Mirage Kitten APT Deploys NodeRabbit & PollCat Cross-Platform RATs: OTX Pulse Analysis — Detection & Hunt Pack

---
title: Mirage Kitten NodeRabbit - Suspicious Node.js Child Process Execution
id: 7c2a1e44-9f3b-4d2a-a1c5-mknoderabbit01
status: experimental
description: Detects Node.js runtime spawning shells, downloaders, or script interpreters consistent with NodeRabbit RAT staging from a trojanized coding challenge.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npm.exe'
      - '\npx.cmd'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate build tooling and dev scripts invoking child processes
level: high
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1204
date: 2026/09/01
---
title: Mirage Kitten C2 - Network Connection to Campaign Infrastructure
id: 8d3b2f55-1a4c-5e3b-b2d6-mkpollcat002
status: experimental
description: Detects DNS or network connections to Mirage Kitten NodeRabbit/PollCat C2 and lure domains, including Azure-hosted msmanagementgrp.com.
author: Security Arsenal Threat Intel
logsource:
  category: dns
  product: windows
detection:
  selection:
    query|contains:
      - 'msmanagementgrp.com'
      - 'sahi-finance.com'
      - 'healthcomfsdpower.com'
      - 'visitfinancedentists.com'
      - 'optimumhealthcredit.com'
  condition: selection
falsepositives:
  - None expected; these are adversary-registered domains
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001
date: 2026/09/01
---
title: Malicious NPM Lifecycle Hook Execution - NodeRabbit Persistence
id: 9e4c3g66-2b5d-6f4c-c3e7-mknpmhook03
status: experimental
description: Detects execution of script interpreters triggered by npm install lifecycle hooks, a persistence and staging mechanism used by trojanized coding challenges.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'preinstall'
      - 'postinstall'
      - 'node-gyp rebuild'
  selection_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\node.exe'
  condition: selection and selection_shell
falsepositives:
  - Legitimate packages with native build steps (node-gyp)
level: medium
tags:
  - attack.persistence
  - attack.t1546
  - attack.t1195.002
date: 2026/09/01

// Mirage Kitten NodeRabbit/PollCat hunt: campaign domains + suspicious Node.js chains
let MKDomains = dynamic(["msmanagementgrp.com","sahi-finance.com","healthcomfsdpower.com","visitfinancedentists.com","optimumhealthcredit.com"]);
let MKHashes = dynamic(["0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864","810f8e3b88eb05f710c09552941d6f56"]);
union isfuzzy=true
(DeviceNetworkEvents
 | where TimeGenerated > ago(90d)
 | where RemoteUrl has_any (MKDomains)
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP),
(DeviceProcessEvents
 | where TimeGenerated > ago(90d)
 | where FileName =~ "node.exe" or ProcessCommandLine has_any ("preinstall","postinstall")
 | where ProcessCommandLine has_any ("powershell","cmd.exe","curl","certutil","http")
 | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256),
(DeviceFileEvents
 | where TimeGenerated > ago(90d)
 | where SHA256 has_any (MKHashes) or MD5 has_any (MKHashes)
 | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256)
| sort by TimeGenerated desc

# Mirage Kitten NodeRabbit/PollCat endpoint hunt — run via EDR live response or RMM
$domains = @('msmanagementgrp.com','sahi-finance.com','healthcomfsdpower.com','visitfinancedentists.com','optimumhealthcredit.com')
$hashes  = @('0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864','810f8e3b88eb05f710c09552941d6f56')

Write-Host "[1/5] DNS cache check for campaign domains" -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $n=$_.Entry; $domains | Where-Object { $n -like "*$_*" } } | Format-Table Entry, Data

Write-Host "[2/5] Active/recent connections by node.exe" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
  $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
  if ($p.Name -match 'node|npm') { [PSCustomObject]@{Process=$p.Name; PID=$_.OwningProcess; Remote=$_.RemoteAddress; Port=$_.RemotePort} }
} | Format-Table

Write-Host "[3/5] Hash sweep of common dev/download locations" -ForegroundColor Cyan
$paths = @("$env:USERPROFILE\Downloads","$env:USERPROFILE\Desktop","$env:USERPROFILE\source","$env:USERPROFILE\repos","$env:TEMP")
foreach ($path in $paths) {
  if (Test-Path $path) {
    Get-ChildItem $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
      $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
      if ($hashes -contains $h.ToLower()) { Write-Host "HIT: $($_.FullName)" -ForegroundColor Red }
    }
  }
}

Write-Host "[4/5] Scheduled tasks launching node/npm (persistence)" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Actions.Arguments -match 'node|\.js$|npm' } | Format-Table TaskName, TaskPath, State

Write-Host "[5/5] Startup folder .js droppers" -ForegroundColor Cyan
Get-ChildItem "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup" -ErrorAction SilentlyContinue |
  Where-Object { $_.Extension -in '.js','.lnk','.cmd' } | Format-Table FullName, LastWriteTime