---
title: Potential GammaSteel Registry Persistence via Printers Key
id: 6e1b8c9d-2f3a-4a5e-9b1c-8d7f6a5e4c3b
description: Detects the creation or modification of values within HKCU\Printers registry key, a technique used by GammaSteel to store payload functions.
status: experimental
date: 2026/06/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6e1b8c9d-2f3a-4a5e-9b1c-8d7f6a5e4c3b
tags:
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    registry:
        - add
        - modify
detection:
    selection:
        TargetObject|contains: '\Software\Microsoft\Windows NT\CurrentVersion\Printers'
    condition: selection
falsepositives:
    - Legitimate printer driver installation
level: high
---
title: Potential CloudZ RAT Pheno Phone Link Abuse
id: 7f2c9d0e-3g4b-5b6f-0c2d-9e8g7b6f5e4d
description: Detects unexpected process access or injection attempts targeting Microsoft Phone Link (YourPhone.exe) by non-system processes, indicative of OTP theft.
status: experimental
date: 2026/06/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/7f2c9d0e-3g4b-5b6f-0c2d-9e8g7b6f5e4d
tags:
    - attack.credential_access
    - attack.t1056.002
logsource:
    product: windows
    category: process_access
detection:
    selection_target:
        TargetImage|endswith: '\YourPhone.exe'
    selection_grant:
        GrantedAccess|contains:
            - '0x10'
            - '0x440'
            - '0x1410' # PROCESS_VM_WRITE, PROCESS_VM_OPERATION
    filter_legit:
        SourceImage|contains:
            - '\Windows\System32\'
            - '\Program Files\WindowsApps\'
    condition: selection_target and selection_grant and not filter_legit
falsepositives:
    - Legitimate debugging of Phone Link
level: high
---
title: Remus Stealer Browser Process Injection
id: 8a3d0e1f-4h5c-6c7g-1d3e-0f9h8c7d6e5f
description: Detects potential Remus/Lumma stealer behavior where a suspicious process creates a remote thread in a browser process to bypass ABE.
status: experimental
date: 2026/06/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/8a3d0e1f-4h5c-6c7g-1d3e-0f9h8c7d6e5f
tags:
    - attack.defense_evasion
    - attack.t1055.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_target:
        TargetImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
    selection_caller:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\cscript.exe'
            - '\wscript.exe'
            - '\rundll32.exe'
    filter_legit:
        ParentImage|contains:
            - '\Program Files\'
            - '\Program Files (x86)\'
    condition: selection_target and selection_caller and not filter_legit
falsepositives:
    - Automated browser testing
level: medium

// Hunt for GammaSteel Network Indicators
let GammaSteelIPs = dynamic(['165.22.170.129']);
let GammaSteelDomains = dynamic(['justsstop.ru']);
DeviceNetworkEvents
| where RemoteIP in (GammaSteelIPs) or RemoteUrl has_any (GammaSteelDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, ActionType
| extend Threat = 'Gamaredon GammaSteel'

// Union with CloudZ RAT File Hash Hunt
let CloudZHashes = dynamic([
    '5b7284bcf30569ae400e416a62391720cc9081e6047f15816f9d1a04a06eb321',
    '24398b75be2645e6c695e529e62e60deb418143a4bbea13c561d3c361419eb54',
    '33af554562176eff34598a839051b8e91692b0305edfdbb4d8eb9df0103ffd98',
    '65fcd965040fabeb6f092df0a4b6856125018bb3b6a1876342da458139f77dac',
    'ed5de036edbbda52ab0049d2163607038d38a49404a46b6bcfc4bac26b743832'
]);
DeviceFileEvents
| where SHA256 in (CloudZHashes) or MD5 in ('a39299719bb4151c373a0e9b92b2bd05') or SHA1 in ('e3ef02456a4df8236da5ee2082a5df36e746b463')
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| extend Threat = 'CloudZ RAT Pheno'

<#
.SYNOPSIS
    Hunt script for GammaSteel persistence and CloudZ artifacts.
.DESCRIPTION
    Checks for suspicious registry entries in HKCU\Printers and scans for
    specific file hashes associated with CloudZ RAT.
#>

# 1. Hunt for GammaSteel Registry Artifacts
Write-Host "[*] Checking HKCU\Printers for GammaSteel payloads..."
$printersPath = "Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Printers"
if (Test-Path $printersPath) {
    $subKeys = Get-Item $printersPath
    # Check for unusual values or large data blobs in UserDSD or similar keys often abused
    $values = Get-ItemProperty $printersPath -ErrorAction SilentlyContinue
    foreach ($prop in $values.PSObject.Properties) {
        if ($prop.Name -ne "PSPath" -and $prop.Name -ne "PSParentPath" -and $prop.Name -ne "PSChildName") {
            $valData = $values.$($prop.Name)
            if ($valData -is [byte[]] -and $valData.Length -gt 512) {
                Write-Host "[!] Suspicious large registry value found: $($prop.Name) in $printersPath" -ForegroundColor Red
            } elseif ($valData -is [string] -and $valData.Length -gt 100) {
                Write-Host "[!] Suspicious long string value found: $($prop.Name) in $printersPath" -ForegroundColor Yellow
            }
        }
    }
}

# 2. Hunt for CloudZ RAT File Hashes
Write-Host "[*] Scanning for CloudZ RAT file hashes..."
$cloudzHashes = @(
    "5b7284bcf30569ae400e416a62391720cc9081e6047f15816f9d1a04a06eb321",
    "24398b75be2645e6c695e529e62e60deb418143a4bbea13c561d3c361419eb54",
    "33af554562176eff34598a839051b8e91692b0305edfdbb4d8eb9df0103ffd98",
    "65fcd965040fabeb6f092df0a4b6856125018bb3b6a1876342da458139f77dac",
    "ed5de036edbbda52ab0049d2163607038d38a49404a46b6bcfc4bac26b743832"
)

# Common execution paths (adjust as necessary)
$pathsToScan = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA")

foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $fileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($cloudzHashes -contains $fileHash) {
                Write-Host "[!] CloudZ RAT artifact found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[*] Hunt complete."


# Response Priorities