Node.js LOLBin Abuse, PaperCut MF Zero-Days & AI-Orchestrated Intrusions: AdaptixC2, AsukaStealer, GLUTTON OTX Pulse Analysis — Enterprise Detection Pack

---
title: Node.js LOLBin Execution of Remote or Script-Based Payload (Woodgnat / ClickFix)
id: 9f3c2a71-4b6e-4d1a-9c5f-2e8a7b1d3f01
status: experimental
description: Detects the legitimate signed node.exe executing inline JavaScript, spawning child processes, or being executed from user-writable/temp paths — consistent with ClickFix-delivered AsukaStealer/ModeloRAT staging.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith: '\node.exe'
  selection_suspicious:
    CommandLine|contains:
      - '-e '
      - '--eval'
      - 'child_process'
      - 'Invoke-WebRequest'
      - 'curl '
      - 'certutil'
      - 'mshta'
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\Downloads\'
  condition: selection_binary and (selection_suspicious or selection_path)
falsepositives:
  - Legitimate Node.js development on developer workstations
level: high
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1218
---
title: PaperCut MF Spawning Suspicious Child Processes (Web Shell / Java Loader)
id: 1a7d4e82-5c3b-4f2a-8d6e-9b1c3a5f7e02
status: experimental
description: Detects PaperCut MF service processes spawning cmd, powershell, wscript, or unexpected java processes — consistent with CVE-2026-82078/81578 exploitation and AdaptixC2 delivery via trojanized Copilot binary.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'pc-app.exe'
      - 'pc-server.exe'
      - '\PaperCut MF\'
  selection_parent_java:
    ParentImage|endswith: '\java.exe'
    ParentCommandLine|contains: 'papercut'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\whoami.exe'
      - '\nltest.exe'
  condition: (selection_parent or selection_parent_java) and selection_child
falsepositives:
  - Rare; legitimate PaperCut admin scripts. Verify against change windows.
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1505.003
---
title: EtherHiding — Blockchain RPC Gateway Access from Non-Developer Endpoints
id: 7b2e9f13-8a4d-4c6b-b2e5-3d9f1a6c8e03
status: experimental
description: Detects network connections to blockchain RPC gateways (Tenderly, Infura, Alchemy, BSC public nodes) from endpoints without developer tooling — consistent with Woodgnat EtherHiding C2 dead-drop resolution.
author: Security Arsenal Threat Intelligence
logsource:
  category: dns
  product: windows
detection:
  selection:
    QueryName|contains:
      - 'gateway.tenderly.co'
      - 'mainnet.infura.io'
      - 'bsc-dataseed'
      - 'rpc.ankr.com'
      - 'eth-mainnet.g.alchemy.com'
  condition: selection
falsepositives:
  - Developer workstations, Web3 QA environments, crypto treasury systems
level: medium
tags:
  - attack.command_and_control
  - attack.t1102.001

// Hunt: AdaptixC2 / Woodgnat / GLUTTON activity — C2, LOLBin, and web shell behaviors
// Microsoft Sentinel — 14-day lookback
let Lookback = 14d;
let BadDomains = dynamic(["mueleer.com","grande-luna.top","oeannon.com","challenge-refernow.com","csa-humanchecknow.com","mail.authorized-logins.net","www.xt24.com"]);
let BadIP = "156.227.0.13";
let BadHashes = dynamic(["d2e55213a02fd16a077298c986130522eb63196bdf8a8c1aec0eed6ef318b222","cf6dd15baf5ef66432a95b5a2ec64ba5c6de565b3fb9e10ae01b1a91612a1c2c","bc5fd75b307c2a11a602fbedb8275e0836ddf81cdd43af00a6bf0d850ff6cf58"]);
let NetEvents =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any (BadDomains) or RemoteIP == BadIP
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, HuntHit = "Network IOC";
let ProcEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where
        // Node.js LOLBin abuse
        (FileName =~ "node.exe" and (ProcessCommandLine has_any ("-e ","--eval","child_process") or FolderPath has_any ("\\Temp\\","\\Public\\","\\Downloads\\")))
        // PaperCut spawning shells
        or (InitiatingProcessFolderPath has "PaperCut" and FileName in~ ("cmd.exe","powershell.exe","wscript.exe","rundll32.exe"))
        // WScript COM stager (SecFlow indicator)
        or (ProcessCommandLine has "wscript.shell" and FileName in~ ("wscript.exe","cscript.exe","powershell.exe"))
        // TrojCopilot-style masquerade: Copilot binary outside expected paths
        or (FileName has "copilot" and not (FolderPath has_any ("\\Program Files\\","\\WindowsApps\\")))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256, HuntHit = "Behavioral";
let HashEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where SHA256 in (BadHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, HuntHit = "Known Malware Hash";
union NetEvents, ProcEvents, HashEvents
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, HuntHit, tostring(RemoteUrl), tostring(RemoteIP), tostring(FileName), tostring(SHA256)
| order by LastSeen desc

<#
.SYNOPSIS
  IOC Hunt — Woodgnat Node.js abuse, AdaptixC2, GLUTTON web shell artifacts
.DESCRIPTION
  Checks for malicious ClickFix lure artifacts, Node.js persistence, AdaptixC2 IOCs,
  and EtherHiding network connections. Run elevated. Output: JSON per host.
#>

$ErrorActionPreference = 'SilentlyContinue'
$Findings = @()

# --- 1. Known malicious domains/IP in DNS cache ---
$badIOCs = @('mueleer.com','grande-luna.top','oeannon.com','challenge-refernow.com',
             'csa-humanchecknow.com','authorized-logins.net','xt24.com','156.227.0.13')
$dnsCache = Get-DnsClientCache | Where-Object { $e = $_.Entry; $badIOCs | Where-Object { $e -like "*$_*" } }
foreach ($d in $dnsCache) {
    $Findings += [PSCustomObject]@{Type='DNSCache'; Indicator=$d.Entry; Detail=$d.Data; Severity='Critical'}
}

# --- 2. Active connections to AdaptixC2 IP / blockchain RPC (EtherHiding) ---
$conns = Get-NetTCPConnection -State Established |
    Where-Object { $_.RemoteAddress -eq '156.227.0.13' -or $_.RemotePort -in @(443,8443) } |
    ForEach-Object {
        $p = Get-Process -Id $_.OwningProcess
        [PSCustomObject]@{Type='NetConn'; Indicator=$_.RemoteAddress; Detail="$($p.ProcessName) ($($p.Path)):$($_.RemotePort)"; Severity=$(if($_.RemoteAddress -eq '156.227.0.13'){'Critical'}elseif($p.ProcessName -in @('node','wscript','java','powershell')){'High'}else{'Info'})}
    }
$Findings += $conns | Where-Object { $_.Severity -ne 'Info' }

# --- 3. Node.exe running from suspicious paths ---
Get-Process node -ErrorAction SilentlyContinue | Where-Object {
    $_.Path -match 'Temp|Public|Downloads|AppData\\Local\\(?!Programs)'
} | ForEach-Object {
    $Findings += [PSCustomObject]@{Type='SuspiciousNode'; Indicator=$_.Path; Detail="PID $($_.Id)"; Severity='High'}
}

# --- 4. Persistence: Run keys & scheduled tasks invoking node/wscript/mshta ---
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    (Get-ItemProperty $key).PSObject.Properties | Where-Object {
        $_.Value -match 'node\.exe|wscript|mshta|javascript:'
    } | ForEach-Object {
        $Findings += [PSCustomObject]@{Type='RunKey'; Indicator=$_.Name; Detail=$_.Value; Severity='High'}
    }
}
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'node\.exe|wscript\.exe|mshta\.exe' -or
    $_.Actions.Arguments -match '-e |--eval|http'
} | ForEach-Object {
    $Findings += [PSCustomObject]@{Type='ScheduledTask'; Indicator=$_.TaskName; Detail="$($_.Actions.Execute) $($_.Actions.Arguments)"; Severity='High'}
}

# --- 5. Known malware hashes on disk (PaperCut AdaptixC2 loaders) ---
$badHashes = @('d2e55213a02fd16a077298c986130522eb63196bdf8a8c1aec0eed6ef318b222',
               'cf6dd15baf5ef66432a95b5a2ec64ba5c6de565b3fb9e10ae01b1a91612a1c2c',
               'bc5fd75b307c2a11a602fbedb8275e0836ddf81cdd43af00a6bf0d850ff6cf58')
$scanPaths = @("$env:TEMP","$env:PUBLIC","$env:ProgramData","$env:USERPROFILE\Downloads")
foreach ($path in $scanPaths) {
    Get-ChildItem $path -Recurse -File -Include *.exe,*.dll,*.js,*.jar -ErrorAction SilentlyContinue |
        ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
            if ($badHashes -contains $h) {
                $Findings += [PSCustomObject]@{Type='MalwareHash'; Indicator=$_.FullName; Detail=$h; Severity='Critical'}
            }
        }
}

# --- 6. Trojanized Copilot binary outside expected install paths ---
Get-ChildItem "C:\Users" -Recurse -Filter "*copilot*.exe" -ErrorAction SilentlyContinue |
    Where-Object { $_.FullName -notmatch 'Program Files|WindowsApps' } |
    ForEach-Object {
        $Findings += [PSCustomObject]@{Type='Masquerade'; Indicator=$_.FullName; Detail=(Get-FileHash $_.FullName).Hash; Severity='High'}
    }

# --- Output ---
if ($Findings.Count -gt 0) {
    $Findings | Sort-Object Severity | ConvertTo-Json -Depth 4
    Write-Host "[!] $($Findings.Count) findings on $env:COMPUTERNAME — escalate to IR" -ForegroundColor Red
} else {
    Write-Host "[+] No Woodgnat/AdaptixC2/GLUTTON indicators found on $env:COMPUTERNAME" -ForegroundColor Green
}