Operation Endgame Disruption & Woodgnat Access Brokers: StealC, Amadey, and Mistic Backdoor Intel — Detection Pack

---
title: Suspicious Connection to StealC/Amadey C2 Domains
id: 1e2d3f4a-5b6c-7d8e-9f0a-1b2c3d4e5f6a
description: Detects network connections to known StealC and Amadey C2 infrastructure identified in recent pulses.
status: experimental
date: 2026/06/27
author: Security Arsenal
references:
    - https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
detection:
    selection:
        Initiated: 'true'
        destination|endswith:
            - 'microsoft-telemetry.at'
            - 'svclsc.com'
            - 'goodpanelforgoodjob.com'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Potential Sideloading via Mistic Backdoor Parent Process
id: 2f3e4g5h-6i7j-8k9l-0m1n-2o3p4q5r6s7t
description: Detects suspicious process execution patterns consistent with Woodgnat's Mistic backdoor deployment via sideloading.
status: experimental
date: 2026/06/27
author: Security Arsenal
references:
    - https://www.security.com/threat-intelligence/new-mistic-backdoor-modelorat
tags:
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    category: process_creation
detection:
    selection:
        ParentImage|endswith:
            - '\svchost.exe'
            - '\rundll32.exe'
        Image|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
    condition: selection
falsepositives:
    - Legitimate software updates
level: high
---
title: KimJongRAT GitHub LOTS Download Pattern
id: 3g4h5i6j-7k8l-9m0n-1o2p-3q4r5s6t7u8v
description: Detects process execution involving PowerShell or Curl downloading archives from GitHub, associated with Kimsuky campaigns.
status: experimental
date: 2026/06/27
author: Security Arsenal
references:
    - https://sect.iij.ad.jp/blog/2026/06/continuous-evolution-of-kimjongrat-2026/
tags:
    - attack.initial_access
    - attack.t1566.001
logsource:
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\curl.exe'
            - '\wget.exe'
    selection_cli:
        CommandLine|contains:
            - 'githubusercontent.com'
            - 'github.com'
            - 'servequake.com'
    condition: all of selection_*
falsepositives:
    - Legitimate developer tooling
level: medium

// Hunt for StealC/Amadey and KimJongRAT Network Indicators
let NetworkIOCs = dynamic([
    "microsoft-telemetry.at", "svclsc.com", "goodpanelforgoodjob.com",
    "googleoba.servequake.com", "lutkdd.corpsecs.com", "pxqtkc.corpsecs.com",
    "176.124.199.207", "176.111.174.140", "62.60.226.159", 
    "94.154.35.25", "64.188.91.237", "196.251.107.130", "104.200.67.46"
]);
DeviceNetworkEvents
| where RemoteUrl has_any (NetworkIOCs) or RemoteIP has_any (NetworkIOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')
| order by Timestamp desc


kql
// Hunt for Mistic/Vidar/StealC File Hashes
let FileHashes = pack_array(
    "8cef760d11d24fc2e9bbd9f770dca5105854f7ece3b0e6948d7c8b7fdd1765ea",
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be",
    "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470",
    "221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9",
    "ab5681266f70af7df24383f15de876e411fc18e35cb6f24603b12f580b05ccb3",
    "8de34006dafd990853a45cbe9aaab4ee18c8cd4c1ad0a98fe71f8d63cd60db25"
);
DeviceProcessEvents
| where SHA256 in (FileHashes) or MD5 in (FileHashes) or SHA1 in (FileHashes)
| project Timestamp, DeviceName, FolderPath, FileName, ProcessCommandLine, AccountName
| extend timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')
| order by Timestamp desc

<#
.SYNOPSIS
    Hunt for persistence and artifacts associated with StealC, Amadey, and Woodgnat Mistic campaigns.
.DESCRIPTION
    Checks for specific suspicious file paths, registry run keys associated with generic malware,
    and active network connections to known C2 IPs.
#>

$C2IPs = @(
    "176.124.199.207", "176.111.174.140", "62.60.226.159",
    "94.154.35.25", "64.188.91.237", "196.251.107.130"
)

$MaliciousHashes = @(
    "8cef760d11d24fc2e9bbd9f770dca5105854f7ece3b0e6948d7c8b7fdd1765ea",
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be"
)

Write-Host "[+] Checking for active network connections to known C2 infrastructure..."
$ActiveConnections = Get-NetTCPConnection -State Established
foreach ($IP in $C2IPs) {
    if ($ActiveConnections.RemoteAddress -contains $IP) {
        Write-Host "[!] ALERT: Found connection to malicious IP: $IP" -ForegroundColor Red
        Get-Process -Id (Get-NetTCPConnection -RemoteAddress $IP).OwningProcess | Select-Object ProcessName, Id, Path
    }
}

Write-Host "[+] Scanning user directories for suspicious executables (Amadey/StealC common paths)..."
$Users = Get-ChildItem "C:\Users"
foreach ($User in $Users) {
    $Paths = @(
        "$($User.FullName)\AppData\Roaming",
        "$($User.FullName)\AppData\Local\Temp"
    )
    foreach ($Path in $Paths) {
        if (Test-Path $Path) {
            Get-ChildItem $Path -Recurse -Include *.exe, *.dll -ErrorAction SilentlyContinue | ForEach-Object {
                $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash
                if ($MaliciousHashes -contains $Hash) {
                    Write-Host "[!] ALERT: Malicious file found at $($_.FullName)" -ForegroundColor Red
                }
            }
        }
    }
}

Write-Host "[+] Checking Registry Run Keys for persistence..."
$RunKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-ItemProperty $Key | ForEach-Object {
            if ($_.PSObject.Properties -match "Update" -or $_.PSObject.Properties -match "Telemetry") {
                Write-Host "[!] Suspicious persistence entry found in $Key" -ForegroundColor Yellow
                $_ | Format-List
            }
        }
    }
}