---
title: AI-Themed Malvertising and Phishing - Storm-3075 Indicators
id: 6c8d9f4e-2a1b-4c3d-8e5f-6a7b8c9d0e1f
description: Detects suspicious processes and network connections associated with Storm-3075 AI impersonation campaigns, including Vidar, Lumma Stealer, and Hijack Loader
author: Security Arsenal
date: 2026/06/13
modified: 2026/06/13
references:
    - https://otx.alienvault.com/pulse/ai-brands-as-bait/
tags:
    - attack.credential_access
    - attack.initial_access
    - attack.t1566 # Phishing
    - attack.t1189 # Drive-by Compromise
logsource:
    category: process_creation
    product: windows
detection:
    selection_loader:
        Image|endswith:
            - '\\HijackLoader.exe'
            - '\\hl.exe'
        CommandLine|contains:
            - '-enc'
            - '-e'
            - 'FromBase64String'
    selection_stealer:
        ParentImage|endswith:
            - '\\powershell.exe'
            - '\\cmd.exe'
            - '\\rundll32.exe'
            - '\\regsvr32.exe'
        Image|contains:
            - 'vidar'
            - 'lumma'
            - 'stealer'
    selection_network:
        Initiated: 'true'
        DestinationIp|contains:
            - '91.199.163.124'
            - '185.221.153.121'
            - '45.112.194.82'
            - '138.226.236.52'
        DestinationPort:
            - 443
            - 8080
    selection_ai_lure:
        CommandLine|contains:
            - 'chatgpt'
            - 'copilot'
            - 'deepseek'
            - 'claude'
            - 'openai'
        Image|endswith:
            - '\\chrome.exe'
            - '\\msedge.exe'
            - '\\firefox.exe'
    condition: 1 of selection*
falsepositives:
    - Legitimate AI tool usage
    - Administrative scripting
level: high
---
title: SilabRAT MaaS Detection - Browser Profile Cloning
id: 7a9e0f5f-3b2c-4d5e-9f6a-7b8c9d0e1f2a
description: Detects SilabRAT browser profile cloning and credential theft activities including HVNC connections and wallet injection
author: Security Arsenal
date: 2026/06/13
modified: 2026/06/13
references:
    - https://otx.alienvault.com/pulse/silabrat-whats-your-power/
tags:
    - attack.credential_access
    - attack.collection
    - attack.t1005 # Data from Local System
    - attack.t1555 # Credentials from Password Stores
logsource:
    category: file_event
    product: windows
detection:
    selection_browser_copy:
        TargetFilename|contains:
            - '\\AppData\\Local\\Google\\Chrome\\User Data\\'
            - '\\AppData\\Local\\Microsoft\\Edge\\User Data\\'
            - '\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\'
        TargetFilename|endswith:
            - '\\Login Data'
            - '\\Cookies'
            - '\\Web Data'
            - '\\History'
        Image|endswith:
            - '\\explorer.exe'
            - '\\powershell.exe'
    selection_wallet:
        TargetFilename|contains:
            - 'metamask'
            - 'phantom'
            - 'coinbase'
            - 'trust'
    selection_silabrat_hash:
        Hashes|contains:
            - '3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b'
            - '79f8da9f9fb4ac7c16d9c210f1f6ef418357a3e7bf602b1dd03a490596fa58c5'
            - 'fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623'
            - 'fbce30a0c852972fdc24f1b6a7c270512a50ef1a7c6c88c88b92a2dcbdfdd023'
    condition: 1 of selection_
falsepositives:
    - Legitimate browser backup tools
    - User profile migration
level: critical
---
title: 4BID Hacktivist ProxyShell Exploitation and C2 Frameworks
id: 8b0f1a6a-4c3d-5e6f-0a7b-8c9d0e1f2a3b
description: Detects 4BID hacktivist campaign activity including ProxyShell exploitation, Sliver/Havoc C2 framework deployment, and BYOVD techniques
author: Security Arsenal
date: 2026/06/13
modified: 2026/06/13
references:
    - https://otx.alienvault.com/pulse/hacktivists-broadening-scope/
tags:
    - attack.initial_access
    - attack.persistence
    - attack.t1190 # Exploit Public-Facing Application
    - attack.t1055 # Process Injection
logsource:
    category: webserver
    product: iis
detection:
    selection_proxyshell:
        cs-uri-query|contains:
            - 'X-AnonResource-Backend'
            - 'X-BEResource'
            - 'X-Rps-CAT'
        cs-uri-stem|contains:
            - '/owa/auth/'
            - '/ecp/'
            - '/mapi/'
            - '/autodiscover/'
    selection_webshell:
        cs-uri-stem|contains:
            - '/fd.aspx'
            - '/shell.aspx'
            - '/error.aspx'
        cs-method: 'POST'
    selection_c2_domains:
        cs-host|contains:
            - 'brokeapt.com'
            - 'rongtv.xyz'
            - 'ssffaa19.xyz'
    selection_user_agent:
        cs-user-agent|contains:
            - 'Sliver'
            - 'Havoc'
            - 'Mythic'
    condition: 1 of selection_
falsepositives:
    - Legitimate Exchange administration
    - Legacy application integration
level: critical


kql
// Hunt for Storm-3075 and SilabRAT network indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("brokeapt.com", "pan.rongtv.xyz", "pan.ssffaa19.xyz") 
    or RemoteIP in ("91.199.163.124", "185.221.153.121", "45.112.194.82", "138.226.236.52")
| extend RiskScore = iif(
    RemotePort in (443, 8080), 
    iff(RemoteUrl has_any ("brokeapt", "rongtv", "ssffaa"), "Critical", "High"),
    "Medium"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, RiskScore
| order by Timestamp desc

// Hunt for Vidar and Lumma Stealer file execution
DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "5455341ed1bbe75a664fca2dd0794c508e1874f75360253a7ff5bc119bc92d80",
    "56d722b0331bf0aaa86bb37483486c6dff6ad9427fc473ed7c3226c21a9bdd23",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "79f8da9f9fb4ac7c16d9c210f1f6ef418357a3e7bf602b1dd03a490596fa58c5",
    "fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623",
    "fbce30a0c852972fdc24f1b6a7c270512a50ef1a7c6c88c88b92a2dcbdfdd023"
)
    or ProcessVersionInfoOriginalFileName in ("Vidar.exe", "Lumma.exe", "HijackLoader.exe", "SilabRAT.exe")
    or ProcessCommandLine has_any ("vidar", "lumma", "stealer", "browser", "wallet")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, SHA256, InitiatingProcessFileName
| order by Timestamp desc

// Hunt for ProxyShell exploitation attempts
SecurityEvent
| where Timestamp > ago(30d)
| where EventID in (5140, 5145, 4624, 4625)
| where TargetUserName has_any ("Exchange", "OWA", "ECP")
    or WorkstationName has_any ("EXCHANGE", "MAIL")
    or SubjectUserName has_any ("EXCHANGE", "MAIL")
| where LogonType in (3, 10) and IpAddress != "-"
| project Timestamp, Computer, SubjectUserName, TargetUserName, IpAddress, LogonType, EventID
| summarize Count = count() by IpAddress, SubjectUserName, TargetUserName
| where Count > 10
| order by Count desc

// Hunt for browser profile theft (SilabRAT behavior)
DeviceFileEvents
| where Timestamp > ago(7d)
| where FolderPath has_any (
    "\\Google\\Chrome\\User Data\\",
    "\\Microsoft\\Edge\\User Data\\",
    "\\Mozilla\\Firefox\\Profiles\\"
)
| where FileName in ("Login Data", "Cookies", "Web Data", "key4.db", "logins.")
| where InitiatingProcessFileName !in ("chrome.exe", "msedge.exe", "firefox.exe", "explorer.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, ActionType, FilePath, SHA256
| order by Timestamp desc


powershell
# IOC Hunt Script for Storm-3075, SilabRAT, and 4BID Campaigns
# Run with elevated privileges on endpoints

param(
    [switch]$Verbose,
    [string]$OutputPath = "$env:TEMP\IOCHunt_$(Get-Date -Format 'yyyyMMdd').csv"
)

$Results = @()

# Known IOCs from OTX Pulses
$KnownDomains = @("brokeapt.com", "pan.rongtv.xyz", "pan.ssffaa19.xyz")
$KnownIPs = @("91.199.163.124", "185.221.153.121", "45.112.194.82", "138.226.236.52")
$KnownHashes = @(
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "5455341ed1bbe75a664fca2dd0794c508e1874f75360253a7ff5bc119bc92d80",
    "56d722b0331bf0aaa86bb37483486c6dff6ad9427fc473ed7c3226c21a9bdd23",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "79f8da9f9fb4ac7c16d9c210f1f6ef418357a3e7bf602b1dd03a490596fa58c5",
    "fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623",
    "fbce30a0c852972fdc24f1b6a7c270512a50ef1a7c6c88c88b92a2dcbdfdd023"
)

# Function to calculate file hash
function Get-FileHash256 {
    param([string]$Path)
    try {
        $hash = (Get-FileHash -Path $Path -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
        return $hash
    } catch {
        return $null
    }
}

# 1. Check for active network connections to C2 infrastructure
if ($Verbose) { Write-Host "Checking network connections..." -ForegroundColor Yellow }
$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | 
    Where-Object { $KnownIPs -contains $_.RemoteAddress }

foreach ($conn in $Connections) {
    $Process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
    $Results += [PSCustomObject]@{
        Type = "NetworkConnection"
        Indicator = $conn.RemoteAddress
        Details = "Process: $($Process.ProcessName) (PID: $($conn.OwningProcess))"
        Severity = "CRITICAL"
        Timestamp = Get-Date
    }
}

# 2. Check for malicious scheduled tasks
if ($Verbose) { Write-Host "Checking scheduled tasks..." -ForegroundColor Yellow }
$SuspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.TaskPath -notmatch "Microsoft" -and 
    $_.Actions.Execute -match "(powershell|cmd|rundll32|regsvr32|wscript)" -and
    $_.Actions.Arguments -match "(-enc|-e|FromBase64String|vidar|lumma|stealer)"
}

foreach ($task in $SuspiciousTasks) {
    $Results += [PSCustomObject]@{
        Type = "ScheduledTask"
        Indicator = $task.TaskName
        Details = "Path: $($task.TaskPath) | Command: $($task.Actions.Execute) $($task.Actions.Arguments)"
        Severity = "HIGH"
        Timestamp = Get-Date
    }
}

# 3. Check for browser profile theft
if ($Verbose) { Write-Host "Checking browser profile access..." -ForegroundColor Yellow }
$UserProfiles = Get-ChildItem "C:\Users" -Directory -ErrorAction SilentlyContinue
$BrowserDataPaths = @(
    "\AppData\Local\Google\Chrome\User Data\Default\Login Data",
    "\AppData\Local\Microsoft\Edge\User Data\Default\Login Data",
    "\AppData\Roaming\Mozilla\Firefox\Profiles\*.sqlite"
)

foreach ($profile in $UserProfiles) {
    foreach ($path in $BrowserDataPaths) {
        $fullPath = Join-Path $profile.FullName $path
        if (Test-Path $fullPath) {
            $acl = Get-Acl $fullPath -ErrorAction SilentlyContinue
            $suspiciousAccess = $acl.Access | Where-Object { 
                $_.FileSystemRights -match "FullControl|Modify|Write" -and 
                $_.IdentityReference -notmatch "System|Administrators|$($profile.Name)"
            }
            
            if ($suspiciousAccess) {
                $Results += [PSCustomObject]@{
                    Type = "BrowserDataAccess"
                    Indicator = $fullPath
                    Details = "Suspicious access by: $($suspiciousAccess.IdentityReference.Value)"
                    Severity = "HIGH"
                    Timestamp = Get-Date
                }
            }
        }
    }
}

# 4. Check for file hashes in common malware locations
if ($Verbose) { Write-Host "Scanning for known malware hashes..." -ForegroundColor Yellow }
$MalwarePaths = @(
    "$env:TEMP",
    "$env:APPDATA",
    "$env:LOCALAPPDATA\Temp",
    "$env:USERPROFILE\Downloads"
)

foreach ($path in $MalwarePaths) {
    if (Test-Path $path) {
        $files = Get-ChildItem -Path $path -Recurse -Include "*.exe", "*.dll", "*.ps1" -ErrorAction SilentlyContinue | 
            Where-Object { $_.Length -gt 0 -and $_.Length -lt 50MB }
        
        foreach ($file in $files) {
            $hash = Get-FileHash256 -Path $file.FullName
            if ($hash -and $KnownHashes -contains $hash) {
                $Results += [PSCustomObject]@{
                    Type = "MalwareFile"
                    Indicator = $hash
                    Details = "Path: $($file.FullName) | Size: $($file.Length) bytes"
                    Severity = "CRITICAL"
                    Timestamp = Get-Date
                }
            }
        }
    }
}

# 5. Check for persistence mechanisms
if ($Verbose) { Write-Host "Checking persistence mechanisms..." -ForegroundColor Yellow }
$RunKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $RunKeys) {
    if (Test-Path $key) {
        $Values = Get-ItemProperty -Path $key -ErrorAction SilentlyContinue
        foreach ($prop in $Values.PSObject.Properties) {
            if ($prop.Name -ne "PSPath" -and $prop.Name -ne "PSParentPath") {
                $value = $prop.Value
                if ($value -match "(vidar|lumma|stealer|hijack|silabrat|-enc|-e|brokeapt|rongtv)") {
                    $Results += [PSCustomObject]@{
                        Type = "Persistence"
                        Indicator = $prop.Name
                        Details = "Key: $key | Value: $value"
                        Severity = "HIGH"
                        Timestamp = Get-Date
                    }
                }
            }
        }
    }
}

# 6. Check for ProxyShell indicators (Exchange servers)
if (Test-Path "C:\Program Files\Microsoft\Exchange Server") {
    if ($Verbose) { Write-Host "Checking Exchange Server for ProxyShell indicators..." -ForegroundColor Yellow }
    $ExchangeLogs = Get-ChildItem "C:\inetpub\logs\LogFiles" -Recurse -Filter "*.log" -ErrorAction SilentlyContinue
    $SuspiciousUA = @("Sliver", "Havoc", "Mythic", "AntSword", "Godzilla", "Behinder")
    
    foreach ($log in $ExchangeLogs) {
        $suspiciousEntries = Select-String -Path $log.FullName -Pattern ($SuspiciousUA -join "|") -ErrorAction SilentlyContinue
        foreach ($entry in $suspiciousEntries) {
            $Results += [PSCustomObject]@{
                Type = "ExchangeCompromise"
                Indicator = "Suspicious User-Agent"
                Details = "File: $($log.Name) | Line: $($entry.LineNumber) | Content: $($entry.Line)"
                Severity = "CRITICAL"
                Timestamp = Get-Date
            }
        }
    }
}

# Output results
if ($Results.Count -gt 0) {
    $Results | Export-Csv -Path $OutputPath -NoTypeInformation
    Write-Host "`n[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] ALERT: Found $($Results.Count) suspicious indicators!" -ForegroundColor Red
    Write-Host "Results saved to: $OutputPath" -ForegroundColor Yellow
    
    $Critical = $Results | Where-Object { $_.Severity -eq "CRITICAL" }
    $High = $Results | Where-Object { $_.Severity -eq "HIGH" }
    
    Write-Host "`nSummary:" -ForegroundColor Cyan
    Write-Host "  CRITICAL: $($Critical.Count)" -ForegroundColor Red
    Write-Host "  HIGH: $($High.Count)" -ForegroundColor Yellow
    
    if ($Verbose) {
        Write-Host "`nCritical Indicators:" -ForegroundColor Red
        $Critical | Format-Table -AutoSize
    }
} else {
    Write-Host "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] No suspicious indicators found." -ForegroundColor Green
}


# Response Priorities