Starland RAT + WLDR PowerShell Implant: UAT-11795 ClickFix Campaign — OTX Pulse Analysis & Enterprise Detection Pack

---
title: ClickFix-Style User-Pasted Command Execution
description: Detects execution chains consistent with ClickFix social engineering — Run dialog / Explorer-spawned mshta, powershell, or cmd carrying encoded or remote-download payloads, as used by UAT-11795 to bootstrap the WLDR agent.
id: 8f2c1a4e-7b3d-4e1a-9c5f-2d6a0b8e4f11
status: experimental
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\rundll32.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\cmd.exe'
  selection_flags:
    CommandLine|contains:
      - ' -enc'
      - ' -ec '
      - ' -e '
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'Invoke-WebRequest'
      - 'DownloadString'
      - 'curl'
      - 'https://'
  condition: selection_parent and selection_image and selection_flags
falsepositives:
  - Admin automation launched interactively from Explorer
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204
  - attack.t1105

---
title: Python Interpreter Executing From User-Writable Directory (Starland RAT)
description: Detects python.exe or pythonw.exe launching from AppData/Temp/Public paths or with installer/explorer parentage — consistent with the Starland RAT Python payload deployed via trojanized installers by UAT-11795.
id: 3a7d9e21-5c4b-4f08-8a2e-1d9b6c0e7f22
status: experimental
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_image:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
  selection_paths:
    Image|contains:
      - '\AppData\Local\'
      - '\AppData\Roaming\'
      - '\Temp\'
      - '\Public\'
  selection_parents:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\msiexec.exe'
      - '\setup.exe'
      - '\powershell.exe'
  condition: selection_image and (selection_paths or selection_parents)
falsepositives:
  - Legitimate per-user Python installs and developer tooling
level: medium
tags:
  - attack.execution
  - attack.t1059.006
  - attack.t1204.002

---
title: PowerShell Implant Persistence via Run Key or Scheduled Task (WLDR Agent)
description: Detects registry Run-key modification or scheduled task registration referencing PowerShell, encoded commands, or user-writable script paths — persistence patterns consistent with the WLDR memory implant.
id: 6b1e4c90-2a8f-4d37-b5e9-7c3f1a0d9e33
status: experimental
author: Security Arsenal
logsource:
  category: registry_set
  product: windows
  service: sysmon
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_value:
    Details|contains:
      - 'powershell'
      - 'pwsh'
      - ' -enc'
      - 'FromBase64String'
      - 'IEX'
      - '\AppData\'
      - '.ps1'
  condition: selection_key and selection_value
falsepositives:
  - Software updaters registering PowerShell-based maintenance tasks
level: high
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.t1059.001

// UAT-11795 hunt: ClickFix execution chains, Starland RAT staging, and WLDR C2 beaconing
let Lookback = 14d;
let C2Domains = dynamic(["zynaris.io", "windowscreenrepairnearme.com"]);
// 1) Network connections to known C2 / lure infrastructure
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl has_any (C2Domains)
| project NetTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
// 2) Suspicious PowerShell / ClickFix-style execution
let ProcHits = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where (FileName in~ ("powershell.exe","pwsh.exe","mshta.exe")
        and ProcessCommandLine has_any ("-enc","FromBase64String","IEX","Invoke-Expression","DownloadString","Invoke-WebRequest"))
    or (FileName in~ ("python.exe","pythonw.exe")
        and (FolderPath has_any ("AppData","Temp","Public")
             or InitiatingProcessFileName in~ ("explorer.exe","msiexec.exe","setup.exe")))
| project ProcTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;
union NetHits, ProcHits
| sort by DeviceName, NetTime

# UAT-11795 Endpoint Hunt — Starland RAT, WLDR agent, CastleStealer artifacts
# Run elevated on suspect hosts or deploy via your RMM/EDR live-response shell.

$Report = @()

# --- 1) Registry Run-key persistence referencing PowerShell or user paths ---
$RunPaths = @(
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($path in $RunPaths) {
    if (Test-Path $path) {
        Get-ItemProperty $path | ForEach-Object {
            $_.PSObject.Properties | Where-Object {
                $_.Value -match 'powershell|pwsh|-enc|FromBase64String|IEX|AppData|\.ps1|python'
            } | ForEach-Object {
                $Report += [pscustomobject]@{ Type='RunKey'; Location=$path; Name=$_.Name; Value=$_.Value }
            }
        }
    }
}

# --- 2) Scheduled tasks invoking PowerShell/Python from user-writable paths ---
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match 'powershell|pwsh|-enc|AppData|python' ) {
        $Report += [pscustomobject]@{ Type='ScheduledTask'; Location=$_.TaskPath; Name=$_.TaskName; Value=($actions -replace '\s+',' ').Substring(0,[Math]::Min(200,$actions.Length)) }
    }
}

# --- 3) Starland RAT staging: python executables/interpreters in user-writable dirs ---
$UserPaths = @("$env:APPDATA", "$env:LOCALAPPDATA", "$env:TEMP", "$env:PUBLIC")
foreach ($dir in $UserPaths) {
    Get-ChildItem -Path $dir -Recurse -Include 'python*.exe','*.pyc' -ErrorAction SilentlyContinue |
        Select-Object -First 50 | ForEach-Object {
            $Report += [pscustomobject]@{ Type='PythonArtifact'; Location=$_.DirectoryName; Name=$_.Name; Value="Size: $($_.Length) bytes | Modified: $($_.LastWriteTime)" }
        }
}

# --- 4) Active connections to known UAT-11795 C2 domains ---
$C2 = @('zynaris.io','windowscreenrepairnearme.com')
foreach ($domain in $C2) {
    $ips = Resolve-DnsName $domain -ErrorAction SilentlyContinue | Where-Object { $_.IPAddress } | Select-Object -ExpandProperty IPAddress
    foreach ($ip in $ips) {
        $conns = Get-NetTCPConnection -RemoteAddress $ip -ErrorAction SilentlyContinue
        foreach ($c in $conns) {
            $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
            $Report += [pscustomobject]@{ Type='C2Connection'; Location=$domain; Name=$proc.ProcessName; Value="$($c.LocalAddress):$($c.LocalPort) -> $ip | State: $($c.State)" }
        }
    }
}

if ($Report.Count -gt 0) { $Report | Format-List; $Report | Export-Csv "$env:TEMP\uat11795_hunt.csv" -NoTypeInformation }
else { Write-Output "[+] No UAT-11795 artifacts found on $env:COMPUTERNAME" }