Outsider Enterprise Takedown: Mitigating AI-Driven PhaaS Operations

---
title: Suspicious High Volume URL Redirection Activity
id: 9e8c7d6a-5b4f-4a3e-9d1c-2f3b4c5d6e7f
status: experimental
description: Detects endpoints connecting to a high volume of unique suspicious top-level domains or redirection services within a short timeframe, indicative of PhaaS URL rotation.
references:
  - https://www.bleepingcomputer.com/news/security/fbi-disrupts-massive-ai-powered-phishing-service-using-a-million-urls/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.initial_access
  - attack.credential_phishing
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
  filter_legit_tlds:
    DestinationHostname|endswith:
      - '.com'
      - '.org'
      - '.net'
      - '.gov'
      - '.edu'
  condition: selection and not filter_legit_tlds | count(DestinationHostname) > 10 by SrcIp
  timeframe: 5m
falsepositives:
  - Users browsing marketing or international research sites
level: high
---
title: Browser Process Spawning Shell
id: a1b2c3d4-5e6f-7g8h-9i0j-1k2l3m4n5o6p
status: experimental
description: Detects browser processes (chrome, firefox, edge) spawning cmd.exe or powershell.exe. Often observed after a user is tricked into downloading a "fake" attachment or payload from a phishing site.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate web application usage launching local tools
level: high

let PhishingAlertIPs = 
SecurityAlert
| where ProviderName == "Microsoft"
| extend ThreatName = tostring(parse_(ExtendedProperties).ThreatName)
| where ThreatName contains "Phish" or ThreatName contains "Credential"
| extend AttackerIP = tostring(parse_(Entities)[0].Address)
| where isnotempty(AttackerIP);
SigninLogs
| where ResultType == 0
| join kind=inner (PhishingAlertIPs) on $left.IPAddress == $right.AttackerIP
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Location, ConditionalAccessStatus, RiskDetail
| order by TimeGenerated desc

-- Hunt for browser history interactions with credential harvesting pages
SELECT * FROM foreach(
  glob(globs='*/History'),
  {
    SELECT 
      timestamp(epoch=visit_time/1000000) AS EventTime,
      url AS URL,
      title AS Title,
      full_path AS SourceFile
    FROM sqlite(file=full_path, query="SELECT url, title, visit_time FROM urls")
    WHERE URL =~ '(login|signin|verify|account|password|credential)'
      AND NOT URL =~ "securityarsenal.com"  
  }
)

# Function to flush DNS cache and check for malicious proxy persistence
function Invoke-PhishingResponseHygiene {
    Write-Host "[+] Flushing DNS Resolver Cache to prevent reconnection to malicious infrastructure..."
    Clear-DnsClientCache
    
    Write-Host "[+] Checking for malicious system-wide proxy settings..."
    $registryPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
    $proxyEnable = (Get-ItemProperty -Path $registryPath -Name ProxyEnable -ErrorAction SilentlyContinue).ProxyEnable
    $proxyServer = (Get-ItemProperty -Path $registryPath -Name ProxyServer -ErrorAction SilentlyContinue).ProxyServer

    if ($proxyEnable -eq 1) {
        Write-Host "[!] WARNING: Proxy is ENABLED. Server: $proxyServer" -ForegroundColor Yellow
        Write-Host "[!] Investigate if this proxy is authorized." -ForegroundColor Yellow
    } else {
        Write-Host "[+] No system-wide proxy detected."
    }

    Write-Host "[+] Checking for WinINET AutoConfig URL (PAC file usage)..."
    $autoConfigURL = (Get-ItemProperty -Path $registryPath -Name AutoConfigURL -ErrorAction SilentlyContinue).AutoConfigURL
    if ($autoConfigURL) {
        Write-Host "[!] WARNING: AutoConfig URL detected: $autoConfigURL" -ForegroundColor Yellow
    }

    Write-Host "[+] Hygiene check complete."
}

Invoke-PhishingResponseHygiene