---
title: Potential ProxyShell Exchange Exploitation Activity
id: 91b98245-0c97-4c9c-aabc-0c6c91e8a7f4
status: experimental
description: Detects potential exploitation of Microsoft Exchange ProxyShell vulnerabilities via suspicious backend ASPX requests.
references:
    - https://securelist.com/tr/hacktivists-broaden-attack-geography/120115/
author: Security Arsenal
date: 2026/06/11
tags:
    - attack.initial_access
    - attack.t1190
    - cve.2021.34473
    - cve.2021.34523
    - cve.2021.31207
logsource:
    product: windows
    service: iis
detection:
    selection:
        c-uri|contains:
            - '/autodiscover.xml'
            - '/mapi/nspi'
            - '/powershell'
        cs-uri-query|contains:
            - 'X-AnonResource-true'
            - 'X-BEResource'
    selection_fd:
        cs-uri-stem|endswith: '/fd.aspx'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: critical
---
title: Suspicious Browser Profile Cloning Activity
id: 3e8a1c91-b4c9-4d5e-9f8e-1a2b3c4d5e6f
status: experimental
description: Detects processes copying browser profile directories (User Data) which is indicative of infostealers like SilabRAT or Lumma Stealer attempting session hijacking.
references:
    - https://www.group-ib.com/blog/silabrat-hijackloader-trojan-malware/
author: Security Arsenal
date: 2026/06/11
tags:
    - attack.credential_access
    - attack.t1555.003
logsource:
    product: windows
    category: file_access
detection:
    selection:
        TargetFilename|contains:
            - '\Google\Chrome\User Data'
            - '\Mozilla\Firefox\Profiles'
            - '\BraveSoftware\Brave-Browser\User Data'
        InitiatorProcessName|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate backup software
level: high
---
title: Hijack Loader Process Injection Pattern
id: 7a9b1c82-d0e1-4f6a-a9b3-2c4d5e6f7a8b
status: experimental
description: Detects execution patterns associated with Hijack Loader, a common loader for Vidar and SilabRAT, often involving suspended processes and shellcode.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/06/08/ai-brands-as-bait-how-threat-actors-are-using-the-ai-hype-in-social-engineering/
author: Security Arsenal
date: 2026/06/11
tags:
    - attack.defense_evasion
    - attack.t1055.004
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
    selection_cli:
        CommandLine|contains:
            - 'HeapAlloc'
            - 'VirtualAlloc'
            - 'CreateThread'
    condition: all of selection*
falsepositives:
    - Low
level: medium

// Hunt for Storm-3075 and SilabRAT Network Indicators
let IOCs = dynamic(["brokeapt.com", "pan.rongtv.xyz", "pan.ssffaa19.xyz", "91.199.163.124", "185.221.153.121", "45.112.194.82"]);
DeviceNetworkEvents
| where RemoteUrl has_any (IOCs) or RemoteIP has_any (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| extend MITRE = "Command and Control / Exfiltration"


kql
// Hunt for Malware File Hashes (Vidar, SilabRAT, BlackReaperRAT)
let MalwareHashes = dynamic([
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "79f8da9f9fb4ac7c16d9c210f1f6ef418357a3e7bf602b1dd03a490596fa58c5"
]);
DeviceProcessEvents
| where SHA256 in (MalwareHashes) or MD5 in (MalwareHashes)
| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, AccountName, SHA256

# IOC Hunter for SilabRAT and Storm-3075 Indicators
$IOC_Hashes = @(
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "5455341ed1bbe75a664fca2dd0794c508e1874f75360253a7ff5bc119bc92d80",
    "56d722b0331bf0aaa86bb37483486c6dff6ad9427fc473ed7c3226c21a9bdd23",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623",
    "fbce30a0c852972fdc24f1b6a7c270512a50ef1a7c6c88c88b92a2dcbdfdd023"
)

Write-Host "[+] Scanning for malware file hashes..."

$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($Drive in $Drives) {
    Write-Host "[INFO] Scanning drive $Drive"
    Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | Where-Object {
        -not $_.PSIsContainer -and $_.Length -gt 0
    } | ForEach-Object {
        $FileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($IOC_Hashes -contains $FileHash) {
            Write-Host "[ALERT] Malware found: $($_.FullName)" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Checking for suspicious scheduled tasks (Persistence)..."
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*powershell*" -or $_.Actions.Execute -like "*cmd*" } | 
    Where-Object { $_.Actions.Arguments -like "*http*" -or $_.Actions.Arguments -like "*downloadstring*" } | 
    Format-List TaskName, TaskPath, Actions


# Response Priorities

*   **Immediate:**
    *   Block all listed IOCs (Domains `brokeapt.com`, IPs `91.199.163.124`, `185.221.153.121`) at the firewall and proxy level.
    *   Scan endpoints using the provided PowerShell script to identify dropped payloads.

*   **24 Hours:**
    *   Conduct credential resets for accounts with potential exposure to Vidar or Lumma Stealers, specifically targeting finance and admin teams.
    *   Review IIS logs for `fd.aspx` and Exchange server logs for ProxyShell indicators.

*   **1 Week:**
    *   Patch Microsoft Exchange servers to mitigate ProxyShell exploitation.
    *   Implement application awareness to detect unauthorized browser profile copying behavior.
    *   Review and restrict software installation policies to prevent malvertising infection chains.