title: Potential Avalon Framework Payload Execution
date: 2026/07/03
status: experimental
description: Detects execution of MSBuild from suspicious paths (e.g., inside mounted ISOs or temp directories) associated with Avalon/CrownX infection chains using legal lures.
author: Security Arsenal
references:
    - https://blackpointcyber.com/blog/avalons-path-from-legal-lure-to-crownx-ransom-capabilities/
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\msbuild.exe'
        ParentImage|contains:
            - '\Temp\'
            - 'Desktop'
            - 'Downloads'
        CommandLine|contains: '.iso'
    condition: selection
falsepositives:
    - Legitimate software development from temp directories
level: high
---
title: Mimikatz Credential Dumping via LSASS Access
date: 2026/07/03
status: experimental
description: Detects potential credential dumping using Mimikatz or similar tools targeting LSASS memory, associated with Defence Impairment campaigns via ColdFusion exploitation.
author: Security Arsenal
references:
    - https://www.huntress.com/blog/mimikatz-credential-dumping-defence-impairment
tags:
    - attack.credential_access
    - attack.t1003.001
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess:
            - '0x1010'
            - '0x143a'
            - '0x1410'
            - '0x101a'
        SourceImage|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wmiprvse.exe'
    condition: selection
falsepositives:
    - Legitimate antivirus or system management tools accessing lsass
level: critical
---
title: Suspicious VPN Extension C2 Connection
date: 2026/07/03
status: experimental
description: Detects network connections to known C2 infrastructure associated with malicious VPN browser extensions clipboard stealers.
author: Security Arsenal
references:
    - https://socket.dev/blog/chrome-and-firefox-extensions-free-vpns-add-clipboard-stealers
tags:
    - attack.exfiltration
    - attack.c2
    - attack.traffic_signaling
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp|contains:
            - '77.91.123.'
            - '178.236.252.'
        DestinationPort: 80
    condition: selection
falsepositives:
    - Rare, legitimate traffic to these specific blocks is unlikely
level: high

// Hunt for file hashes associated with TA4922, Avalon, and Mimikatz
let IOCs = dynamic([
    "43dc5b1d4c73d5ed9f4f7f561830079896eeb533a7c21bc577e4e267d5a3aa56", 
    "2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d",
    "4b7301f02b8312ae6de614981f325dbbabee32166630618fdff74615d9a487ba",
    "40859ede262098086962ab00c89f02452aa9941c88c7f4ac002db166179980c6"
]);
DeviceFileEvents
| where SHA256 in IOCs
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| order by Timestamp desc


kql
// Hunt for network connections to Smishing and VPN C2 infrastructure
let MaliciousIPs = dynamic([
    "43.159.168.186", "43.162.84.202", "43.165.6.36", 
    "45.135.162.90", "47.82.154.2", "8.222.134.149",
    "77.91.123.187", "178.236.252.133", "178.236.252.161"
]);
DeviceNetworkEvents
| where RemoteIP in MaliciousIPs
| project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName
| order by Timestamp desc

<#
.SYNOPSIS
    IOC Hunt for Avalon, TA4922, and Mimikatz Hashes.
.DESCRIPTION
    Scans C: drive for specific SHA256 hashes identified in OTX pulses.
#>

$TargetHashes = @(
    "43dc5b1d4c73d5ed9f4f7f561830079896eeb533a7c21bc577e4e267d5a3aa56",
    "b3b63970833b3379ecec2d3ef8fea328fef8dd1c1574b1bcdfebad5bdce9280c",
    "2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d",
    "0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb8",
    "c3587edc48c37656b29bcd3da9458eea",
    "4b7301f02b8312ae6de614981f325dbbabee32166630618fdff74615d9a487ba",
    "40859ede262098086962ab00c89f02452aa9941c88c7f4ac002db166179980c6"
)

Write-Host "Starting IOC Hunt..." -ForegroundColor Cyan

$Matches = Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object { 
        $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($Hash -in $TargetHashes) {
            [PSCustomObject]@{
                Path = $_.FullName
                Hash = $Hash
                Detection = "IOC Match"
            }
        }
    }

if ($Matches) {
    Write-Host "WARNING: Malicious files detected!" -ForegroundColor Red
    $Matches | Format-Table -AutoSize
} else {
    Write-Host "No IOC matches found on local system." -ForegroundColor Green
}


# Response Priorities

*   **Immediate:**
    *   Block all listed IPv4 addresses and `/html/continue.php` URLs at the perimeter.
    *   Run the PowerShell hunt script across endpoints to identify dropped payloads (Avalon, RATs, Mimikatz).
    *   Isolate hosts with confirmed Mimikatz or ColdFusion exploitation indicators.
*   **24 Hours:**
    *   **Credential Audit:** Given the prevalence of infostealers (Avalon, VPN extensions, Smishing), force a password reset for privileged accounts and monitor for anomalous logon attempts (TA4922 global expansion).
    *   Review browser extension lists in enterprise environments for "VPN Go" or "Free VPN by VPN GO" and enforce a blocklist policy.
*   **1 Week:**
    *   Patch Adobe ColdFusion servers against CVE-2023-26360 and CVE-2023-29298.
    *   Update application control policies to block MSBuild execution from user directories (Avalon vector).
    *   Implement stricter email filtering for Proton Drive links and legal document lures.