title: Suspicious Rundll32 Ordinal Execution via WebDAV
id: 4a3b5c6d-7e8f-9a0b-1c2d-3e4f5a6b7c8d
description: Detects the use of rundll32.exe loading a remote payload using ordinal #1 over WebDAV, a technique associated with ClickFix campaigns.
author: Security Arsenal
date: 2026/07/30
modified: 2026/07/30
references:
    - https://otx.alienvault.com/pulse/66a8b8f5c8e4e
tags:
    - attack.execution
    - attack.t1204
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains: '.dll,'#1
        CommandLine|contains: 'http'
    filter:
        CommandLine|contains: 'https://' # Tunneled over 443
    condition: selection and filter
falsepositives:
    - Legitimate system administration (rare)
level: high
---
title: Potential Malicious Browser Extension Clipboard Hijack
id: 5b4c6d7e-8f9a-0b1c-2d3e-4f5a6b7c8d9e
description: Detects potential clipboard hijacking behavior by browser extensions based on process access patterns (heuristic).
author: Security Arsenal
date: 2026/07/30
modified: 2026/07/30
references:
    - https://otx.alienvault.com/pulse/66a8b8f5c8e4e
tags:
    - attack.credential_access
    - attack.t1115
logsource:
    category: process_access
    product: windows
detection:
    selection:
        SourceImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
        TargetImage|endswith: '\rundll32.exe' # Often used to hook into clipboard
        GrantedAccess: '0x1010' # PROCESS_VM_READ | PROCESS_VM_WRITE
    condition: selection
falsepositives:
    - Unknown
level: medium
---
title: NPM Package Installation with External Process Spawn
id: 6c5d7e8f-9a0b-1c2d-3e4f-5a6b7c8d9e0f
description: Detects npm installation events that immediately spawn a suspicious shell or runtime process (like Bun), indicative of supply chain attacks like the Shai-Hulud worm.
author: Security Arsenal
date: 2026/07/30
modified: 2026/07/30
references:
    - https://otx.alienvault.com/pulse/66a8b8f5c8e4e
tags:
    - attack.initial_access
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        Image|endswith: '\npm.cmd'
        CommandLine|contains: 'install'
    selection_child:
        Image|endswith:
            - '\bun.exe'
            - '\powershell.exe'
            - '\cmd.exe'
    condition: selection_parent | by ParentProcessId and selection_child
falsepositives:
    - Legitimate build scripts using Bun
level: high

// Hunt for PasasteSinTAG Phishing Domains in Network Events
let IoC_Domains = dynamic([
    "pasastesintag.pics", "parastesintago.click", "parastesintago.help", 
    "pasastesintagc.top", "pasastesintago.cyou", "pasastesintago.online",
    "pasastesintag26.click", "pasastesintap.cfd", "git-tanstack.com"
]);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (IoC_Domains) or RemoteUrl contains "pasastesintag"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, ActionType
// Hunt for ClickFix related Rundll32 execution over WebDAV
union DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessVersionInfoOriginalFileName =~ "rundll32.exe" 
| where CommandLine has ".dll,#1" and CommandLine has "http"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

# IOC Hunt Script: Malicious Extensions and File Hashes
# Requires Admin privileges for registry checks

# Known Malicious File Hashes from Pulses
$MaliciousHashes = @(
    "43dc5b1d4c73d5ed9f4f7f561830079896eeb533a7c21bc577e4e267d5a3aa56",
    "b3b63970833b3379ecec2d3ef8fea328fef8dd1c1574b1bcdfebad5bdce9280c",
    "72fc06a8b03720f4a64744eecd5b3f658ad880bdb327c0c465c7bdc66b14a8d2",
    "fbbdf4bc490ad7b28953630c1707aa68b89d319b9b735f3d8563320b81b21a97",
    "2fe9c41901045013ba28ccb9af5870f9aef4f1ffd1e717cd5e0189ffdbe7fca2",
    "2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96",
    "f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6"
)

Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Cyan

# Scan common directories
$PathsToScan = @("C:\Users\", "C:\ProgramData\", $env:TEMP)
foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | Where-Object { 
            $MaliciousHashes -contains $_.Hash 
        } | ForEach-Object {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.Path) (Hash: $($_.Hash))" -ForegroundColor Red
        }
    }
}

# Check for suspicious Chrome/Firefox Extensions (VPN Go)
Write-Host "[+] Checking for suspicious browser extensions..." -ForegroundColor Cyan
$ChromeExtensionsPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions"
$FirefoxExtensionsPath = "$env:APPDATA\Mozilla\Firefox\Profiles"

# Basic heuristic check for folder names containing 'vpn' or 'go' in extensions path
if (Test-Path $ChromeExtensionsPath) {
    Get-ChildItem $ChromeExtensionsPath -Directory | Where-Object { $_.Name -match "vpn|go" } | ForEach-Object {
        Write-Host "[!] Suspicious Chrome Extension ID found: $($_.Name)" -ForegroundColor Yellow
        # Check manifest version if JSON parsing available, simplified here
        Get-ChildItem $_.FullName -Recurse -Filter "manifest." | ForEach-Object {
            $content = Get-Content $_.FullName -Raw | ConvertFrom-Json
            if ($content.name -match "vpn" -or $content.name -match "VPN Go") {
                Write-Host "   [!] Confirmed Name Match in manifest: $($content.name)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Hunt complete. Review findings." -ForegroundColor Green


# Response Priorities