TeamPCP & Lumma Stealer Campaigns: OTX Pulse Analysis — Enterprise Credential Theft Detection Pack

---
title: Potential ClickFix PowerShell Downloader
id: 7b3b1f1e-6a2c-4f5b-9a8d-1c2e3f4a5b6c
description: Detects obfuscated PowerShell commands downloading MSI files, typical of ClickFix campaigns delivering Lumma Stealer.
status: stable
author: Security Arsenal
date: 2026/05/02
references:
    - https://otx.alienvault.com/pulse/placeholdertags:
    - attack.execution
    - attack.initial_access
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'IWR'
            - 'DownloadString'
    selection_download:
        CommandLine|contains: '.msi'
    condition: selection and selection_download
falsepositives:
    - Legitimate software installation scripts
level: high
---
title: Suspicious MSBuild Execution from User Context
id: 9c4d2e2f-7b3d-4e6c-8a9b-2d3e4f5a6b7c
description: Detects MSBuild.exe execution triggered by suspicious parent processes or scripts, indicative of TeamPCP Python SDK payload activity.
status: stable
author: Security Arsenal
date: 2026/05/02
references:
    - https://otx.alienvault.com/pulse/placeholdertags:
    - attack.defense_evasion
    - attack.execution
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\msbuild.exe'
    filter_legit:
        ParentImage|contains:
            - '\Visual Studio'
            - '\MSBuild\'
            - '\devenv.exe'
    condition: selection and not filter_legit
falsepositives:
    - Developer build scripts not running from standard IDEs
level: medium
---
title: Suspicious Go Binary Network Activity
id: 0e5f3a4b-8c4d-4e7f-9b1c-3f4e5a6b7c8d
description: Detects unsigned Go binaries establishing network connections, potential GhostSocks or LofyStealer loader activity.
status: stable
author: Security Arsenal
date: 2026/05/02
references:
    - https://otx.alienvault.com/pulse/placeholdertags:
    - attack.command_and_control
    - attack.execution
logsource:
    product: windows
    category: network_connection
detection:
    selection_path:
        Image|not contains:
            - ':\Program Files'
            - ':\Program Files (x86)'
        InitiatingProcessFileName|endswith: '.exe'
    condition: selection_path
falsepositives:
    - Legitimate unsigned tools
level: low


**KQL (Microsoft Sentinel)**

kql
// Hunt for ClickFix PowerShell Activity
DeviceProcessEvents
| where Timestamp >= ago(7d)
| where FileName has "powershell.exe"
| where ProcessCommandLine has_any ("Invoke-WebRequest", "IWR", "DownloadFile", "msi")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

// Hunt for TeamPCP Python SDK Indicators (Domains and Hashes)
let IoC_Domains = dynamic(["aquasecurtiy.org", "retreaw.click", "serv.biz", "serv.xyz", "api.biz"]);
let IoC_Hashes = dynamic(["6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a", "d21a5d08b4614005c8fcd9d0068f0190", "ddd2994acd25bde5ac32a03f1cf30b41", "f31a8953531ffb5c14e2d8347e283e1f8f3c732a5a9a68f611c96f4730e8a7dc"]);
union DeviceNetworkEvents, DeviceFileEvents
| where Timestamp >= ago(3d)
| where RemoteUrl has_any (IoC_Domains) or SHA256 has_any (IoC_Hashes) or MD5 has_any (IoC_Hashes)
| project Timestamp, DeviceName, ActionType, RemoteUrl, SHA256, MD5, InitiatingProcessAccountName


**PowerShell Hunt Script**

powershell
# IOC Hunt Script for TeamPCP, LofyStealer, and GhostSocks Activity
# Requires Administrator privileges

Write-Host "Starting Dark Web Credential Theft IOC Hunt..." -ForegroundColor Cyan

# 1. Check for File Hash Presence
Write-Host "`n[+] Checking for malicious file hashes..." -ForegroundColor Yellow
$hashes = @(
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a",
    "8395c3268d5c5dbae1c7c6d4bb3c318c752ba4608cfcd90eb97ffb94a910eac2",
    "d2a0d5f564628773b6af7b9c11f6b86531a875bd2d186d7081ab62748a800ebb",
    "d21a5d08b4614005c8fcd9d0068f0190",
    "fb203c0ac030a97281960d7c28d86ebf",
    "ddd2994acd25bde5ac32a03f1cf30b41",
    "f31a8953531ffb5c14e2d8347e283e1f8f3c732a5a9a68f611c96f4730e8a7dc",
    "c529217014b732abbe646046c07ce8f0366a42051839d4cb3be5b400285fc728"
)

$drives = @("C:\", "D:\")
foreach ($hash in $hashes) {
    foreach ($drive in $drives) {
        if (Test-Path $drive) {
            Write-Host "Scanning $drive for hash $hash..."
            Get-ChildItem -Path $drive -Recurse -ErrorAction SilentlyContinue | 
                Where-Object { $_.Length -gt 0 } | 
                ForEach-Object { 
                    $fileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                    if ($fileHash -eq $hash) {
                        Write-Host "MATCH FOUND: $($_.FullName)" -ForegroundColor Red
                    }
                }
        }
    }
}

# 2. Check Network Connections for Suspicious Domains
Write-Host "`n[+] Checking active network connections for suspicious domains..." -ForegroundColor Yellow
$suspiciousDomains = @("aquasecurtiy.org", "retreaw.click", "serv.biz", "serv.xyz", "api.biz", "robinhuds.com")
$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

foreach ($conn in $connections) {
    $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
    if ($process -and $conn.RemoteAddress -ne "0.0.0.0") {
        try {
            $remoteHost = [System.Net.Dns]::GetHostEntry($conn.RemoteAddress).HostName
            if ($suspiciousDomains | Where-Object { $remoteHost -like "*$_*" }) {
                Write-Host "Suspicious Connection: PID $($conn.OwningProcess) ($($process.ProcessName)) connected to $remoteHost ($($conn.RemoteAddress))" -ForegroundColor Red
            }
        } catch {
            # Ignore DNS resolution failures
        }
    }
}

Write-Host "`n[+] Hunt Complete." -ForegroundColor Green