TroyDen AI Lures, ClickFix Python RATs, and SessionGate TDS: OTX Pulse Analysis

---
title: Potential LuaJIT Infostealer Execution - TroyDen Lures
id: 6b8a9f1e-2c4d-4b5e-9f1a-2c4d4b5e9f1a
description: Detects execution of LuaJIT processes often used by TroyDen infostealers, potentially spawned from suspicious GitHub download directories.
status: experimental
date: 2026/06/07
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6b8a9f1e2c4d4b5e9f1a
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\luajit.exe'
            - '\lua53.exe'
    filter_legit:
        ParentImage|contains:
            - '\Program Files\'
            - '\Program Files (x86)\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate developer usage of LuaJIT
level: high
tags:
    - attack.execution
    - attack.t1059.001
---
title: Suspicious Finger Protocol and Portable Python Usage - ClickFix
id: 7c9b0g2f-3d5e-5c6f-0g2b-3d5e5c6f0g2b
description: Detects the use of the legacy finger.exe utility or portable python executables spawned from a command line or browser, indicative of ClickFix campaign activity.
status: experimental
date: 2026/06/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/7c9b0g2f3d5e5c6f0g2b
logsource:
    category: process_creation
    product: windows
detection:
    selection_finger:
        Image|endswith: '\finger.exe'
    selection_python:
        Image|contains:
            - '\python.exe'
            - '\ipy.exe'
        CommandLine|contains: '-c'
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
    condition: 1 of selection*
falsepositives:
    - Rare administrative use of finger
level: high
tags:
    - attack.defense_evasion
    - attack.t1218
---
title: Traffic Distribution System (TDS) Domain Connection
id: 8d0c1h3g-4e6f-6d7g-1h3c-4e6f6d7g1h3c
description: Detects network connections to known Traffic Distribution System domains and IP addresses associated with malware distribution ecosystems.
status: experimental
date: 2026/06/04
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/8d0c1h3g4e6f6d7g1h3c
logsource:
    category: network_connection
    product: windows
detection:
    selection_domains:
        Initiated|equals: 'true'
        DestinationHostname|contains:
            - 'teamsvoicehub.com'
            - 'dapala.net'
            - 'staruxaproruha.com'
            - 'guiformat.com'
            - 'forestoaker.com'
    selection_ips:
        DestinationIp|in:
            - '194.150.220.218'
            - '217.156.122.75'
    condition: 1 of selection*
falsepositives:
    - None
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001

// Hunt for ClickFix and TroyDen related process activity
let SuspiciousProcesses = dynamic(["luajit.exe", "python.exe", "ipy.exe", "finger.exe"]);
let SuspiciousDomains = dynamic(["teamsvoicehub.com", "dapala.net", "guiformat.com", "forestoaker.com"]);
// Union of Process and Network events
DeviceProcessEvents
| where FileName in (SuspiciousProcesses) or ProcessCommandLine has_any ("-c", "import http")
| extend IoCType = "Process"
| union (DeviceNetworkEvents
| where RemoteUrl has_any (SuspiciousDomains) or RemoteIP in ("194.150.220.218", "217.156.122.75")
| extend IoCType = "Network")
| project Timestamp, DeviceName, ActionType, FileName, ProcessCommandLine, RemoteUrl, RemoteIP, InitiatingProcessAccountName, IoCType
| order by Timestamp desc

<#
.SYNOPSIS
    IOC Hunter for TroyDen, ClickFix, and Malware Ecosystem campaigns.
.DESCRIPTION
    Checks for network connections to malicious domains, suspicious running processes, 
    and file system artifacts associated with the pulses.
#>

$MaliciousDomains = @("teamsvoicehub.com", "dapala.net", "staruxaproruha.com", "ai-like.net", "mtg-life.net", "novayastaruxa.com", "kevinnotanother.com", "guiformat.com", "forestoaker.com")
$MaliciousIPs = @("194.150.220.218", "217.156.122.75")
$SuspiciousProcesses = @("luajit", "python", "ipy", "finger")

Write-Host "[*] Starting Hunt for OTX Pulse Indicators..." -ForegroundColor Cyan

# 1. Check for malicious processes
Write-Host "[*] Checking for suspicious processes..." -ForegroundColor Yellow
$foundProcesses = Get-Process | Where-Object { $SuspiciousProcesses -contains $_.ProcessName.ToLower() }
if ($foundProcesses) {
    Write-Host "[!] ALERT: Found suspicious processes running:" -ForegroundColor Red
    $foundProcesses | Select-Object ProcessName, Id, Path | Format-Table
} else {
    Write-Host "[+] No suspicious processes found." -ForegroundColor Green
}

# 2. Check DNS Cache for malicious domains
Write-Host "[*] Checking DNS Cache for malicious domains..." -ForegroundColor Yellow
$dnsEntries = Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry }
if ($dnsEntries) {
    Write-Host "[!] ALERT: Found DNS cache entries for malicious domains:" -ForegroundColor Red
    $dnsEntries | Select-Object Entry, Data | Format-Table
} else {
    Write-Host "[+] No malicious DNS entries found." -ForegroundColor Green
}

# 3. Check Established Network Connections
Write-Host "[*] Checking active network connections..." -ForegroundColor Yellow
$connections = Get-NetTCPConnection -State Established | Select-Object LocalPort, RemoteAddress, OwningProcess
foreach ($conn in $connections) {
    if ($MaliciousIPs -contains $conn.RemoteAddress) {
        $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[!] ALERT: Connection to malicious IP $($conn.RemoteAddress) from $($proc.ProcessName) (PID: $($conn.OwningProcess))" -ForegroundColor Red
    }
}

# 4. Check Hosts File
Write-Host "[*] Checking HOSTS file for domain redirections..." -ForegroundColor Yellow
$hostsPath = "$env:windir\System32\drivers\etc\hosts"
if (Test-Path $hostsPath) {
    $hostsContent = Get-Content $hostsPath
    foreach ($line in $hostsContent) {
        if ($line -notmatch "^#" -and $line -match "\S") {
            foreach ($domain in $MaliciousDomains) {
                if ($line -like "*$domain*") {
                    Write-Host "[!] ALERT: Suspicious entry in HOSTS file: $line" -ForegroundColor Red
                }
            }
        }
    }
}

Write-Host "[*] Hunt Complete." -ForegroundColor Cyan