MiniFast and MiniJunk V2: Detecting Iranian SEO Poisoning and Social Engineering Attacks

---
title: Potential MiniJunk V2 Loader Activity - Suspicious Execution from Downloads
id: 8a4c2d1e-5f6a-4b3c-9e8d-1a2b3c4d5e6f
status: experimental
description: Detects execution of scripts or binaries directly from the user Downloads directory, a common TTP for SEO poisoning campaigns delivering MiniJunk.
references:
  - https://thehackernews.com/2026/05/iranian-hackers-deploy-minifast-and.html
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    NewProcessName|contains: '\Downloads\'
    NewProcessName|endswith:
      - '.exe'
      - '.bat'
      - '.cmd'
      - '.vbs'
      - '.ps1'
  filter:
    - NewProcessName|contains: 'OneDriveSetup.exe'
    - NewProcessName|contains: 'DropboxInstaller.exe'
falsepositives:
  - Legitimate software installations initiated by user
level: medium
---
title: MiniFast C2 Beacon Pattern - Suspicious User-Agent
id: 9b5d3e2f-6a7b-5c4d-0f9e-2b3c4d5e6f7a
status: experimental
description: Detects network connections associated with MiniFast malware which often uses specific or malformed User-Agent strings during C2 check-in.
references:
  - https://thehackernews.com/2026/05/iranian-hackers-deploy-minifast-and.html
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
  selection_optional:
    UserAgent|contains:
      - 'Mozilla/4.0'
      - 'Python-urllib'
  condition: selection or selection_optional
falsepositives:
  - Legacy application compatibility
  - Administrative scripts using old UA strings
level: high

// Hunt for suspicious child processes of web browsers indicating SEO poisoning download execution
let ProcessEvents = DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ("chrome.exe", "msedge.exe", "firefox.exe", "explorer.exe")
| where FolderPath contains "\\Downloads\\"
| where FileName !in ("OneDriveSetup.exe", "DropboxInstaller.exe", "setup.exe", "install.exe") // Whitelist generic installers cautiously
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, SHA256, InitiatingProcessFileName;
ProcessEvents
| join kind=leftouter (DeviceNetworkEvents | where Timestamp > ago(7d) | where RemotePort in (80, 443, 8080)) on Timestamp, DeviceName
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, RemoteIP, RemoteUrl, SHA256

-- Hunt for recently created executables in Downloads that have been executed
LET ProcessFiles = SELECT Pid, Name, Exe, CommandLine
FROM pslist()
WHERE Exe =~ "\\Downloads\\" AND Name =~ "\\.(exe|bat|cmd|vbs)$"

LET FileMetaData = SELECT FullPath, Size, Mtime
FROM glob(globs="C:\Users\*\Downloads\*.(exe|bat|cmd|vbs)")

SELECT * FROM foreach(row=ProcessFiles, 
    query={
        SELECT FullPath, Size, Mtime, 
               Pid, Name, Exe, CommandLine
        FROM FileMetaData
        WHERE FullPath = Exe AND Mtime < now() - duration("5m")
    })

# Emergency Response: Quarantine suspected SEO poisoning payloads
# This script scans user Downloads for suspicious executables created in the last 24h

$DateCutoff = (Get-Date).AddDays(-1)
$Users = Get-ChildItem "C:\Users" -Directory

Foreach ($User in $Users) {
    $DownloadsPath = Join-Path $User.FullName "Downloads"
    if (Test-Path $DownloadsPath) {
        Write-Host "Scanning $DownloadsPath..."
        
        $SuspiciousFiles = Get-ChildItem -Path $DownloadsPath -Recurse -Include *.exe, *.bat, *.cmd, *.vbs, *.js `
            | Where-Object { $_.CreationTime -gt $DateCutoff -and $_.Extension -ne ".exe" -or $_.Extension -eq ".exe" }
        
        foreach ($File in $SuspiciousFiles) {
            # Check for file characteristics common in SEO poisoning (generic names, single file)
            if ($File.Length -lt 50MB -and $File.Name -notmatch "installer|setup|update") {
                Write-Host "[!] Suspicious file found: $($File.FullName)" -ForegroundColor Yellow
                # Move to quarantine folder
                $QuarantinePath = "C:\Quarantine\SEO_Poisoning"
                if (!(Test-Path $QuarantinePath)) { New-Item -ItemType Directory -Path $QuarantinePath -Force }
                Move-Item -Path $File.FullName -Destination "$QuarantinePath\$($File.Name)_$($User.Name)" -Force
            }
        }
    }
}
Write-Host "Scan complete. Check C:\Quarantine for isolated items."