title: Potential ClickFix Activity - Browser Spawning Shell
id: 4f3e1a2b-6c9d-4a1e-9b2c-3d4e5f6a7b8c
date: 2026/04/25
status: experimental
description: Detects potential ClickFix social engineering activity where a browser process spawns a shell (PowerShell, Bash, CMD) often triggered by fake error messages.
references:
    - https://otx.alienvault.com/pulse/6265c8d0e7e46166c8e3f1e2/
author: Security Arsenal
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1059.001
    - attack.t1566.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wsl.exe'
    filter:
        CommandLine|contains:
            - 'youtube-dl' # Legitimate use case
            - 'vlc' 
    condition: selection and not filter
falsepositives:
    - Legitimate web-based utilities launching command lines
level: high
---
title: DinDoor Backdoor - Deno Runtime Execution via Installer
id: 5a4b2c1d-7d0e-5f2a-0c3d-4e5f6a7b8c9d
date: 2026/04/25
status: experimental
description: Detects the execution of the Deno runtime immediately following an MSI installer, characteristic of the DinDoor backdoor delivery used by MuddyWater.
references:
    - https://otx.alienvault.com/pulse/6265c8d0e7e46166c8e3f1e4/
author: Security Arsenal
tags:
    - attack.execution
    - attack.t1059.006
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        Image|endswith: '\msiexec.exe'
    selection_child:
        Image|contains: '\deno.exe'
        CommandLine|contains: 'run'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate software development using Deno installed via MSI
level: critical
---
title: TwizAdmin C2 Connection - FastAPI Panel Traffic
id: 6b5c3d2e-8e1f-6a3b-1d4e-5f6a7b8c9d0e
date: 2026/04/25
status: experimental
description: Detects network connections to known TwizAdmin FastAPI C2 panels or suspicious traffic on port 1337 associated with the DataBreachPlus operation.
references:
    - https://otx.alienvault.com/pulse/6265c8d0e7e46166c8e3f1e0/
author: Security Arsenal
tags:
    - attack.c2
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection_port:
        DestinationPort: 1337
    selection_ioc:
        DestinationHostname|contains:
            - 'fanonlyatn.xyz'
    condition: 1 of selection*
falsepositives:
    - Legitimate traffic on non-standard ports
level: medium

// Hunt for ClickFix and DinDoor IOCs
let IOCs = dynamic(["fanonlyatn.xyz", "ustazazharidrus.com", "account-help.info", "ineracaspsl.site", "serialmenot.com", "justtalken.com", "31.31.198.206"]);
// Network Events
DeviceNetworkEvents
| where RemoteUrl in (IOCs) or RemoteIP in (IOCs)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| extend ThreatType = iff(RemotePort == 1337, "TwizAdmin C2", "General C2")
| order by Timestamp desc
;
// Process Creation for Deno/Msiexec chain
DeviceProcessEvents
| where InitiatingProcessFileName =~ "msiexec.exe" and FileName =~ "deno.exe"
| project Timestamp, DeviceName, InitiatingProcessCommandLine, CommandLine, FolderPath
| order by Timestamp desc
;

<#
    Security Arsenal Threat Hunt - TwizAdmin & DinDoor
    Checks for active network connections to known malicious IPs/Domains
    and suspicious Deno runtime processes.
#>

$TargetIOCs = @(
    "31.31.198.206",
    "103.241.66.238"
)

Write-Host "[+] Checking Active Network Connections to Known C2s..." -ForegroundColor Cyan

$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

foreach ($IP in $TargetIOCs) {
    $Match = $Connections | Where-Object { $_.RemoteAddress -eq $IP }
    if ($Match) {
        $Process = Get-Process -Id $Match.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[!] ALERT: Connection to $IP found!" -ForegroundColor Red
        Write-Host "    Local Address: $($Match.LocalAddress):$($Match.LocalPort)" -ForegroundColor Yellow
        Write-Host "    Process: $($Process.ProcessName) (PID: $($Match.OwningProcess))" -ForegroundColor Yellow
        Write-Host "    Path: $($Process.Path)" -ForegroundColor Yellow
    }
}

Write-Host "[+] Checking for Deno Runtime Processes (DinDoor)..." -ForegroundColor Cyan
$DenoProcesses = Get-Process -Name "deno" -ErrorAction SilentlyContinue
if ($DenoProcesses) {
    Write-Host "[!] ALERT: Deno runtime detected. Investigate parent chain." -ForegroundColor Red
    $DenoProcesses | ForEach-Object {
        $Parent = Get-Process -Id $_.Parent.ProcessId -ErrorAction SilentlyContinue
        Write-Host "    PID: $($_.Id), Parent: $($Parent.ProcessName), Path: $($_.Path)" -ForegroundColor Yellow
    }
} else {
    Write-Host "[-] No Deno processes found." -ForegroundColor Green
}


# Response Priorities