Operation STANDOFF + Offside Wallet Theft Factory: GitHub-Redirected C2, Stealer Loader Chains & Malicious Firefox Extensions — OTX Enterprise Detection Pack

---
title: Operation STANDOFF Stealer Loader Execution and Run Key Persistence
id: 7c2f1a44-standoff-loader-0001
status: experimental
description: Detects execution and persistence patterns associated with Operation STANDOFF pay-per-install loaders (SmokeLoader, Amadey) dropping Raccoon/RedLine/Socelars stealers and establishing Run key persistence.
author: Security Arsenal Threat Intel
logsource:
  category: registry_set
  product: windows
detection:
  selection_runkey:
    TargetObject|contains:
      - '\Software\Microsoft\Windows\CurrentVersion\Run'
      - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
  selection_suspicious_path:
    Details|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Users\Public\'
  filter_legit:
    Details|contains:
      - '\Microsoft\'
      - '\Adobe\'
  condition: selection_runkey and selection_suspicious_path and not filter_legit
falsepositives:
  - Legitimate user-installed software registering startup items from AppData
level: high
date: 2026/08/20
tags:
  - attack.persistence
  - attack.t1060
  - attack.t1547.001
  - malware.raccoon
  - malware.redline
---
title: GitHub Dead-Drop C2 Resolution Followed by Non-GitHub Inbound C2 (STANDOFF / TimeWeb)
id: 7c2f1a44-standoff-c2-0002
status: experimental
description: Detects processes performing HTTP requests to github.com (dead-drop resolver pattern) immediately followed by connections to known STANDOFF infrastructure or suspicious low-reputation domains, consistent with GitHub-redirected C2 resolution.
author: Security Arsenal Threat Intel
logsource:
  category: proxy
detection:
  selection_github:
    c-uri|contains:
      - 'raw.githubusercontent.com'
      - 'github.com'
  selection_c2_domains:
    c-uri|contains:
      - 'listincode.com'
      - 'wfsdragon.ru'
      - 'topniemannpickshop.cc'
      - 'all-mobile-pa1ments.com.mx'
      - 'buy-fantasy-gxmes.com.sg'
  selection_c2_path:
    cs-uri|contains:
      - '/api/setStats.php'
  condition: selection_c2_domains or selection_c2_path
falsepositives:
  - None expected for direct IOC matches; path match may hit unrelated PHP APIs (tune per environment)
level: critical
date: 2026/08/20
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102
  - campaign.operation_standoff
---
title: Malicious Browser Extension Exfiltration via Supabase or Cloudflare Workers (Offside Wallet Theft Factory)
id: 7c2f1a44-offside-ext-0003
status: experimental
description: Detects Firefox browser processes posting data to Supabase REST endpoints or Cloudflare Workers domains associated with malicious extension exfiltration, or connecting to known Offside campaign C2 domains.
author: Security Arsenal Threat Intel
logsource:
  category: network_connection
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\firefox.exe'
      - '\plugin-container.exe'
  selection_ioc:
    DestinationHostname|contains:
      - 'browser-app.com'
      - 'browsify.net'
      - 'e-wl.com'
      - 'gemachriverdale.org'
  condition: selection_browser and selection_ioc
falsepositives:
  - None expected; these domains are confirmed campaign infrastructure
level: critical
date: 2026/08/20
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1176
  - campaign.offside_wallet_theft

// Security Arsenal — Operation STANDOFF + Offside Wallet Theft Factory Hunt
// Hunts network IOCs, stealer process lineage, and browser extension exfiltration
let StandoffIOCs = dynamic(["listincode.com", "www.listincode.com", "wfsdragon.ru", "topniemannpickshop.cc", "all-mobile-pa1ments.com.mx", "buy-fantasy-gxmes.com.sg"]);
let OffsideIOCs = dynamic(["browser-app.com", "browsify.net", "gemachriverdale.org", "e-wl.com"]);
let AllIOCs = array_concat(StandoffIOCs, OffsideIOCs);
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (AllIOCs) or RemoteUrl has "/api/setStats.php"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType
    | extend HuntType = "NetworkIOC";
let StealerProcess =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName has_any ("raccoon", "redline", "amadey", "smokeloader", "socelars", "glupteba", "xmrig")
       or ProcessCommandLine has_any ("raccoon", "redline", "amadey", "smokeloader")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, SHA256
    | extend HuntType = "StealerProcess";
let ExtensionExfil =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName in~ ("firefox.exe", "plugin-container.exe")
    | where RemoteUrl has_any ("supabase.co", "workers.dev") and RemoteUrl has_any (OffsideIOCs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
    | extend HuntType = "ExtensionExfil";
union NetworkHits, StealerProcess, ExtensionExfil
| sort by TimeGenerated desc

# Security Arsenal — STANDOFF & Offside Endpoint IOC Hunt (run via EDR Live Response or GPO)
# Checks: Run key persistence, suspicious AppData binaries, extension hashes, network IOCs

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# 1. Run/RunOnce key persistence pointing to user-writable paths
$runKeys = @('HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
             'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($key in $runKeys) {
    Get-ItemProperty $key | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match 'AppData|ProgramData|Users\\Public|Temp' -and
            $_.Value -notmatch 'Microsoft|Adobe|OneDrive|Teams|Slack'
        } | ForEach-Object {
            $report += [PSCustomObject]@{ Check='RunKeyPersistence'; Location=$key; Name=$_.Name; Value=$_.Value }
        }
    }
}

# 2. Scheduled tasks launching from user-writable directories
Get-ScheduledTask | Where-Object {
    ($_.Actions.Execute -match 'AppData|ProgramData|Users\\Public') -and
    ($_.Actions.Execute -notmatch 'Microsoft|Adobe|Google|OneDrive')
} | ForEach-Object {
    $report += [PSCustomObject]@{ Check='ScheduledTask'; Location=$_.TaskPath; Name=$_.TaskName; Value=$_.Actions.Execute }
}

# 3. Offside extension payload hash sweep across user profiles
$badHashes = @('08b7b064fa9a41b06774315d944ffddff705ab727222a0c3bcac64a77553bf2f',
               '4d0912d575087dab5f468214a2fd259bc386472a8b2b93b6e2441cde4bd941cb',
               '26427220b9965e22deca0e617657c2c65b78f750183355d1265c147818367bd7',
               '252119fc48ad93b0c930d7a62fb49420cf8986716539e4e9d4d5c1bad700d435')
Get-ChildItem 'C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles' -Recurse -Include *.xpi,*.js -File |
    ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($badHashes -contains $h) {
            $report += [PSCustomObject]@{ Check='MaliciousExtensionHash'; Location=$_.FullName; Name=$_.Name; Value=$h }
        }
    }

# 4. Active/historical network connections to campaign IOCs
$iocDomains = @('listincode.com','wfsdragon.ru','topniemannpickshop.cc','browser-app.com','browsify.net','e-wl.com')
Get-NetTCPConnection | Where-Object { $_.State -eq 'Established' } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $report += [PSCustomObject]@{ Check='ActiveConnection'; Location=$_.RemoteAddress; Name=$proc.ProcessName; Value=$_.RemotePort }
}
$dnsCache = Get-DnsClientCache | Where-Object { $d = $_.Entry; $iocDomains | Where-Object { $d -match $_ } }
$dnsCache | ForEach-Object {
    $report += [PSCustomObject]@{ Check='DNSCacheHit'; Location='DnsClientCache'; Name=$_.Entry; Value=$_.Data }
}

$report | Format-Table -AutoSize
if ($report) { $report | Export-Csv "$env:TEMP\arsenal_ioc_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation }