---
title: Potential Stealc Infostealer Execution
description: Detects execution patterns associated with Stealc infostealer, including suspicious process execution and C2 communication patterns observed in recent campaigns.
references:
  - https://otx.alienvault.com/pulse/667b0e3d7c1b3c4c6d8e9f0a
author: Security Arsenal Research
date: 2026/06/28
tags:
  - attack.credential_access
  - attack.collection
  - attack.t1056
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\cmd.exe'
    Image|endswith:
      - '\StealC.exe'
      - '\svchost.exe' # Often masquerades as svchost
      - '\msupdate.exe'
    CommandLine|contains:
      - 'token'
      - 'cookies'
      - 'wallets'
  condition: selection
falsepositives:
  - Legitimate administration tools
level: critical
---
title: Amadey Botnet C2 Traffic
description: Detects potential network traffic to Amadey Command and Control servers based on suspicious host headers and URI structures.
references:
  - https://otx.alienvault.com/pulse/667c1f4e8d2a5d7e0f1a2b3c
author: Security Arsenal Research
date: 2026/06/28
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 80
      - 443
    Initiated: 'true'
    DestinationHostname|contains:
      - 'microsoft-telemetry.at'
      - 'svclsc.com'
    RequestUri|contains:
      - '/ms/index.php'
  condition: selection
falsepositives:
  - Rare
level: high
---
title: Mistic Backdoor Persistence via Scheduled Task
description: Detects the creation of a scheduled task that may be used by Mistic backdoor for persistence, often using obscure names.
references:
  - https://otx.alienvault.com/pulse/667d2a5f9e3b6e8f1a2b3c4d
author: Security Arsenal Research
date: 2026/06/28
tags:
  - attack.persistence
  - attack.t1053
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4698
    TaskName|contains:
      - 'Update'
      - 'Service'
    Command|contains:
      - 'powershell.exe -Enc'
      - 'rundll32.exe'
      - 'regsvr32.exe /s'
    SubjectUserName|contains:
      - 'SYSTEM'
      - 'ADMIN'
  condition: selection
falsepositives:
  - Legitimate software updates
level: medium

// Hunt for network connections to known Stealc/Amadey C2 infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("microsoft-telemetry.at", "svclsc.com", "goodpanelforgoodjob.com", "authorized-logins.net", "corpsecs.com", "servequake.com")
  or RemoteIP in ("176.124.199.207", "176.111.174.140", "62.60.226.159", "104.200.67.46", "89.36.224.5")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort, ActionType
| summarize count() by DeviceName, RemoteUrl

# IOC Hunt Script for Stealc, Amadey, and Mistic Artifacts
# Run as Administrator

$IOC_Hashes = @(
    "8cef760d11d24fc2e9bbd9f770dca5105854f7ece3b0e6948d7c8b7fdd1765ea",
    "ff8d2afd9d7f0a828592fee34ca55d1a3542f7ed",
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be",
    "b6cab0b3aa8e56d2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17",
    "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470"
)

$IOC_Domains = @(
    "microsoft-telemetry.at",
    "svclsc.com",
    "authorized-logins.net",
    "driver-updater.net",
    "teamicrosoft.com",
    "corpsecs.com"
)

Write-Host "[+] Scanning for file hashes..." -ForegroundColor Cyan
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0kb -and $_.Length -lt 5mb } | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hash -in $IOC_Hashes) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) | Hash: $hash" -ForegroundColor Red
        }
    }

Write-Host "[+] Checking DNS cache for malicious domains..." -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | 
    Where-Object { $IOC_Domains -icontains $_.Entry } | 
    ForEach-Object {
        Write-Host "[!] MALICIOUS DOMAIN RESOLUTION: $($_.Entry) -> $($_.Data)" -ForegroundColor Red
    }

Write-Host "[+] Checking for suspicious scheduled tasks..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.State -eq "Ready" } | ForEach-Object {
    $taskInfo = Export-ScheduledTask -TaskName $_.TaskName -TaskPath $_.TaskPath
    if ($taskInfo -match "(rundll32|powershell -Enc|regsvr32)") {
        Write-Host "[!] SUSPICIOUS TASK: $($_.TaskName) at $($_.TaskPath)" -ForegroundColor Yellow
        Write-Host $taskInfo.Actions.Execute
    }
}
Write-Host "[*] Scan complete." -ForegroundColor Green


# Response Priorities

**Immediate:**
*   Block all identified IOCs (IPs, Domains, URLs) at the firewall, proxy, and DNS levels.
*   Initiate a hunt for the file hashes provided across all endpoints using EDR.
*   Isolate any endpoints with confirmed matches or suspicious behavior.

**24h:**
*   If credential-stealing malware (Stealc, Amadey) is suspected or confirmed, force a password reset for all affected users and revoke session tokens.
*   Review VPN and remote access logs for connections originating from infected IPs.
*   Conduct a forensic analysis of the "Mistic" backdoor indicators if targeting matches the sector profile (Insurance, Education, Tech).

**1 week:**
*   Implement application allowlisting to prevent the execution of unsigned binaries in user directories.
*   Harden browser security policies to mitigate cookie/session theft (disable third-party cookies, enforce hardware-bound tokens).
*   Conduct security awareness training focusing on identifying sophisticated social engineering (LinkedIn recruiting scams) and phishing.