Vidar VM-Obfuscated Stealer + ClearFake/Amatera WebDAV Chain (UAT-10820): OTX Pulse Analysis — Enterprise Detection Pack

---
title: Vidar Infostealer - Anti-Analysis and Debugger Detection Behavior
id: 7c3a1e2d-9f4b-4a1c-b8e5-vidar0001anti
description: Detects process behaviors associated with Vidar infostealer anti-analysis routines including NtQueryInformationProcess debugger checks, RDTSC timing abuse, and AV process enumeration via toolhelp snapshot.
status: experimental
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent_browser:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
    selection_child_suspicious:
        Image|endswith:
            - '\rundll32.exe'
            - '\powershell.exe'
            - '\cmd.exe'
            - '\mshta.exe'
            - '\wscript.exe'
    selection_vidar_telemetry:
        CommandLine|contains:
            - 'NtQueryInformationProcess'
            - 'tasklist'
            - 'Get-Process'
    condition: selection_parent_browser and selection_child_suspicious
falsepositives:
    - Browser extension installers and enterprise software updaters spawning script interpreters
level: high
tags:
    - attack.defense_evasion
    - attack.t1497
    - attack.t1057
    - attack.t1059
---
title: ClickFix ClearFake - WebDAV Remote DLL Execution Chain
id: 8d4b2f3e-0a5c-5b2d-c9f6-clearfake002
id: 8d4b2f3e-0a5c-4b2d-c9f6-clearfake002
description: Detects the ClearFake/UAT-10820 infection chain where users are socially engineered via fake CAPTCHA prompts into executing commands that load DLLs over WebDAV (rundll32 with UNC/webdav paths or net use to WebDAV shares).
status: experimental
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_webdav_exec:
        CommandLine|contains:
            - '\\'
            - '@SSL'
            - 'DavWWWRoot'
            - 'http://'
            - 'https://'
    selection_loader:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\mshta.exe'
    selection_paste_lure:
        CommandLine|contains:
            - 'mshta'
            - 'powershell -w hidden'
            - 'iex'
    condition: (selection_webdav_exec and selection_loader) or (selection_loader and selection_paste_lure)
falsepositives:
    - Legitimate intranet WebDAV usage loading signed binaries (rare on workstations)
level: critical
tags:
    - attack.initial_access
    - attack.t1189
    - attack.t1204
    - attack.t1218
    - attack.t1105
---
title: Amatera NetSupport Persistence - RMM Install and Exfil Indicators
id: 9e5c304f-1b6d-4c3e-d0a7-amatera003
description: Detects NetSupport Manager RAT installation artifacts and credential-access behavior following Amatera/ZigCryptoStealer delivery, including suspicious service creation and Telegram API egress patterns.
status: experimental
author: Security Arsenal Threat Intel
logsource:
    category: service_install
    product: windows
detection:
    selection_netsupport_service:
        ServiceName|contains:
            - 'NetSupport'
            - 'client32'
        ServiceFileName|contains:
            - 'client32.exe'
            - 'pcictl.dll'
    selection_tmp_install:
        ServiceFileName|contains:
            - '\AppData\Local\Temp\'
            - '\Users\Public\'
            - '\ProgramData\'
    condition: selection_netsupport_service or (selection_tmp_install and selection_netsupport_service)
falsepositives:
    - Legitimate NetSupport deployments by IT (whitelist known IT-managed install paths and accounts)
level: high
tags:
    - attack.persistence
    - attack.t1543.003
    - attack.command_and_control
    - attack.t1219

// ClearFake / UAT-10820 + Vidar Hunt — Microsoft Sentinel
// Hunts IOC hits, WebDAV execution, EtherHiding/Cloudflare Worker staging, and Telegram C2 egress
let lookback = 14d;
let fileHashes = dynamic(["34c7929e60aa09bffdf458f4ee0b618f65d77e1b77e161f66fb835e35c405cc4",
    "398633479c7d8c0c93616f50d1faaa7f01b5864c89de0911812da60bf90e3358",
    "3a2e69ca13d76af3d9502d352802be4d6aa00cc675da69fccab33dc3a0c914fe",
    "e42890753b9e9e08a29dab78db957677dfb9efd3dfa0aef84184d4257ad1a6f0",
    "abd28aecb2d57660bcd9455333b84d289aa883eaf5cf15def1bf0feb35833aa2",
    "93830d73ddf9665ae4d5665f1cebabd093646ed54356662e1b2a925bc2df681b",
    "7504898b17a9ce05eb9209128bcd0fb67d675a70c8c64f6f624d08b47b2fe3af"]);
let badDomains = dynamic(["leaguejazire.com", "smart.hugo-mapp.co", "paf.hugo-mapp.co", "verification.google"]);
let badIPs = dynamic(["45.150.34.2"]);
let netEvents = DeviceNetworkEvents
    | where TimeGenerated > ago(lookback)
    | where RemoteUrl has_any (badDomains)
       or RemoteIP in (badIPs)
       or (RemoteUrl contains "api.telegram.org" and InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","telegram.exe"))
       or (RemotePort == 443 and InitiatingProcessFileName =~ "rundll32.exe")
    | project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine;
let fileEvents = DeviceFileEvents
    | where TimeGenerated > ago(lookback)
    | where SHA256 in~ (fileHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256;
let procEvents = DeviceProcessEvents
    | where TimeGenerated > ago(lookback)
    | where ProcessCommandLine has_any ("DavWWWRoot", "@SSL\\", "pf.ch", "client32")
       or (FileName =~ "rundll32.exe" and ProcessCommandLine contains "http")
       or (InitiatingProcessFileName has_any ("chrome.exe","msedge.exe","firefox.exe")
           and FileName in~ ("powershell.exe","cmd.exe","mshta.exe","rundll32.exe"))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName;
netEvents | union fileEvents, procEvents
| sort by TimeGenerated desc

<#
.SYNOPSIS
    Hunt for Vidar infostealer + ClearFake/Amatera/UAT-10820 artifacts on Windows endpoints.
.DESCRIPTION
    Checks for IOC file hashes, WebDAV client artifacts, NetSupport Manager persistence,
    suspicious scheduled tasks, Telegram C2 connections, and browser credential store access anomalies.
.EXAMPLE
    .
Hunt-Vidar-ClearFake.ps1 -OutputPath C:\IR\hunt_results.json
#>
param([string]$OutputPath = ".\vidar_clearfake_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').json")

$results = [ordered]@{
    Hostname           = $env:COMPUTERNAME
    ScanTime           = (Get-Date).ToString("o")
    HashHits           = @()
    NetSupportArtifacts = @()
    WebDavArtifacts    = @()
    SuspiciousTasks    = @()
    TelegramConnections = @()
    RunKeyAnomalies    = @()
}

# --- 1. IOC hash sweep (user-writable dirs where stealers/RATs stage) ---
$iocHashes = @(
    "34C7929E60AA09BFFDF458F4EE0B618F65D77E1B77E161F66FB835E35C405CC4",
    "398633479C7D8C0C93616F50D1FAAA7F01B5864C89DE0911812DA60BF90E3358",
    "3A2E69CA13D76AF3D9502D352802BE4D6AA00CC675DA69FCCAB33DC3A0C914FE",
    "E42890753B9E9E08A29DAB78DB957677DFB9EFD3DFA0AEF84184D4257AD1A6F0",
    "ABD28AECB2D57660BCD9455333B84D289AA883EAF5CF15DEF1BF0FEB35833AA2",
    "93830D73DDF9665AE4D5665F1CEBABD093646ED54356662E1B2A925BC2DF681B",
    "7504898B17A9CE05EB9209128BCD0FB67D675A70C8C64F6F624D08B47B2FE3AF"
)
$scanPaths = @("$env:LOCALAPPDATA\Temp", "$env:APPDATA", "C:\Users\Public", "C:\ProgramData")
foreach ($p in $scanPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -File -Include *.exe,*.dll,*.ch -ErrorAction SilentlyContinue |
            ForEach-Object {
                try {
                    $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
                    if ($iocHashes -contains $h) {
                        $results.HashHits += [pscustomobject]@{ Path = $_.FullName; SHA256 = $h }
                    }
                } catch {}
            }
    }
}

# --- 2. NetSupport Manager persistence (UAT-10820 follow-on RAT) ---
$nsPaths = @("$env:ProgramFiles\NetSupport", "${env:ProgramFiles(x86)}\NetSupport",
             "$env:APPDATA\client32.exe", "$env:LOCALAPPDATA\client32.exe", "C:\ProgramData\client32.exe")
foreach ($p in $nsPaths) { if (Test-Path $p) { $results.NetSupportArtifacts += $p } }
Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'NetSupport|client32' -or $_.DisplayName -match 'NetSupport' } |
    ForEach-Object { $results.NetSupportArtifacts += "SERVICE: $($_.Name) [$($_.Status)]" }

# --- 3. WebDAV client cache / recent network providers (ClearFake execution vector) ---
$webdavCache = "$env:SystemRoot\ServiceProfiles\LocalService\AppData\Local\Temp\TfsStore"
if (Test-Path $webdavCache) { $results.WebDavArtifacts += "WebDAV cache present: $webdavCache" }
Get-ChildItem "HKCU:\Network" -ErrorAction SilentlyContinue | ForEach-Object {
    $remote = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).RemotePath
    if ($remote -match 'http|@SSL|DavWWWRoot') { $results.WebDavArtifacts += "Mapped WebDAV: $remote" }
}
Get-ChildItem "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2" -ErrorAction SilentlyContinue |
    Where-Object { $_.PSChildName -match '@SSL|DavWWWRoot|http' } |
    ForEach-Object { $results.WebDavArtifacts += "MountPoint: $($_.PSChildName)" }

# --- 4. Suspicious scheduled tasks (stealer re-exec / RAT persistence) ---
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $actions = $_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }
    if (($actions -join ' ') -match 'Temp|AppData|Public|rundll32.*http|powershell.*-w hidden') {
        $results.SuspiciousTasks += [pscustomobject]@{ Task = $_.TaskName; Action = ($actions -join '; ') }
    }
}

# --- 5. Live Telegram C2 connections (Vidar exfil channel) ---
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -eq 443 } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc -and $proc.Name -notmatch '^(chrome|msedge|firefox|telegram|svchost|Teams|slack)$') {
            try {
                $dns = (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost
            } catch { $dns = $null }
            if ($dns -match 'telegram|t\.me' -or $_.RemoteAddress -match '^(149\.154\.|91\.108\.)') {
                $results.TelegramConnections += [pscustomobject]@{
                    Process = $proc.Name; PID = $_.OwningProcess; RemoteIP = $_.RemoteAddress; DNS = $dns
                }
            }
        }
    }

# --- 6. Run key anomalies ---
foreach ($key in @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
                   "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")) {
    if (Test-Path $key) {
        (Get-ItemProperty $key).PSObject.Properties | Where-Object {
            $_.Value -match 'Temp|AppData.*\.exe|client32|pf\.ch' -and $_.Name -notmatch '^PS'
        } | ForEach-Object { $results.RunKeyAnomalies += "$key :: $($_.Name) = $($_.Value)" }
    }
}

$results | ConvertTo-Json -Depth 5 | Out-File $OutputPath -Encoding UTF8
Write-Host "[+] Hunt complete. Findings written to $OutputPath" -ForegroundColor Green
if ($results.HashHits.Count -or $results.NetSupportArtifacts.Count -or $results.TelegramConnections.Count) {
    Write-Host "[!] HIGH-PRIORITY ARTIFACTS FOUND — escalate to IR immediately." -ForegroundColor Red
}