Remcos RAT + Refrigerator Botnet + DarkSword iOS Exploitation Platform: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Remcos RAT PowerShell Downloader Execution
id: 8a3f1c2e-9d4b-4e6a-a1c5-3f8e2d9b7c4a
status: experimental
description: Detects PowerShell execution fetching VBS payloads, consistent with Remcos RAT delivery via weaponized Excel macros
author: Security Arsenal Threat Intelligence
references:
  - https://www.esentire.com/blog/remcos-rat
  - https://otx.alienvault.com/pulse/
date: 2026/11/06
modified: 2026/11/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\excel.exe'
  selection_powershell:
    Image|endswith: '\powershell.exe'
  selection_command:
    CommandLine|contains:
      - 'edi.vbs'
      - 'firewall.vbs'
      - 'Invoke-WebRequest'
      - 'DownloadString'
      - 'lbl.support'
  condition: selection_parent and selection_powershell and selection_command
falsepositives:
  - Legitimate administrative scripts (rare from Excel parent process)
level: high
---
title: Suspicious Network Connection to Known Refrigeration Botnet IPs
id: 7b2e4f1a-3c8d-4a9e-b2f6-9e1c5d7a3f8b
status: experimental
description: Detects outbound connections to IP addresses associated with the Dixell/Copeland refrigeration controller botnet
author: Security Arsenal Threat Intelligence
references:
  - https://securityscorecard.com/blog/a-dish-served-lukewarm-the-refrigerator-botnet/
date: 2026/11/06
modified: 2026/11/06
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIp:
      - '84.1.34.242'
      - '78.21.151.21'
      - '90.0.156.128'
      - '160.19.119.226'
      - '168.195.122.22'
  condition: selection
falsepositives:
  - Unlikely; these IPs are confirmed malicious infrastructure
level: critical
---
title: DarkSword iOS Exploitation Domain Resolution
id: 5c9a1e7f-2b4d-4f8a-a3e6-1d9c7b5e3a2f
status: experimental
description: Detects DNS queries to domains associated with the DarkSword/Coruna iOS exploitation platform
author: Security Arsenal Threat Intelligence
references:
  - https://censys.com/blog/darksword-coruna-open-directory-finding-report/
date: 2026/11/06
modified: 2026/11/06
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1189
logsource:
  category: dns
  product: windows
detection:
  selection:
    query:
      - 'lbl.support'
      - '66ds.lol'
      - 'hdios.cn'
      - 'escofiringbijou.com'
  condition: selection
falsepositives:
  - Threat hunting or security research activity
level: high

// Microsoft Sentinel KQL Hunt: Remcos RAT, Refrigerator Botnet, and DarkSword Indicators
// Hunt for network connections, DNS queries, and process execution related to these campaigns

let malicious_domains = dynamic(["lbl.support", "66ds.lol", "hdios.cn", "escofiringbijou.com"]);
let malicious_ips = dynamic(["84.1.34.242", "78.21.151.21", "90.0.156.128", "160.19.119.226", "168.195.122.22"]);

// Hunt 1: Network connections to botnet IPs and C2 domains
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteIP in (malicious_ips) or RemoteUrl has_any (malicious_domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| extend ThreatIndicator = case(
    RemoteIP in (malicious_ips), "Refrigerator Botnet",
    RemoteUrl has "lbl.support", "Remcos RAT",
    RemoteUrl has_any ("66ds.lol", "hdios.cn", "escofiringbijou.com"), "DarkSword iOS Exploitation",
    "Unknown"
)
| order by TimeGenerated desc;

// Hunt 2: PowerShell execution from Excel (Remcos delivery chain)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "EXCEL.EXE"
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("edi.vbs", "firewall.vbs", "Invoke-WebRequest", "DownloadString")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt 3: DNS queries to malicious domains
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where ActionType == "DnsQuery"
| extend DnsQuery = tostring(parse_json(AdditionalFields).query)
| where DnsQuery has_any (malicious_domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, DnsQuery, RemoteIP
| order by TimeGenerated desc;

# Security Arsenal IOC Hunt Script — Remcos RAT, Refrigerator Botnet, DarkSword
# Run with administrative privileges on Windows endpoints
# Checks for persistence artifacts, network connections, and file indicators

Write-Host "[+] Security Arsenal Threat Hunt — OTX Pulse IOCs (2026-11-06)" -ForegroundColor Cyan
Write-Host ""

# IOC Lists
$malicious_domains = @("lbl.support", "66ds.lol", "hdios.cn", "escofiringbijou.com")
$malicious_ips = @("84.1.34.242", "78.21.151.21", "90.0.156.128", "160.19.119.226", "168.195.122.22")
$malicious_hashes = @(
    "50f2ff7d96392fcfe6ed57a1ff71ae9c87a1346ff3694173a255b67e9ff8a208",
    "abf8ada022fce92c24e0aead4f1b1ae8991002130bbbc4335f3381972683b400",
    "864d68e64618d6bfc26d75d6f780ae0b7bfed3698cc8333818ed32519e560d1f"
)

# 1. Check for active network connections to malicious IPs
Write-Host "[1] Checking active network connections to botnet IPs..." -ForegroundColor Yellow
$netstat = netstat -ano | Select-String "ESTABLISHED"
foreach ($ip in $malicious_ips) {
    if ($netstat -match $ip) {
        Write-Host "  [!] ALERT: Active connection to malicious IP: $ip" -ForegroundColor Red
        $netstat | Select-String $ip | ForEach-Object { Write-Host "      $_" }
    }
}

# 2. Check DNS cache for malicious domains
Write-Host "`n[2] Checking DNS cache for malicious domains..." -ForegroundColor Yellow
$dnsCache = Get-DnsClientCache
foreach ($domain in $malicious_domains) {
    $match = $dnsCache | Where-Object { $_.Entry -like "*$domain*" }
    if ($match) {
        Write-Host "  [!] ALERT: DNS cache entry found for: $domain" -ForegroundColor Red
        $match | Format-Table Entry, Data, Status
    }
}

# 3. Check for suspicious scheduled tasks (Remcos persistence)
Write-Host "`n[3] Checking for suspicious scheduled tasks..." -ForegroundColor Yellow
$tasks = Get-ScheduledTask | Where-Object { $_.TaskName -match "edi|firewall|remcos|update" }
if ($tasks) {
    Write-Host "  [!] ALERT: Suspicious scheduled tasks detected:" -ForegroundColor Red
    $tasks | Format-Table TaskName, TaskPath, State
}

# 4. Check Registry Run keys for persistence
Write-Host "`n[4] Checking Registry Run keys for persistence mechanisms..." -ForegroundColor Yellow
$runKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        $entries = Get-ItemProperty -Path $key
        $entries.PSObject.Properties | ForEach-Object {
            if ($_.Value -match "powershell|vbs|edi|firewall") {
                Write-Host "  [!] ALERT: Suspicious Run key entry: $($_.Name) = $($_.Value)" -ForegroundColor Red
            }
        }
    }
}

# 5. Check for suspicious files by hash (requires file paths to scan)
Write-Host "`n[5] Scanning common malware staging directories for known hashes..." -ForegroundColor Yellow
$scanPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA\Temp", "C:\Users\Public\Downloads")
foreach ($path in $scanPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($malicious_hashes -contains $hash) {
                Write-Host "  [!] ALERT: Malicious file detected: $($_.FullName) [SHA256: $hash]" -ForegroundColor Red
            }
        }
    }
}

# 6. Check for recent PowerShell execution from Office applications
Write-Host "`n[6] Checking recent PowerShell execution events (parent: Excel)..." -ForegroundColor Yellow
$events = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4103} -MaxEvents 100 -ErrorAction SilentlyContinue
if ($events) {
    $suspicious = $events | Where-Object { $_.Message -match "edi.vbs|firewall.vbs|Invoke-WebRequest|DownloadString" }
    if ($suspicious) {
        Write-Host "  [!] ALERT: Suspicious PowerShell execution detected:" -ForegroundColor Red
        $suspicious | Select-Object TimeCreated, Message | Format-List
    }
}

Write-Host "`n[+] Hunt complete. Review any alerts above and escalate to IR team if matches found." -ForegroundColor Green
Write-Host "[+] For support: https://securityarsenal.com/services/incident-response" -ForegroundColor Cyan