Vidar/XMRig Factory-v3, Vanta, MacSync ClickFix, UNC6671 Vishing and Storm-2755 AiTM: OTX Credential-Theft Detection Pack

---
title: Factory-v3 Go Loader or Cracked Software Archive Execution
id: 9e1a2f10-8a7c-4b1f-9d2a-vidar001
status: experimental
description: Detects password-protected cracked software launches and Go loader behavior consistent with Vidar/XMRig malvertising delivery
author: Security Arsenal
date: 2026/08/07
logsource:
  category: process_creation
  product: windows
detection:
  selection_archive:
    Image|endswith:
      - '\7z.exe'
      - '\WinRAR.exe'
      - '\rar.exe'
    CommandLine|contains:
      - ' -p'
      - 'crack'
      - 'keygen'
      - 'setup'
  selection_loader:
    Image|endswith:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
    CommandLine|contains:
      - 'factory'
      - 'xmrig'
      - 'vidar'
  condition: selection_archive or selection_loader
fields:
  - Image
  - CommandLine
  - ParentImage
  - Hashes
falsepositives:
  - legitimate software packaging and IT admin archive use
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
  - attack.t1027
---
title: ClickFix Terminal Execution and macOS Stealer Staging
id: 2c7b7a20-4c91-4d6a-macsync002
status: experimental
description: Detects user-coerced Terminal execution followed by curl or osascript staging associated with MacSync fake CAPTCHA intrusions
author: Security Arsenal
date: 2026/08/07
logsource:
  category: process_creation
  product: macos
detection:
  selection_terminal:
    Image|endswith:
      - '/Terminal'
      - '/bash'
      - '/zsh'
      - '/curl'
  selection_cmd:
    CommandLine|contains:
      - 'curl '
      - ' -o '
      - 'chmod +x'
      - 'osascript'
      - 'captcha'
      - 'verify'
  condition: selection_terminal and selection_cmd
fields:
  - Image
  - CommandLine
  - ParentImage
falsepositives:
  - developer shell activity
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
  - attack.t1105
---
title: Okta Passkey or M365 AiTM Phishing Domain Resolution
id: 71aa9d30-77d1-4f0e-aitm003
status: experimental
description: Detects DNS or web access to UNC6671 passkey/Okta lookalikes and Storm-2755 AiTM identity proxy hostnames
author: Security Arsenal
date: 2026/08/07
logsource:
  category: dns
  product: windows
detection:
  selection_domains:
    query|contains:
      - 'oktaenroll.com'
      - 'idokta.com'
      - 'myoktasso.com'
      - 'mypasskeysso.com'
      - 'setupssopasskey.com'
      - 'passkeyms.com'
      - 'keyokta.com'
      - 'portalpasskey.com'
      - 'idp.kualabemo.com'
      - 'idp.keyreniao.com'
      - 'idp.korminel.com'
      - 'msauth.monlinelogicaline.com'
  condition: selection_domains
fields:
  - query
  - answer
  - Image
falsepositives:
  - threat research or blockpage verification
level: critical
tags:
  - attack.credential_access
  - attack.t1557
  - attack.t1071
  - attack.t1656

let PhishDomains = dynamic(['oktaenroll.com','idokta.com','myoktasso.com','mypasskeysso.com','setupssopasskey.com','passkeyms.com','keyokta.com','portalpasskey.com']);
let AiTMHosts = dynamic(['idp.kualabemo.com','idp.keyreniao.com','idp.korminel.com','msauth.monlinelogicaline.com']);
let BadIPs = dynamic(['138.124.118.69','193.29.224.151']);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (PhishDomains) or RemoteUrl has_any (AiTMHosts) or RemoteIP in (BadIPs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort),
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ('crack','keygen','xmrig','vidar','factory','curl ','chmod +x','osascript','captcha','verify')
   or FileName has_any ('7z.exe','WinRAR.exe','bash','zsh','curl','Terminal')
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, SHA256)
| order by TimeGenerated desc

$ErrorActionPreference = 'SilentlyContinue'
$domains = @('oktaenroll.com','idokta.com','myoktasso.com','mypasskeysso.com','setupssopasskey.com','passkeyms.com','keyokta.com','portalpasskey.com','idp.kualabemo.com','idp.keyreniao.com','idp.korminel.com','msauth.monlinelogicaline.com')
$ips = @('138.124.118.69','193.29.224.151')
Write-Output '[+] Active remote connections'
Get-NetTCPConnection | Where-Object { $ips -contains $_.RemoteAddress } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
Write-Output '[+] DNS cache hits'
Get-DnsClientCache | Where-Object { $d = $_.Entry; $domains | Where-Object { $d -like ('*' + $_ + '*') } } | Select-Object Entry,RecordName,RecordType,TimeToLive,Data
Write-Output '[+] Suspicious user-writable executables'
Get-ChildItem -Path $env:USERPROFILEullet
Get-ChildItem -Path $env:USERPROFILE
Downloads,$env:USERPROFILEullet
Desktop,$env:APPDATA,$env:LOCALAPPDATA -Recurse -Include *.exe,*.dll,*.scr,*.pkg,*.dmg -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } | Select-Object FullName,Length,LastWriteTime
Write-Output '[+] Persistence keys'
Get-ItemProperty -Path 'HKCU:ullet
Softwareullet
Microsoftullet
Windowsullet
CurrentVersionullet
Run','HKLM:ullet
Softwareullet
Microsoftullet
Windowsullet
CurrentVersionullet
Run' | Select-Object *
Write-Output '[+] Recent scheduled tasks'
Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddDays(-14) -or $_.Actions.Execute -match 'powershell|curl|bash|rundll32|mshta' } | Select-Object TaskName,TaskPath,State,Actions