StealC, Woodgnat, and Crypto Supply Chain Assaults: OTX Pulse Analysis

---
title: Suspicious Telemetry Domain Connection - StealC/Amadey
id: 5a6b1c9d-4e3f-4a2b-9f1d-8c3b2a1d9e0f
description: Detects network connections to known spoofed telemetry domains associated with StealC and Amadey campaigns.
status: experimental
date: 2026/06/28
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660000000000/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'microsoft-telemetry.at'
            - 'svclsc.com'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Potentially Malicious NPM or Python Execution - JINX-0164
id: 7b8c2d0e-5f4a-3b2c-0e2d-9d4e3f2a1b0c
description: Detects execution of npm or python scripts from suspicious developer-focused domains or unusual child processes associated with JINX-0164.
status: experimental
date: 2026/06/28
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660000000004/
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
product: windows
detection:
    selection_img:
        Image|endswith:
            - '\node.exe'
            - '\python.exe'
    selection_cli:
        CommandLine|contains:
            - 'driver-updater.net'
            - 'live.ong'
            - 'teamicrosoft.com'
    condition: all of selection_*
falsepositives:
    - Legitimate developer scripts
level: high
---
title: Kimsuky KimJongRAT GitHub Download Pattern
id: 8c9d3e1f-0g5b-4c3d-1f3e-0e5f4a3b2c1d
description: Detects download patterns consistent with Kimsuky using GitHub to deliver KimJongRAT via PowerShell.
status: experimental
date: 2026/06/28
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660000000008/
tags:
    - attack.initial_access
    - attack.t1566.001
logsource:
    category: process_creation
product: windows
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
    selection_url:
        CommandLine|contains:
            - 'github.com'
            - 'githubusercontent.com'
    selection_ext:
        CommandLine|contains: '.zip'
    condition: all of selection_*
falsepositives:
    - Administrative software deployment
level: medium

// Hunt for StealC and Amadey C2 indicators
let IoC_Domains = dynamic(['microsoft-telemetry.at', 'svclsc.com', 'goodpanelforgoodjob.com', 'overlapsnowbound.com', 'authorized-logins.net', 'mueleer.com']);
let IoC_IPs = dynamic(['176.124.199.207', '176.111.174.140', '62.60.226.159', '94.154.35.25', '64.188.91.237', '196.251.107.130', '89.36.224.5', '104.200.67.46']);
DeviceNetworkEvents
| where RemoteUrl in (IoC_Domains) or RemoteIP in (IoC_IPs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend IoC_Type = iff(RemoteIP in (IoC_IPs), "IP_Address", "Domain")

// Hunt for JINX-0164 and Woodgnat suspicious process execution
union DeviceProcessEvents, DeviceNetworkEvents
| where (ProcessCommandLine has_any('driver-updater.net', 'live.ong', 'teamicrosoft.com', 'authorized-logins.net')) 
       or (ProcessCommandLine has_any('npm', 'python') and ProcessCommandLine has_any('install', 'troubleshoot'))
| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, InitiatingProcessFileName

# IOC Hunt Script for StealC, Amadey, and JINX-0164 Activity
# Requires Administrative Privileges

$TargetHashes = @(
    "8cef760d11d24fc2e9bbd9f770dca5105854f7ece3b0e6948d7c8b7fdd1765ea",
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be",
    "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470"
)

$MaliciousDomains = @(
    "microsoft-telemetry.at",
    "svclsc.com",
    "authorized-logins.net",
    "driver-updater.net"
)

Write-Host "[+] Checking for active network connections to known C2 domains..." -ForegroundColor Cyan
$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($Conn in $Connections) {
    try {
        $RemoteHost = [System.Net.Dns]::GetHostEntry($Conn.RemoteAddress).HostName
        if ($MaliciousDomains -contains $RemoteHost) {
            Write-Host "[!] Suspicious connection found: $($RemoteHost) (PID: $($Conn.OwningProcess))" -ForegroundColor Red
            Get-Process -Id $Conn.OwningProcess | Select-Object ProcessName, Path
        }
    } catch {
        # Ignore resolution failures
    }
}

Write-Host "[+] Scanning for specific file hashes in common download folders..." -ForegroundColor Cyan
$Paths = @("$env:USERPROFILE\Downloads", "$env:TEMP")
foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $Hash) {
                Write-Host "[!] Malicious file detected: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Hunt Complete."