title: Potential Deno Runtime Abuse - DinDoor Backdoor
id: 4e8b3c2d-1a5f-4b6e-9c7d-8f9a0b1c2d3e
description: Detects the execution of the Deno runtime, which is abused by the DinDoor backdoor (MuddyWater) to execute malicious JavaScript. Deno is not standard on most enterprise Windows endpoints.
status: experimental
date: 2026/04/24
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\deno.exe'
    # Optional: Check for suspicious run arguments often used in DinDoor
    CommandLine|contains:
      - 'run '
      - 'eval '
  condition: selection
falsepositives:
  - Legitimate developer workstations using Deno (rare in enterprise)
level: high
tags:
  - attack.execution
  - attack.t1059.005
---
title: Suspicious PowerShell Execution via ClickFix Technique
id: 5f9c4d3e-2b6g-5c7f-0d8e-9a1b2c3d4e5f
description: Detects PowerShell processes spawned by browsers (ClickFix pattern) or containing obfuscated commands characteristic of "ClickFix" social engineering attacks.
status: experimental
date: 2026/04/24
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\brave.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\pwsh.exe'
  selection_obfuscation:
    CommandLine|contains:
      - 'FromBase64String'
      - 'IEX '
      - 'Invoke-Expression'
      - 'DownloadString'
  condition: all of selection_*
falsepositives:
  - Legitimate web-based troubleshooting tools (rare)
level: high
tags:
  - attack.initial_access
  - attack.t1189
---
title: Network Connection to Non-Standard Port 1337 (TwizAdmin C2)
id: 6g0d5e4f-3c7h-6d8g-1e9f-0b2c3d4e5f6a
description: Detects outbound network connections to port 1337, associated with the TwizAdmin malware C2 panel.
status: experimental
date: 2026/04/24
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 1337
    Initiated: 'true'
  condition: selection
falsepositives:
  - Legitimate development servers or games using this port
level: medium
tags:
  - attack.command_and_control
  - attack.t1071

// Hunt for Deno Runtime execution and Suspicious PowerShell (ClickFix/TwizAdmin)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("deno.exe", "java.exe", "javaw.exe", "powershell.exe", "cmd.exe")
| where ProcessCommandLine has_any ("run", "eval", "FromBase64String", "IEX", "DownloadString") 
   or FolderPath endswith "\\deno.exe"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, FolderPath
| union (DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort == 1337 or RemoteUrl has_any ("fanonlyatn.xyz", "ineracaspsl.site", "serialmenot.com", "ustazazharidrus.com", "account-help.info")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName)

<#
.SYNOPSIS
    Hunt script for TwizAdmin, ClickFix artifacts, and DinDoor backdoors.
.DESCRIPTION
    Checks for running Deno/Java processes, suspicious scheduled tasks, and registry persistence.
#>

Write-Host "[+] Hunting for DinDoor (Deno) and TwizAdmin (Java/Clipper) artifacts..."

# 1. Check for Suspicious Processes
$suspiciousProcs = @("deno", "java", "javaw")
$found = Get-Process | Where-Object { $suspiciousProcs -contains $_.ProcessName } | Select-Object ProcessName, Id, Path

if ($found) {
    Write-Host "[!] WARNING: Found suspicious running processes:" -ForegroundColor Red
    $found | Format-Table -AutoSize
} else {
    Write-Host "[-] No Deno/Java processes detected running." -ForegroundColor Green
}

# 2. Check Registry Run Keys for Suspicious Entries
$runPaths = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

Write-Host "[+] Scanning Registry Run Keys for suspicious persistence..."
foreach ($path in $runPaths) {
    if (Test-Path $path) {
        Get-ItemProperty $path -ErrorAction SilentlyContinue | 
        Get-Member -MemberType NoteProperty | 
        Where-Object { $_.Name -ne "PSPath" -and $_.Name -ne "PSParentPath" } | 
        ForEach-Object {
            $val = (Get-ItemProperty $path).($_.Name)
            if ($val -match ".js" -or $val -match "deno" -or $val -match "http" -or $val -match ".jar") {
                Write-Host "[!] Suspicious entry in $path : $($_.Name) = $val" -ForegroundColor Yellow
            }
        }
    }
}

# 3. Check for TwizAdmin/DinDoor File Presence (Based on common locations)
$pathsToScan = @("$env:TEMP", "$env:APPDATA")
Write-Host "[+] Scanning user directories for .js/.jar/.msi files created recently..."
$recentFiles = Get-ChildItem -Path $pathsToScan -Include *.js, *.jar, *.msi -Recurse -ErrorAction SilentlyContinue | 
                Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
if ($recentFiles) {
    Write-Host "[!] Found recently created script/jar/msi files:" -ForegroundColor Yellow
    $recentFiles | Select-Object FullName, LastWriteTime | Format-Table -AutoSize
}


# Response Priorities

*   **Immediate:** Block all listed IOCs (Domains and IPs) at the network perimeter. Initiate a hunt for processes named `deno.exe` or suspicious Java instances connecting to port 1337.
*   **24h:** If credential stealing (Lumma, Vidar, Redline) is suspected, enforce password resets for privileged accounts and rotate exposed API keys/seed phrases.
*   **1 Week:** Review and harden application allowlisting policies to prevent the execution of unauthorized runtimes like Deno. Conduct security awareness training focused on identifying "ClickFix" style social engineering (fake browser errors/prompts).