StyleSmuggler PSK Agent RAT, Yoba Cryptominer Loader & AD CS ESC1/ESC8 Abuse: OTX Pulse Analysis — Enterprise Detection Pack

---
title: StyleSmuggler Webshell Deployment via Magento CVE-2026-75650
id: a1b2c3d4-0001-4e5f-8a9b-000000000001
status: experimental
description: Detects webshell deployment and shell script dropper execution patterns associated with StyleSmuggler exploitation of Magento/Adobe Commerce via the /paypal/transparent/response/ endpoint. Observed in OTX pulse deploying PSK Agent RAT, zer4.php, and chi_down webshells.
references:
    - https://www.imperva.com/blog/stylesmuggler-exploitation-deploys-psk-agent-rat-against-magento-stores
author: Security Arsenal Threat Intelligence
date: 2026/11/03
tags:
    - attack.initial_access
    - attack.t1190
    - attack.persistence
    - attack.t1505.003
logsource:
    category: webserver
    product: apache
detection:
    selection_uri:
        cs-uri-stem|contains:
            - '/paypal/transparent/response/'
    selection_method:
        cs-method:
            - 'POST'
            - 'PUT'
    selection_ua:
        cs-user-agent|contains:
            - 'curl'
            - 'wget'
            - 'python-requests'
            - 'Go-http-client'
    condition: selection_uri and selection_method and selection_ua
falsepositives:
    - Legitimate PayPal transparent redirect callbacks (should use GET and standard browser user agents)
level: high
---
title: PSK Agent RAT C2 Communication - Windwsecurity Domain
id: a1b2c3d4-0002-4e5f-8a9b-000000000002
status: experimental
description: Detects network connections to known PSK Agent RAT command-and-control infrastructure identified in the StyleSmuggler Magento exploitation campaign.
references:
    - https://www.imperva.com/blog/stylesmuggler-exploitation-deploys-psk-agent-rat-against-magento-stores
author: Security Arsenal Threat Intelligence
date: 2026/11/03
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'windwsecurity.run'
    selection_ip:
        DestinationIp:
            - '132.243.238.178'
            - '86.107.100.105'
    condition: selection_domain or selection_ip
falsepositives:
    - None expected for known malicious infrastructure
level: critical
---
title: YobaLoader DLL Sideloading via Signed AI Application
id: a1b2c3d4-0003-4e5f-8a9b-000000000003
status: experimental
description: Detects DLL sideloading behavior where a malicious DLL is loaded by a legitimate digitally signed executable associated with OpenAI or Anthropic AI applications, as observed in the Yoba malware campaign distributing XMRig cryptominer.
references:
    - https://blog.polyswarm.io/yoba-malware-campaign-abuses-signed-ai-applications-to-evade-detection
author: Security Arsenal Threat Intelligence
date: 2026/11/03
tags:
    - attack.defense_evasion
    - attack.t1574.002
    - attack.execution
logsource:
    category: image_load
    product: windows
detection:
    selection_signed:
        Signed: 'true'
    selection_signer:
        Signature|contains:
            - 'OpenAI'
            - 'Anthropic'
    selection_dll_path:
        ImageLoaded|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Downloads\'
            - '\Public\'
    filter_system_path:
        ImageLoaded|startswith:
            - 'C:\Program Files\'
            - 'C:\Windows\'
    condition: selection_signed and selection_signer and selection_dll_path and not filter_system_path
falsepositives:
    - Legitimate plugins or extensions loaded by AI desktop applications from non-standard paths
level: high
---
title: AD CS ESC1/ESC8 Certificate Abuse via PetitPotam or NTLM Relay
id: a1b2c3d4-0004-4e5f-8a9b-000000000004
status: experimental
description: Detects suspicious certificate enrollment and authentication patterns associated with AD CS ESC1 (misconfigured certificate template) and ESC8 (NTLM relay to AD CS HTTP) abuse. Observed in human-operated intrusions using Teams-based social engineering and Quick Assist.
references:
    - https://www.microsoft.com/en-us/security/blog/2026/10/30/help-desk-impersonation-ad-cs-abuse-investigating-esc1-esc8-intrusion-paths/
author: Security Arsenal Threat Intelligence
date: 2026/11/03
tags:
    - attack.credential_access
    - attack.t1649
    - attack.lateral_movement
    - attack.t1557.001
logsource:
    product: windows
    service: security
detection:
    selection_cert_enroll:
        EventID: 4886
        CertificateTemplate|contains:
            - 'User'
            - 'WebServer'
            - 'Computer'
            - 'DomainController'
    selection_suspicious_requester:
        Requester|contains:
            - 'ANONYMOUS LOGON'
            - 'NT AUTHORITY\SYSTEM'
    selection_nerver:
        EventID: 4887
    condition: selection_cert_enroll and selection_suspicious_requester
falsepositives:
    - Legitimate auto-enrollment from domain controllers (filter by known DC machine accounts)
level: critical

// Hunt for StyleSmuggler / PSK Agent / Yoba / AD CS Abuse Indicators
// Microsoft Sentinel — DeviceNetworkEvents + DeviceProcessEvents + DeviceImageLoadEvents

// Query 1: Network connections to PSK Agent RAT C2 (StyleSmuggler campaign)
let PSK_C2_IPs = dynamic(["132.243.238.178", "86.107.100.105"]);
let PSK_C2_Domains = dynamic(["windwsecurity.run"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(90d)
| where RemoteIP in (PSK_C2_IPs)
   or RemoteUrl has_any (PSK_C2_Domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated desc;

// Query 2: YobaLoader DLL sideloading — signed AI app binaries loading DLLs from non-standard paths
DeviceImageLoadEvents
| where TimeGenerated >= ago(30d)
| where FileName contains "OpenAI" or FileName contains "Anthropic" or FileName contains "ChatGPT" or FileName contains "Claude"
| where FolderPath has_any (@"\AppData\Local\Temp\", @"\AppData\Roaming\", @"\Downloads\", @"\Public\")
| where not (FolderPath startswith @"C:\Program Files" or FolderPath startswith @"C:\Windows")
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated desc;

// Query 3: Quick Assist execution followed by portable runtime staging (AD CS abuse)
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "quickassist.exe"
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated >= ago(30d)
    | where FileName has_any ("python.exe", "bun.exe", "java.exe", "node.exe")
    | where FolderPath has_any (@"\AppData\Local\Temp\", @"\Downloads\", @"\Public\")
) on DeviceName
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine,
          FileName1, FolderPath1, ProcessCommandLine1, InitiatingProcessAccountName
| sort by TimeGenerated desc;

// Query 4: Rclone execution (exfiltration staging — AD CS abuse)
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "rclone.exe" or ProcessCommandLine has "rclone"
| where ProcessCommandLine has_any ("copy", "sync", "move", "--config")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessAccountName, FolderPath
| sort by TimeGenerated desc;

# Security Arsenal — IOC Hunt Script
# Targets: StyleSmuggler/PSK Agent, YobaLoader, AD CS ESC1/ESC8 artifacts
# Run as Administrator on endpoints and servers
# Author: Security Arsenal Threat Intelligence | 2026-11-03

$ErrorActionPreference = 'SilentlyContinue'
$Findings = @()

Write-Host "[+] Security Arsenal IOC Hunt — 2026-11-03" -ForegroundColor Cyan
Write-Host "[+] Targeting: PSK Agent RAT, YobaLoader/XMRig, AD CS ESC1/ESC8 artifacts`n" -ForegroundColor Cyan

# ────────────────────────────────────────────────────────
# 1. Check for PSK Agent RAT C2 network connections
# ────────────────────────────────────────────────────────
Write-Host "[1/7] Checking for active connections to PSK Agent C2 infrastructure..." -ForegroundColor Yellow
$C2IPs = @('132.243.238.178', '86.107.100.105')
foreach ($ip in $C2IPs) {
    $conns = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq $ip }
    if ($conns) {
        foreach ($conn in $conns) {
            $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
            $Findings += [PSCustomObject]@{
                Category   = 'PSK Agent C2 Connection'
                Severity   = 'CRITICAL'
                Detail     = "Active connection to $ip by process $($proc.ProcessName) (PID: $($conn.OwningProcess))"
                Source     = 'NetTCPConnection'
            }
        }
    }
}
# Check DNS cache for windwsecurity.run
$dnsCache = Get-DnsClientCache | Where-Object { $_.Entry -like '*windwsecurity*' }
if ($dnsCache) {
    foreach ($entry in $dnsCache) {
        $Findings += [PSCustomObject]@{
            Category   = 'PSK Agent C2 DNS Resolution'
            Severity   = 'CRITICAL'
            Detail     = "DNS cache entry: $($entry.Entry) -> $($entry.Data)"
            Source     = 'DnsClientCache'
        }
    }
}

# ────────────────────────────────────────────────────────
# 2. Check for known malicious file hashes (SHA256)
# ────────────────────────────────────────────────────────
Write-Host "[2/7] Scanning for known malicious file hashes..." -ForegroundColor Yellow
$MaliciousHashes = @(
    'fc9bcdb3a442880e585d6fe4ddaec62d62af641f8ac3cceeb6a553985a7d9094',
    '6dbfb04c063170af13a8151346898ebcb9c4b827fa8d16a96018419b746601a6',
    '1811a1d63310737e969348d16d95f80bf56f8e8896fc64eb5d6d6dc314e2a547',
    '06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7',
    '85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17',
    'f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001'
)
$ScanPaths = @(
    "$env:TEMP",
    "$env:USERPROFILE\Downloads",
    "$env:USERPROFILE\Desktop",
    "$env:APPDATA",
    "$env:LOCALAPPDATA\Temp",
    "C:\ProgramData"
)
foreach ($path in $ScanPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($hash -and ($MaliciousHashes -contains $hash.ToLower())) {
                $Findings += [PSCustomObject]@{
                    Category   = 'Known Malicious File'
                    Severity   = 'CRITICAL'
                    Detail     = "Malicious file found: $($_.FullName) | SHA256: $hash"
                    Source     = 'FileHashScan'
                }
            }
        }
    }
}

# ────────────────────────────────────────────────────────
# 3. Check for PHP webshells (zer4.php, chi_down) on web servers
# ────────────────────────────────────────────────────────
Write-Host "[3/7] Checking for PHP webshells (zer4.php, chi_down)..." -ForegroundColor Yellow
$WebPaths = @(
    "C:\inetpub\wwwroot",
    "C:\xampp\htdocs",
    "D:\websites",
    "/var/www/html"
)
$WebshellNames = @('zer4.php', 'chi_down.php', 'chi_down')
foreach ($webPath in $WebPaths) {
    if (Test-Path $webPath) {
        Get-ChildItem -Path $webPath -Recurse -File -ErrorAction SilentlyContinue | Where-Object {
            $WebshellNames -contains $_.Name
        } | ForEach-Object {
            $Findings += [PSCustomObject]@{
                Category   = 'Webshell Detected'
                Severity   = 'CRITICAL'
                Detail     = "Webshell found: $($_.FullName) | Size: $($_.Length) bytes | Modified: $($_.LastWriteTime)"
                Source     = 'WebshellScan'
            }
        }
    }
}

# ────────────────────────────────────────────────────────
# 4. Check for suspicious DLLs alongside signed AI application binaries (Yoba)
# ────────────────────────────────────────────────────────
Write-Host "[4/7] Checking for YobaLoader DLL sideloading artifacts..." -ForegroundColor Yellow
$SuspiciousDLLPaths = @(
    "$env:LOCALAPPDATA\Temp",
    "$env:APPDATA",
    "$env:USERPROFILE\Downloads"
)
foreach ($dllPath in $SuspiciousDLLPaths) {
    if (Test-Path $dllPath) {
        Get-ChildItem -Path $dllPath -Recurse -Filter "*.dll" -ErrorAction SilentlyContinue | ForEach-Object {
            $sig = Get-AuthenticodeSignature -FilePath $_.FullName -ErrorAction SilentlyContinue
            if ($sig.Status -ne 'Valid') {
                $Findings += [PSCustomObject]@{
                    Category   = 'Unsigned/Suspicious DLL in User Path'
                    Severity   = 'HIGH'
                    Detail     = "Unsigned DLL: $($_.FullName) | Size: $($_.Length) bytes | Created: $($_.CreationTime)"
                    Source     = 'DLLScan'
                }
            }
        }
    }
}

# ────────────────────────────────────────────────────────
# 5. Check for XMRig miner artifacts
# ────────────────────────────────────────────────────────
Write-Host "[5/7] Checking for XMRig cryptominer artifacts..." -ForegroundColor Yellow
$XMRigPatterns = @('xmrig', 'xmr-stak', 'minergate', 'cryptonight', 'monero')
$XMRigPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "C:\ProgramData")
foreach ($xmPath in $XMRigPaths) {
    if (Test-Path $xmPath) {
        Get-ChildItem -Path $xmPath -Recurse -File -ErrorAction SilentlyContinue | Where-Object {
            $name = $_.Name.ToLower()
            $XMRigPatterns | Where-Object { $name -like "*$_*" }
        } | ForEach-Object {
            $Findings += [PSCustomObject]@{
                Category   = 'XMRig Miner Artifact'
                Severity   = 'HIGH'
                Detail     = "Potential miner file: $($_.FullName) | Size: $($_.Length) bytes"
                Source     = 'MinerScan'
            }
        }
    }
}
# Check for high-CPU processes commonly associated with cryptomining
$highCPU = Get-Process | Where-Object { $_.CPU -gt 500 -and $_.ProcessName -notmatch '^(system|idle|svchost|csrss|lsass|MsMpEng)$' }
if ($highCPU) {
    foreach ($proc in $highCPU) {
        $Findings += [PSCustomObject]@{
            Category   = 'Suspicious High-CPU Process (Potential Miner)'
            Severity   = 'MEDIUM'
            Detail     = "Process: $($proc.ProcessName) (PID: $($proc.Id)) | CPU: $($proc.CPU) | Path: $($proc.Path)"
            Source     = 'ProcessScan'
        }
    }
}

# ────────────────────────────────────────────────────────
# 6. Check for Quick Assist remote access artifacts (AD CS abuse vector)
# ────────────────────────────────────────────────────────
Write-Host "[6/7] Checking for Quick Assist usage artifacts..." -ForegroundColor Yellow
$QuickAssistLogs = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-RemoteAssistance/Operational'; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue
if ($QuickAssistLogs) {
    foreach ($event in $QuickAssistLogs) {
        $Findings += [PSCustomObject]@{
            Category   = 'Quick Assist Remote Session'
            Severity   = 'MEDIUM'
            Detail     = "EventID $($event.Id): $($event.Message.Substring(0, [Math]::Min(200, $event.Message.Length))) | Time: $($event.TimeCreated)"
            Source     = 'RemoteAssistanceLog'
        }
    }
}

# ────────────────────────────────────────────────────────
# 7. Check for Rclone staging (exfiltration tool from AD CS abuse pulse)
# ────────────────────────────────────────────────────────
Write-Host "[7/7] Checking for Rclone staging artifacts..." -ForegroundColor Yellow
$RclonePaths = @("$env:TEMP", "$env:APPDATA", "$env:USERPROFILE\Downloads", "C:\ProgramData", "C:\Tools")
foreach ($rcPath in $RclonePaths) {
    if (Test-Path $rcPath) {
        Get-ChildItem -Path $rcPath -Recurse -Filter "rclone*" -ErrorAction SilentlyContinue | ForEach-Object {
            $Findings += [PSCustomObject]@{
                Category   = 'Rclone Exfiltration Tool Detected'
                Severity   = 'HIGH'
                Detail     = "Rclone artifact: $($_.FullName) | Size: $($_.Length) bytes | Modified: $($_.LastWriteTime)"
                Source     = 'RcloneScan'
            }
        }
    }
}
# Check for rclone config files
$rcloneConfig = Get-ChildItem -Path "$env:USERPROFILE\.config\rclone" -ErrorAction SilentlyContinue
if ($rcloneConfig) {
    $Findings += [PSCustomObject]@{
        Category   = 'Rclone Configuration Detected'
        Severity   = 'HIGH'
        Detail     = "Rclone config directory found: $($rcloneConfig.FullName)"
        Source     = 'RcloneConfig'
    }
}

# ────────────────────────────────────────────────────────
# Output Results
# ────────────────────────────────────────────────────────
Write-Host "`n══════════════════════════════════════════════════" -ForegroundColor Cyan
Write-Host "  HUNT COMPLETE — $(($Findings | Measure-Object).Count) findings" -ForegroundColor Cyan
Write-Host "══════════════════════════════════════════════════`n" -ForegroundColor Cyan

if ($Findings.Count -gt 0) {
    $Findings | Sort-Object Severity, Category | Format-Table -AutoSize -Wrap
    $Findings | Export-Csv -Path ".\ioc_hunt_findings_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[+] Findings exported to CSV." -ForegroundColor Green
} else {
    Write-Host "[+] No IOC matches found on this host." -ForegroundColor Green
}