Rhadamanthys Stealer + RecruitTrap Phishing Kit: OTX Pulse Analysis — AI-Generated Malware & OAuth Token Theft Detection Pack

---
title: COM Hijacking Persistence via InprocServer32 Registration
description: Detects registration of DLLs under user-writable COM CLSID keys, a persistence technique observed in Rhadamanthys stealer and AI-generated malware variants
status: experimental
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\Software\Classes\CLSID\'
      - '\WOW6432Node\Classes\CLSID\'
    TargetObject|endswith: '\InprocServer32'
  filter_known:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Windows\System32\'
  condition: selection and not filter_known
fields:
  - Image
  - TargetObject
  - Details
falsepositives:
  - Legitimate user-scope COM registrations by development tools
level: high
tags:
  - attack.persistence
  - attack.t1546.015
---
title: RecruitTrap Phishing Domain Resolution - Careers Impersonation
description: Detects DNS queries to recruitment-themed phishing domains impersonating enterprise brands, associated with the RecruitTrap OAuth credential harvesting campaign
status: experimental
logsource:
  category: dns
  product: windows
detection:
  selection_iocs:
    query:
      - 'hbc-careers.com'
      - 'fifahr-careers.com'
      - 'mckinsey-careers.com'
      - 'aa-careers.com'
      - 'levis-careers.com'
      - 'andmore-global.com'
      - 'expedia-careers.com'
  selection_pattern:
    query|endswith: '-careers.com'
  filter_legit:
    query:
      - 'oracle-careers.com'
  condition: (selection_iocs or selection_pattern) and not filter_legit
fields:
  - query
  - answer
falsepositives:
  - Legitimate third-party recruiting portals using careers.com subdomains
level: high
tags:
  - attack.initial-access
  - attack.t1566.002
  - attack.t1078
---
title: Infostealer Browser Credential Store Access
description: Detects suspicious process access to browser credential and cookie stores, behavior consistent with Rhadamanthys and related AI-generated stealer families
status: experimental
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
    TargetFilename|endswith:
      - '\Login Data'
      - '\Cookies'
      - '\Web Data'
      - '\cookies.sqlite'
      - '\logins.json'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\msedgewebview2.exe'
  filter_security:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_path and not filter_browsers and not filter_security
fields:
  - Image
  - TargetFilename
  - User
falsepositives:
  - EDR and DLP agents scanning browser stores
  - Backup software
level: high
tags:
  - attack.credential-access
  - attack.t1555.003
  - attack.t1539

// RecruitTrap phishing infrastructure + infostealer C2 hunt
// Covers: RecruitTrap domain resolution, OAuth token theft follow-on sign-ins, browser credential store access
let RecruitTrapDomains = dynamic(["hbc-careers.com","fifahr-careers.com","mckinsey-careers.com","aa-careers.com","levis-careers.com","andmore-global.com","expedia-careers.com"]);
let Lookback = 30d;
let DNSHits = DeviceNetworkEvents
| where Timestamp > ago(Lookback)
| where RemoteUrl has_any (RecruitTrapDomains) or (RemoteUrl endswith "-careers.com" and RemoteUrl !has "oracle")
| project DNSHitTime=Timestamp, DeviceName, DeviceId, InitiatingProcessFileName, RemoteUrl, RemoteIP;
let CredStoreAccess = DeviceFileEvents
| where Timestamp > ago(Lookback)
| where FolderPath has_any ("\\Google\\Chrome\\User Data\\","\\Microsoft\\Edge\\User Data\\","\\Mozilla\\Firefox\\Profiles\\")
| where FileName in~ ("Login Data","Cookies","Web Data","cookies.sqlite","logins.json")
| where InitiatingProcessFolderPath !has_any ("\\chrome.exe","\\msedge.exe","\\firefox.exe")
| where InitiatingProcessFolderPath !startswith @"C:\Program Files"
| project CredAccessTime=Timestamp, DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessSHA256, FolderPath, FileName;
let COMHijack = DeviceRegistryEvents
| where Timestamp > ago(Lookback)
| where RegistryKey has @"\Software\Classes\CLSID\" and RegistryKey endswith @"\InprocServer32"
| where InitiatingProcessFolderPath !startswith @"C:\Program Files" and InitiatingProcessFolderPath !startswith @"C:\Windows\System32"
| project COMTime=Timestamp, DeviceName, DeviceId, InitiatingProcessFileName, RegistryKey, RegistryValueData;
DNSHits
| join kind=fullouter CredStoreAccess on DeviceId
| join kind=fullouter COMHijack on DeviceId
| extend SuspicionScore = (iff(isnotempty(RemoteUrl),1,0) + iff(isnotempty(FileName),1,0) + iff(isnotempty(RegistryKey),1,0))
| project DeviceName, DeviceId, SuspicionScore, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessSHA256, FileName, RegistryKey
| order by SuspicionScore desc, DeviceName asc

# OTX IOC Hunt: Rhadamanthys/Oyster persistence artifacts + RecruitTrap network indicators
# Run elevated on endpoints; outputs findings to console and CSV
$findings = @()
$otxHashes = @(
    '4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b14',
    'bb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7',
    'c398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14ef',
    '5226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd',
    'c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1c',
    '20ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d',
    '66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bd',
    'b1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fb'
)
$phishDomains = @('hbc-careers.com','fifahr-careers.com','mckinsey-careers.com','aa-careers.com','levis-careers.com','andmore-global.com','expedia-careers.com')

# 1. COM hijacking artifacts - user-scope CLSID registrations pointing to non-standard paths
Write-Host '[*] Checking COM hijack persistence (HKCU CLSID InprocServer32)...' -ForegroundColor Cyan
Get-ChildItem 'HKCU:\Software\Classes\CLSID' -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.PSChildName -eq 'InprocServer32' } | ForEach-Object {
        $dll = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).'(default)'
        if ($dll -and $dll -notmatch '^C:\\(Windows|Program Files)' ) {
            $findings += [pscustomobject]@{Type='COM-Hijack'; Path=$_.PSPath; Value=$dll}
            Write-Host "[!] Suspicious COM registration: $dll" -ForegroundColor Red
        }
    }

# 2. Oyster/Rhadamanthys persistence - Run keys and suspicious scheduled tasks
Write-Host '[*] Checking Run keys and scheduled tasks...' -ForegroundColor Cyan
foreach ($rk in 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run') {
    Get-ItemProperty $rk -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|Temp|Public\\' } | ForEach-Object {
            $findings += [pscustomobject]@{Type='RunKey'; Path=$rk; Value="$($_.Name)=$($_.Value)"}
            Write-Host "[!] Suspicious Run key: $($_.Name) = $($_.Value)" -ForegroundColor Red
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match 'AppData|Temp' -and $_.TaskPath -notlike '\Microsoft*'
} | ForEach-Object {
    $findings += [pscustomobject]@{Type='ScheduledTask'; Path=$_.TaskName; Value=$_.Actions.Execute}
    Write-Host "[!] Suspicious task: $($_.TaskName) -> $($_.Actions.Execute)" -ForegroundColor Red
}

# 3. Hash sweep of common staging directories
Write-Host '[*] Hashing staging directories against OTX IOCs...' -ForegroundColor Cyan
foreach ($dir in "$env:TEMP","$env:LOCALAPPDATA\Temp","$env:USERPROFILE\Downloads","C:\ProgramData") {
    Get-ChildItem $dir -Recurse -File -Include *.exe,*.dll,*.msi -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($otxHashes -contains $h.ToLower()) {
            $findings += [pscustomobject]@{Type='HashMatch'; Path=$_.FullName; Value=$h}
            Write-Host "[!!] OTX HASH MATCH: $($_.FullName)" -ForegroundColor Red
        }
    }
}

# 4. RecruitTrap phishing - DNS cache and active connections
Write-Host '[*] Checking DNS cache and connections for RecruitTrap domains...' -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $n = $_.Name; $phishDomains | Where-Object { $n -like "*$_*" }
} | ForEach-Object {
    $findings += [pscustomobject]@{Type='DNS-Cache'; Path=$_.Name; Value=$_.Data}
    Write-Host "[!] Phishing domain in DNS cache: $($_.Name)" -ForegroundColor Red
}

# 5. Browser credential store access artifacts (prefetch of unusual processes touching profile dirs)
Write-Host '[*] Checking for stealer prefetch artifacts...' -ForegroundColor Cyan
Get-ChildItem 'C:\Windows\Prefetch' -Filter '*.pf' -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and $_.Name -notmatch 'CHROME|MSEDGE|FIREFOX' } |
    Sort-Object LastWriteTime -Descending | Select-Object -First 0 | Out-Null

$findings | Export-Csv -Path ".\OTX_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
Write-Host "[*] Hunt complete. $($findings.Count) finding(s)." -ForegroundColor Green