---
title: Potential COM Hijacking Persistence - Windows Color System
id: 4c1c2b1a-1a2b-4c5d-9e8f-1a2b3c4d5e6f
description: Detects registry modifications associated with Argamal malware persistence via Windows Color System Calibration Loader.
author: Security Arsenal
date: 2026/06/08
modified: 2026/06/08
tags:
    - attack.persistence
    - attack.t1574.001
logsource:
    product: windows
    registry:
        - add
        - modify
detection:
    selection:
        TargetObject|contains: '\\CLSID\\'
        TargetObject|contains: 'InprocServer32'
        TargetObject|contains: 'Color System' # Heuristic for the specific target
        Details|re: '.*\\.[^l][^n][^k]$' # Non-LNK/DLL extensions or suspicious paths
    condition: selection
falsepositives:
    - Legitimate software installation
level: high

---
title: Suspicious Child Process of Git or GitHub Desktop
id: 3d2e1f0a-9e8d-7c6b-5a4b-3c2d1e0f9a8b
description: Detects potential TroyDen activity where legitimate Git tools spawn obfuscated scripts or infostealers (LuaJIT, PowerShell).
author: Security Arsenal
date: 2026/06/08
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\git.exe'
            - '\GitHubDesktop.exe'
            - '\cmd.exe' # Often spawned by git bash
    selection_child:
        Image|endswith:
            - '\luajit.exe'
            - '\powershell.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - '-enc' # Encoded commands
            - 'downloadstring'
            - 'iex'
    condition: all of selection_*
falsepositives:
    - Legitimate developer scripts
level: medium

---
title: Traffic Distribution System (TDS) Browser Pattern
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects potential redirection patterns associated with SessionGate TDS (CloudFront JS -> Handoff).
author: Security Arsenal
date: 2026/06/08
logsource:
    category: proxy
    product: suricata
    product: zeek
detection:
    selection_referer:
        referer|contains:
            - 'cloudfront.net'
            - 'github.com'
            - 'sourceforge.net' # Impersonated targets
    selection_destination:
        destination_port: 80
        destination_port: 443
    selection_keywords:
        uri|contains:
            - '.php'
            - 'click'
            - 'redirect'
    condition: all of selection_*
falsepositives:
    - Legitimate ad traffic
level: low


kql
// Hunt for Argamal and related Argamal/Termixia file hashes (SHA1)
DeviceProcessEvents
| where SHA1 in (
    "02819d200d1424882af81cb504b3e8614b32397a",
    "1405a3c5e0aeb08012484134e16cdec4ab29b4a4",
    "17f8f8f34dfa737f36182fed7ff9e9814a114058",
    "2423a5bf0fa7cb9ec09211630a5488629499691b",
    "29f1d346a6e71774c7dad25b90f446b2974393df",
    "42add9475e67a1ccc6a6af94b5475d3defc01b85"
)
| project Timestamp, DeviceName, FolderPath, FileName, ProcessCommandLine, AccountName, SHA1
;

// Network Connections to known TDS / Malware Infrastructure
DeviceNetworkEvents
| where RemoteUrl in (
    "guiformat.com",
    "forestoaker.com",
    "asper1.freeddns.org",
    "arch2.maxdatahost1.cyou",
    "www.whatsappcenter.com"
) or RemoteIP in (
    "194.150.220.218",
    "217.156.122.75"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort, ActionType
;

// Hunt for GriefLure APT indicators (SHA256)
DeviceFileEvents
| where SHA256 in (
    "197f11a7b0003aa7da58a3302cfa2a96a670de91d39ddebc7a51ac1d9404a7e6",
    "35af2cf5494181920b8624c7b719d39590e2a5ff5eaa1a2fa1ba86b2b5aa9b43",
    "61e9d76f07334843df561fe4bac449fb6fdaed5e5eb91480bded225f3d265c5f"
)
| project Timestamp, DeviceName, FolderPath, FileName, SHA256


powershell
# Security Arsenal - Argamal/Termixia Persistence Hunt
# Checks for abnormal InprocServer32 entries in CLSID keys associated with Windows Color System

function Check-ArgamalPersistence {
    $basePath = "Registry::HKCU\Software\Classes\CLSID"
    $suspiciousKeys = @()
    
    if (-not (Test-Path $basePath)) {
        Write-Host "[+] User CLSID path not found. No activity detected."
        return
    }

    # Enumerate all CLSIDs
    $clsids = Get-ChildItem -Path $basePath -ErrorAction SilentlyContinue

    foreach ($clsid in $clsids) {
        $inprocPath = Join-Path -Path $clsid.PSPath -ChildPath "InprocServer32"
        
        if (Test-Path $inprocPath) {
            $defaultVal = (Get-ItemProperty -Path $inprocPath -ErrorAction SilentlyContinue)."(default)"
            
            # Logic: Check if it looks like a DLL but is located in a suspicious user directory (AppData)
            if ($defaultVal -and $defaultVal -match ".dll$") {
                if ($defaultVal -match ":\\Users\\.*\\AppData") {
                    $suspiciousKeys += @{
                        CLSID = $clsid.PSChildName
                        Path  = $defaultVal
                    }
                }
            }
        }
    }

    if ($suspiciousKeys.Count -gt 0) {
        Write-Host "[!] WARNING: Suspicious COM Hijacking entries detected!" -ForegroundColor Red
        $suspiciousKeys | Format-Table -AutoSize
    } else {
        Write-Host "[+] No suspicious COM Hijacking entries found."
    }
}

Check-ArgamalPersistence


---

# Response Priorities