---
title: Suspicious PowerShell Download Executable - Vidar/Lumma Vector
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects PowerShell commands downloading executables, often seen in AI-themed lures and TikTok fake tutorials distributing Vidar.
status: experimental
date: 2026/06/11
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/ai-brands-as-bait/
    - https://otx.alienvault.com/pulse/fake-software-tutorials-tiktok/
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'DownloadFile'
            - 'DownloadString'
    filter_legit:
        CommandLine|contains:
            - 'windowsupdate'
            - 'microsoft.com'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate system administration scripts
level: high
---
title: Potential HijackLoader or AsmCrypt Execution Pattern
description: Detects process execution patterns associated with HijackLoader and AsmCrypt often used to load SilabRAT and Vidar.
status: experimental
date: 2026/06/11
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/silabrat/
    - https://otx.alienvault.com/pulse/ai-brands-as-bait/
tags:
    - attack.defense_evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\explorer.exe'
    selection_child:
        Image|contains:
            - '\Temp\'
            - '\AppData\Local\Temp\'
        CommandLine|contains:
            - '/load'
            - '-enc'
            - 'regsvr32'
    condition: selection_parent and selection_child
falsepositives:
    - Software installers
level: medium
---
title: Malicious Python Extension Load - Hades/Miasma Supply Chain
description: Detects Python processes loading suspicious native extensions (.so/.pyd) from non-standard paths, indicative of the Hades/Miasma supply chain attack.
status: experimental
date: 2026/06/11
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/mini-shai-hulud-miasma/
tags:
    - attack.initial_access
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\python.exe'
            - '\python3.exe'
        CommandLine|contains:
            - '.pyd'
            - '.so'
            - '.dll'
    filter_path:
        CommandLine|contains:
            - '\Program Files\'
            - '\ProgramData\'
            - '\Anaconda\'
    condition: selection and not filter_path
falsepositives:
    - Legitimate Python developer environments
level: high

// Hunt for network connections to known IOCs (Domains/IPs)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "msget.run", "d4ug.site", "brokeapt.com", "pan.rongtv.xyz", "pan.ssffaa19.xyz"
) or RemoteIP == "91.199.163.124"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend IOCType = iff(RemoteUrl != "", "Domain", "IP")


kql
// Hunt for PowerShell processes potentially related to Vidar tutorials
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("DownloadFile", "Invoke-WebRequest", "iex") 
   and ProcessCommandLine matches regex @"\.(exe|dll|bat|ps1)"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

# Hunt for specific IOCs found in OTX Pulses
$Hashes = @(    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "6506d31707a399498f934bf9705bcf889f1ecae3dbc6f4ff88d67a8be3d01b2",
    "6d332f814f15f19758d65026bbfd0a8c49671b319ec77b8fa1b27fc48afff7d9"
)

$SuspectIP = "91.199.163.124"

Write-Host "[+] Scanning for Malicious File Hashes..." -ForegroundColor Cyan
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($Hashes -contains $hash) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }

Write-Host "[+] Checking for active network connections to SilabRAT C2 ($SuspectIP)..." -ForegroundColor Cyan
$connections = Get-NetTCPConnection -RemoteAddress $SuspectIP -ErrorAction SilentlyContinue
if ($connections) {
    $connections | ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[!] SUSPICIOUS CONNECTION: PID $($_.OwningProcess) ($($proc.ProcessName)) connected to $SuspectIP" -ForegroundColor Red
    }
} else {
    Write-Host "[-] No active connections found to specific C2 IP." -ForegroundColor Green
}


---

# Response Priorities