_brands
falsepositives:
    - Legitimate connections to domains with similar names
level: medium

// Hunt for connections to TAG-182 MarkiRAT C2 domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ ("yemplayer.site", "microsoft.comi-site.website", "google.comisignin.online", "comesignt.website", "min.come-site.website")
| summarize count() by DeviceName, RemoteUrl, InitiatingProcessAccountName
| order by count_ desc

// Hunt for Pink campaign domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ ("deploypasskey.com", "passkeyadd.com", "passkeydeploy.com")
| summarize count() by DeviceName, RemoteUrl, InitiatingProcessAccountName
| order by count_ desc

// Hunt for suspicious Android APK installations
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ActionType == "ApplicationInstall"
| where FileName endswith ".apk"
| where InitiatingProcessFileName !in~ ("googleplaystore", "amazon.appstore", "system")
| summarize count() by DeviceName, FileName, InitiatingProcessFileName
| order by count_ desc

// Hunt for MarkiRAT file hash
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 == "400eb6a94810323a1fc5f8ab31c682fe765aaec2cc61b37c31d719c7e45c9a6c"
| project DeviceName, FileName,FolderPath, SHA256, Timestamp

# IOC Hunt Script for TAG-182 MarkiRAT and Pink Campaign
# Created: 2026-07-05
# Purpose: Scan endpoints for indicators of compromise from OTX pulses

# MarkiRAT file hash
$maliciousHash = "400eb6a94810323a1fc5f8ab31c682fe765aaec2cc61b37c31d719c7e45c9a6c"

# Malicious domains
$maliciousDomains = @(
    "yemplayer.site",
    "microsoft.comi-site.website",
    "google.comisignin.online",
    "comesignt.website",
    "min.come-site.website",
    "deploypasskey.com",
    "passkeyadd.com",
    "passkeydeploy.com"
)

# Malicious IP
$maliciousIP = "46.30.191.123"

# Function to check DNS cache for malicious domains
function Check-DNSCache {
    Write-Host "Checking DNS cache for malicious domains..." -ForegroundColor Yellow
    
    $dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
    $foundDomains = @()
    
    foreach ($domain in $maliciousDomains) {
        $matches = $dnsCache | Where-Object { $_.Entry -like "*$domain*" }
        if ($matches) {
            $foundDomains += $domain
            Write-Host "SUSPICIOUS DNS ENTRY FOUND: $domain" -ForegroundColor Red
            $matches | Format-Table Entry, Data, TimeToLive
        }
    }
    
    if ($foundDomains.Count -eq 0) {
        Write-Host "No malicious domains found in DNS cache." -ForegroundColor Green
    }
    
    return $foundDomains
}

# Function to check for connections to malicious domains
function Check-NetworkConnections {
    Write-Host "Checking active network connections..." -ForegroundColor Yellow
    
    $connections = Get-NetTCPConnection -ErrorAction SilentlyContinue
    $foundConnections = @()
    
    # Check for connections to malicious IP
    $ipMatches = $connections | Where-Object { $_.RemoteAddress -eq $maliciousIP }
    if ($ipMatches) {
        $foundConnections += $maliciousIP
        Write-Host "SUSPICIOUS CONNECTION FOUND: $maliciousIP" -ForegroundColor Red
        $ipMatches | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess
        
        # Get process details
        foreach ($conn in $ipMatches) {
            $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
            if ($process) {
                Write-Host "Owning Process: $($process.ProcessName) (PID: $($process.Id))" -ForegroundColor Red
                Write-Host "Process Path: $($process.Path)" -ForegroundColor Red
            }
        }
    }
    
    if ($foundConnections.Count -eq 0) {
        Write-Host "No connections to malicious indicators found." -ForegroundColor Green
    }
    
    return $foundConnections
}

# Function to check for suspicious scheduled tasks
function Check-ScheduledTasks {
    Write-Host "Checking for suspicious scheduled tasks..." -ForegroundColor Yellow
    
    $tasks = Get-ScheduledTask -ErrorAction SilentlyContinue
    $suspiciousTasks = @()
    
    foreach ($task in $tasks) {
        $taskActions = $task.Actions
        
        foreach ($action in $taskActions) {
            if ($action.Execute -like "*powershell*" -or $action.Execute -like "*cmd.exe*") {
                if ($action.Arguments -like "*http*") {
                    $suspiciousTasks += $task
                    Write-Host "SUSPICIOUS TASK FOUND: $($task.TaskName)" -ForegroundColor Red
                    Write-Host "Action: $($action.Execute) $($action.Arguments)" -ForegroundColor Red
                }
            }
        }
    }
    
    if ($suspiciousTasks.Count -eq 0) {
        Write-Host "No suspicious scheduled tasks found." -ForegroundColor Green
    }
    
    return $suspiciousTasks
}

# Main execution
Write-Host "Starting IOC hunt script..." -ForegroundColor Cyan
Write-Host "Timestamp: $(Get-Date)" -ForegroundColor Cyan

Check-DNSCache
Check-NetworkConnections
Check-ScheduledTasks

Write-Host "IOC hunt script completed." -ForegroundColor Cyan