---
title: Potential NPM Typosquatting Malware Execution
id: 8c7a3b2d-1a9e-4f3c-9b5e-6d4f7e8a9b0c
description: Detects execution of suspicious processes spawned by Node.js or NPM, indicative of malware like Shai-Hulud running in dev environments.
status: experimental
date: 2026/06/18
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - Legitimate build scripts running shell commands
level: high
---
title: ClickFix Infection Chain HTA to MSI
id: 1d2e3f4a-5b6c-7d8e-9f0a-1b2c3d4e5f6a
description: Detects the characteristic infection chain of Potemkin Loader where mshta.exe executes an HTA file that subsequently triggers msiexec.exe.
status: experimental
date: 2026/06/18
tags:
  - attack.initial_access
  - attack.t1191
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  root:
    Image|endswith: '\mshta.exe'
    CommandLine|contains: '.hta'
  child:
    Image|endswith: '\msiexec.exe'
  filter_main_generic:
    ParentImage|contains: '\\'
  timeframe: 30s
  condition: root | by ProcessId and not 1 of filter_*
level: critical
---
title: ShinyHunters MeshCentral Webshell Activity
id: 2f3e4a5b-6c7d-8e9f-0a1b-2c3d4e5f6a7b
description: Detects potential webshell or exploitation activity associated with CVE-2026-35273 on Oracle PeopleSoft, specifically looking for processes associated with MeshCentral agent.
status: experimental
date: 2026/06/18
tags:
  - attack.persistence
  - attack.t1505.003
  - cve.2026.35273
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: 'MeshAgent'
    Image|endswith: '.exe'
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\java.exe'
  condition: selection
falsepositives:
  - Legitimate administration of MeshCentral
level: high

// Hunt for Potemkin ClickFix Network Connections
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("eutialyson.com", "distritovagas.com", "resumeacceptable.com") 
   or InitiatingProcessCommandLine has_any ("inst24.msi", "hte.hta")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort

// Hunt for ShinyHunters C2 Activity
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl contains "azurenetfiles.net" or RemoteIP == "176.120.22.24"
| extend FileHashInfo = parse_(AdditionalFields)
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, FileHashInfo.SHA1, FileHashInfo.SHA256, FileHashInfo.MD5

// Hunt for Malicious NPM Process Spawns
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has_any ("node.exe", "npm.cmd")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, CommandLine

<#
.SYNOPSIS
    IOC Hunt for Shai-Hulud, Potemkin, and ShinyHunters Activity.
.DESCRIPTION
    Checks hosts file for malicious domains and scans for specific file hashes.
#>

$MaliciousDomains = @(
    "87e0bbc636999b.lhr.life",
    "edcf8b03c84634.lhr.life",
    "azurenetfiles.net",
    "resumeacceptable.com",
    "sonra.eutialyson.com",
    "cl.distritovagas.com"
)

$MaliciousHashes = @(
    "c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f",
    "ebcf977806f68af3147e0b78b55f6aed",
    "cc19e502e4201cc974c753b96429027925224f53",
    "2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35",
    "79f7b67ce8b390703f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b"
)

Write-Host "[*] Checking Hosts file for malicious domains..." -ForegroundColor Cyan
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($domain in $MaliciousDomains) {
        if ($HostsContent -match $domain) {
            Write-Host "[!] ALERT: Found domain $domain in hosts file." -ForegroundColor Red
        }
    }
}

Write-Host "[*] Scanning for malicious file hashes (This may take time)..." -ForegroundColor Cyan
$DrivesToScan = @("C:\")
foreach ($drive in $DrivesToScan) {
    if (Test-Path $drive) {
        Get-ChildItem -Path $drive -Recurse -ErrorAction SilentlyContinue | 
        Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | 
        Where-Object { $MaliciousHashes -contains $_.Hash } | 
        ForEach-Object {
            Write-Host "[!] ALERT: Malicious file found: $($_.Path) | Hash: $($_.Hash)" -ForegroundColor Red
        }
    }
}

Write-Host "[*] Checking processes connecting to Malicious IPs..." -ForegroundColor Cyan
$MaliciousIPs = @("176.120.22.24", "77.110.122.58")
Get-NetTCPConnection -ErrorAction SilentlyContinue | 
Where-Object { $MaliciousIPs -contains $_.RemoteAddress } | 
ForEach-Object {
    $Process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    Write-Host "[!] ALERT: Process connected to malicious IP: $($Process.ProcessName) (PID: $($_.OwningProcess)) to $($_.RemoteAddress):$($_.RemotePort)" -ForegroundColor Red
}


# Response Priorities