TroyDen Lure Factory & Argamal RAT: OTX Pulse Analysis — Infostealer & Credential Theft Detection Pack

---
title: Potential Argamal RAT COM Hijacking Persistence
id: b4d3e7a1-8b9c-4d5f-9e1a-2b3c4d5e6f7a
description: Detects modifications to the Windows Color System Calibration Loader registry key, a known persistence mechanism used by Argamal RAT.
author: Security Arsenal
date: 2026/06/08
modified: 2026/06/08
status: experimental
tags:
  - attack.persistence
  - attack.t1546.003
logsource:
  product: windows
  registry:
    EventID: 13
    ObjectName: HKCU\Software\Classes\CLSID\{...}\InprocServer32
detection:
  selection:
    TargetObject|contains: 'Mscms.dll'
    Details|contains: '.dll'
  filter:
    Details|endswith: 'Mscms.dll'
  condition: selection and not filter
falsepositives:
  - Legitimate software installation modifying color profiles
level: high
---
title: Suspicious GitHub Repository Process Execution (TroyDen)
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
description: Detects execution of scripts or binaries from user profiles originating from GitHub, indicative of potential lure-based malware delivery.
author: Security Arsenal
date: 2026/06/08
modified: 2026/06/08
status: experimental
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|contains: 'GitHub'
    Image|endswith:
      - '.exe'
      - '.bat'
      - '.cmd'
      - '.vbs'
    CommandLine|contains:
      - 'prometheus'
      - 'luajit'
  condition: selection
falsepositives:
  - Developer tooling execution from GitHub repositories
level: medium
---
title: PAN-OS Exploit Indicators - Nginx Shellcode Injection
id: e7f8g9h0-i1j2-4k3l-m5n6-o7p8q9r0s1t2
description: Detects potential exploitation of PAN-OS firewall via abnormal nginx process behavior indicative of shellcode injection.
author: Security Arsenal
date: 2026/06/08
modified: 2026/06/08
status: experimental
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  product: firewall
  service: pan-os
detection:
  selection:
    LogType|contains: 'SYSTEM'
    Subtype|contains: 'USER_ID'
    ActionFlags|contains: 'policy-deny'
    Module|contains: 'nginx'
    Message|contains:
      - 'overflow'
      - 'buffer'
  condition: selection
falsepositives:
  - Normal firewall deny logs without exploit context
level: critical

// Hunt for Argamal RAT Registry Persistence
DeviceRegistryEvents
| where RegistryKey contains "CLSID"
| where RegistryKey contains "InprocServer32"
| where RegistryValueData contains @".dll"
| where RegistryKey !contains @"\Mscms.dll"
| project Timestamp, DeviceName, RegistryKey, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessFileName

// Hunt for TroyDen/GitHub Lure Executions
DeviceProcessEvents
| where InitiatingProcessFileName contains "GitHub" or ProcessCommandLine contains "github.com"
| where ProcessCommandLine contains "luajit" or ProcessCommandLine contains "prometheus"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName

// Hunt for Suspicious TDS/Clipper Connections (SessionGate/RemusStealer)
DeviceNetworkEvents
| where RemoteUrl in ("forestoaker.com", "guiformat.com", "baxe.pics")
| or RemoteIP in ("194.150.220.218", "217.156.122.75")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName

# Argamal Persistence Check: Windows Color System Calibration Hijacking
$TargetKey = "HKCU:\Software\Classes\CLSID"
$Suspects = Get-ChildItem -Path $TargetKey -Recurse -ErrorAction SilentlyContinue | Where-Object {
    $_.PSChildName -eq "InprocServer32"
}

foreach ($Suspect in $Suspects) {
    $DllPath = (Get-ItemProperty -Path $Suspect.PSPath -ErrorAction SilentlyContinue)."(default)"
    if ($DllPath -and -not $DllPath.EndsWith("Mscms.dll")) {
        Write-Host "[ALERT] Potential COM Hijack detected at: $($Suspect.PSPath)"
        Write-Host "        Value: $DllPath"
    }
}

# TroyDen/GitHub Lure Check: Suspicious Download/Execution patterns
$GithubProcesses = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4688)]] and *[EventData[Data[@Name='NewProcessName'] and (contains(.,'GitHub') or contains(.,'git.exe'))]] and *[EventData[Data[@Name='CommandLine'] and (contains(.,'luajit') or contains(.,'prometheus'))]]" -ErrorAction SilentlyContinue
if ($GithubProcesses) {
    Write-Host "[ALERT] Potential TroyDen execution via GitHub detected."
    $GithubProcesses | Select-Object TimeCreated, Message | Format-Table -AutoSize
}