---
title: Suspicious Process Spawn via Steam Wallpaper Engine
id: 48399c8b-1a3d-4e2f-9a5b-6c8d7e9f0a1b
description: Detects potential malware execution spawned by Wallpaper Engine or Steam processes, related to DarkComet/Lumma distribution.
status: experimental
date: 2026/06/17
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\Steam\'
      - 'WallpaperEngine.exe'
  selection_suspicious:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
    CommandLine|contains:
      - '-enc'
      - 'downloadstring'
      - 'iex'
  condition: selection and selection_suspicious
falsepositives:
  - Legitimate wallpaper scripts (rare)
level: high
tags:
  - attack.initial_access
  - attack.t1195
  - attack.execution
---
title: Microsoft Teams Spawning Uncommon Shells
id: 59111d9c-2b4e-5f3g-0b6c-7d9e0f1a2b3c
description: Detects Microsoft Teams spawning command shells or PowerShell, indicative of DragonForce Backdoor.Turn exploitation or side-loading.
status: experimental
date: 2026/06/17
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\Teams.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter:
    CommandLine|contains: 'Update.exe' # Known update mechanism
  condition: selection and not filter
falsepositives:
  - Administrative troubleshooting via Teams
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.persistence
---
title: PowerShell Encoded Command from Browser (ClickFix)
id: 6a222e0d-3c5f-6g4h-1c7d-8e0f1g2h3i4j
description: Detects suspicious encoded PowerShell commands launched by browsers, typical of ClickFix campaigns delivering SmartRAT.
status: experimental
date: 2026/06/17
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - ' -e '
      - ' -Enc '
      - 'FromBase64String'
  condition: selection
falsepositives:
  - Legitimate web applications launching local utilities
level: critical
tags:
  - attack.initial_access
  - attack.t1566
  - attack.execution


kql
// Hunt for network connections to known malicious domains from DragonForce/INC campaigns
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ (
    "crefisa.online",
    "windowsupdate-cdn.com",
    "incblog.su"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP

// Hunt for file hashes associated with Interlock/Steam malware
DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA256 in~ (
    "333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c",
    "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141",
    "fc586cad94e5a10dd5be6a6ae6096bd02dfbfd094365bec87e788ed0798d6f67"
)
| project Timestamp, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessAccountName


powershell
# IOC Hunt Script: Steam Workshop Malware & Persistence
# Checks for suspicious files in Steam Workshop directories and common persistence paths.

$WorkshopPaths = @("$env:ProgramFiles (x86)\Steam\steamapps\workshop", "$env:ProgramFiles\Steam\steamapps\workshop")
$MaliciousExtensions = @(".rar", ".zip", ".bat", ".cmd", ".vbs", ".js")
$SuspiciousHashes = @(
    "18dedc0009f0927cba6425c84cce9883",
    "5620f01284329f561b1839a36be55355",
    "74414ed4b63aadec039b603c32762b80"
)

Write-Host "[+] Scanning Steam Workshop Directories for suspicious archives/scripts..."
foreach ($Path in $WorkshopPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Where-Object {
            $MaliciousExtensions -contains $_.Extension
        } | ForEach-Object {
            Write-Host "[!] Suspicious file found: $($_.FullName)"
        }
    }
}

Write-Host "[+] Scanning Downloads folder for known IOCs..."
$DownloadsPath = "$env:USERPROFILE\Downloads"
if (Test-Path $DownloadsPath) {
    Get-ChildItem -Path $DownloadsPath -File -ErrorAction SilentlyContinue | ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash.ToLower()
        if ($SuspiciousHashes -contains $hash) {
            Write-Host "[CRITICAL] Known malware sample found: $($_.FullName) with hash $hash"
        }
    }
}


# Response Priorities