Outsider Enterprise Takedown: Mitigating PaaS Phishing Risks and Detecting 2FA Bypass Kits

---
title: Potential Phishing Kit C2 via Telegram API
id: 8a2c4d1e-5f6b-4a7c-9e1d-2f3a4b5c6d7e
status: experimental
description: Detects potential use of Telegram API for C2 communication, often used by modern phishing kits like Outsider Enterprise to exfiltrate credentials.
references:
 - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.command_and_control
 - attack.t1071.001
logsource:
 category: network_connection
 product: windows
detection:
 selection:
   DestinationHostname|contains:
     - 'api.telegram.org'
   Initiated: 'true'
 filter_legitimate:
   Image|endswith:
     - '\Telegram.exe'
     - '\telegram-desktop.exe'
     - '\chrome.exe'
     - '\msedge.exe'
     - '\firefox.exe'
 condition: selection and not filter_legitimate
falsepositives:
 - Legitimate use of Telegram by non-standard approved clients (rare in enterprise)
level: high
---
title: Suspicious PowerShell Base64 Encoded Web Request
id: 9b3d5e2f-6g7h-5i8j-0k1l-3m4n5o6p7q8r
status: experimental
description: Detects PowerShell processes making web requests using Base64 encoded commands, a common method to initialize phishing kits or download malicious payloads.
references:
 - https://attack.mitre.org/techniques/T1059/001
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.execution
 - attack.t1059.001
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   Image|endswith: '\powershell.exe'
   CommandLine|contains:
     - 'Invoke-WebRequest'
     - 'IWR'
     - 'wget'
     - 'curl'
   CommandLine|matches: '-EncodedCommand\s*\w+'
 condition: selection
falsepositives:
 - System management scripts
 - Legacy software installers
level: medium
---
title: Browser Process Spawning Suspicious Child Process
id: 0c4e5f6a-1b2c-3d4e-5f6a-7b8c9d0e1f2a
status: experimental
description: Detects browser processes spawning cmd, powershell, or wscript, indicative of successful phishing drive-by download or session hijack execution.
references:
 - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.initial_access
 - attack.t1204
logsource:
 category: process_creation
 product: windows
detection:
 selection_parent:
   Image|contains:
     - '\chrome.exe'
     - '\msedge.exe'
     - '\firefox.exe'
 selection_child:
   Image|endswith:
     - '\cmd.exe'
     - '\powershell.exe'
     - '\wscript.exe'
     - '\cscript.exe'
 condition: selection_parent and selection_child
falsepositives:
 - Legitimate file downloads or user-initiated scripts
level: high

// Hunt for connections to Telegram API from non-browser processes
DeviceNetworkEvents
| where RemoteUrl contains "api.telegram.org"
| where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "firefox.exe", "telegram-desktop.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| order by Timestamp desc

// Hunt for high-entropy domain access (Potential Phishing Kit)
// Phishing kits often generate randomized subdomains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| parse RemoteUrl with Protocol "://" Host "/" Path
| extend Subdomain = tostring(split(Host, ".")[0])
| where strlen(Subdomain) > 10 // Heuristic for generated subdomains
| summarize count() by Host, DeviceName
| where count_ < 5 // Focus on rare, one-off domains typical of targeted phishing

-- Hunt for processes connecting to Telegram IPs or Domains
-- This identifies potential C2 activity from phishing kits
SELECT *
FROM chain(
  SELECT 
    Pid, 
    Name, 
    CommandLine, 
    Exe,
    Username
  FROM pslist()
)
WHERE Name =~ "powershell.exe" OR Name =~ "cmd.exe"

-- Cross-reference with network connections to Telegram
LET TelegramProcesses = SELECT Pid FROM pslist() WHERE Name =~ "telegram.exe"

SELECT 
  F.Pid, 
  F.RemoteAddress, 
  F.RemotePort, 
  P.Name, 
  P.CommandLine
FROM netstat() AS F
LEFT JOIN pslist() AS P ON F.Pid = P.Pid
WHERE F.RemoteAddress IN ip_ranges("149.154.160.0/20", "91.108.4.0/22")
  AND P.Name NOT IN $TelegramProcesses

# Block known Telegram C2 IP ranges at the firewall to mitigate phishing kit exfiltration
# Note: Verify business use of Telegram before executing
Write-Host "Hardening network against common Phishing-as-a-Service C2 infrastructure..."

$TelegramRanges = @("149.154.160.0/20", "91.108.4.0/22")
$RuleName = "Block Phishing C2 - Telegram"

# Remove existing rule if present to avoid duplicates
if (Get-NetFirewallRule -DisplayName $RuleName -ErrorAction SilentlyContinue) {
    Remove-NetFirewallRule -DisplayName $RuleName
}

foreach ($cidr in $TelegramRanges) {
    New-NetFirewallRule -DisplayName $RuleName -Direction Outbound -Action Block -RemoteAddress $cidr -Profile Any -Enabled True -ErrorAction Stop
}

Write-Host "Firewall rules updated. Blocking outbound traffic to Telegram IP ranges."

# Force flush DNS cache to prevent resolution of seized Outsider Enterprise domains if still cached
Clear-DnsClientCache
Write-Host "DNS cache flushed."