title: Potential Amadey or Stealc Infostealer Persistence
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects persistence mechanisms often used by Amadey and Stealc malware families via Run keys.
status: experimental
date: 2026/06/29
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/operation-endgame
tags:
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    registry:
        - add
detection:
    selection:
        EventType: SetValue
        TargetObject|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Run'
            - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
        Details|contains:
            - 'Amadey'
            - 'Stealc'
            - 'Lumma'
            - 'Danabot'
    condition: selection
falsepositives:
    - Legitimate software installation
level: high

---
title: Suspicious PowerShell Download via GitHub - Kimsuky/JINX-0164 Pattern
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
description: Detects PowerShell commands downloading archives or scripts from GitHub, a common vector for Kimsuky KimJongRAT and crypto-targeting malware.
status: experimental
date: 2026/06/29
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/kimjongrat
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_cmd:
        CommandLine|contains:
            - 'github.com'
            - 'githubusercontent.com'
            - 'Invoke-WebRequest'
            - 'IEX'
            - 'DownloadString'
    selection_ext:
        CommandLine|contains:
            - '.zip'
            - '.rar'
            - '.7z'
    condition: all of selection_*
falsepositives:
    - Legitimate developer scripts
level: medium

---
title: Potential Langflow CVE-2026-55255 Exploitation Attempt
id: 3c4d5e6f-7a8b-9c0d-1e2f-3a4b5c6d7e8f
description: Detects potential web exploitation attempts against Langflow targeting specific paths associated with CVE-2026-55255.
status: experimental
date: 2026/06/29
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/langflow-cve
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: webserver
detection:
    selection_uri:
        c-uri|contains:
            - '/api/v1/components'
            - '/flow/'
    selection_suspicious:
        c-uri|contains:
            - '../'
            - '%2e%2e'
            - 'slt' 
    condition: all of selection_*
falsepositives:
    - Unusual but legitimate API testing
level: critical


kql
// Hunt for network connections to known IOCs from JINX-0164 and Woodgnat
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in (
    'teamicrosoft.com', 
    'driver-updater.net', 
    'live.ong', 
    'authorized-logins.net',
    'grande-luna.top',
    'oeannon.com',
    'googleoba.servequake.com'
    )
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP

// Hunt for process creation associated with Amadey/Stealc/ModeloRAT
DeviceProcessEvents 
| where Timestamp > ago(7d)
| where SHA256 in (
    'ff8d2afd9d7f0a828592fee34ca55d1a3542f7ed', // Amadey/Stealc related SHA1 converted context if found, otherwise placeholder for hash logic
    '3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be', // Mistic related
    'b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17'  // AUDIOFIX/MINIRAT
    )
| project Timestamp, DeviceName, FileName, ProcessCommandLine, FolderPath, SHA256


powershell
# IOC Hunter: scans processes and specific file paths for known malware hashes

$TargetHashes = @( 
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be", # Mistic
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17", # AudioFix
    "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470", # KimJongRAT
    "221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9"  # KimJongRAT
)

Write-Host "[+] Scanning running processes for known malicious hashes..."
Get-Process | ForEach-Object {
    try {
        $path = $_.Path
        if ($path -and (Test-Path $path)) {
            $hash = (Get-FileHash -Path $path -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $hash) {
                Write-Host "[!] ALERT: Malicious process detected - PID: $($_.Id), Name: $($_.ProcessName), Path: $path, Hash: $hash" -ForegroundColor Red
            }
        }
    } catch {}
}

Write-Host "[+] Checking common download/temp directories for specific payload names..."
$SuspiciousFiles = @("agent.ashx", "install.sh", "*.zip")
$PathsToScan = @("$env:USERPROFILE\Downloads", "$env:TEMP", "C:\ProgramData")

foreach ($p in $PathsToScan) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -Include $SuspiciousFiles -ErrorAction SilentlyContinue | ForEach-Object {
             Write-Host "[!] Suspicious file found: $($_.FullName)" -ForegroundColor Yellow
        }
    }
}


# Response Priorities

*   **Immediate:** Block all listed IPv4 addresses and Domains at perimeter firewalls and proxies. Specifically, block domains mimicking Microsoft (`teamicrosoft.com`, `teams.live.us.org`). 
*   **24h:** Initiate credential audits for users who may have interacted with LinkedIn recruitment messages or downloaded files from untrusted GitHub repositories. Scan endpoints for the SHA256 hashes provided in the IOC list.
*   **1 Week:** Harden developer environments. Restrict the use of personal GitHub repositories in corporate pipelines and enforce application control (AppLocker) to prevent the execution of unsigned Python or Go binaries in user directories.