VOLTA Infostealer AI-Assessed Exfiltration + Qubole Cross-Account Abuse: OTX Detection Pack

---
title: VOLTA Infostealer Chrome ABE Bypass Attempt
id: 7a3f1c8e-2b4d-4f9a-9c1e-3d5a7f9b2e1a
status: experimental
description: Detects potential VOLTA infostealer attempts to bypass Chrome Application-Bound Encryption
author: Security Arsenal Threat Intelligence
date: 2026/11/10
references:
    - https://piyolog.hatenadiary.jp/entry/2026/11/09/144357
logsource:
    category: process_creation
    product: windows
detection:
    selection_chrome_path:
        CommandLine|contains:
            - '\\Google\\Chrome\\User Data'
            - '\\Microsoft\\Edge\\User Data'
            - '\\BraveSoftware\\Brave-Browser\\User Data'
    selection_suspicious_access:
        CommandLine|contains:
            - 'Local State'
            - 'Login Data'
            - 'Cookies'
            - 'Web Data'
    filter_legitimate:
        Image|endswith:
            - '\\chrome.exe'
            - '\\msedge.exe'
            - '\\brave.exe'
    condition: selection_chrome_path and selection_suspicious_access and not filter_legitimate
falsepositives:
    - Password managers
    - Legitimate backup software
level: high
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1552.001

---
title: VOLTA Infostealer Telegram C2 Communication
id: 9b2e4d6f-3c5a-4e8b-8d2f-4a6c8e1f3a2b
status: experimental
description: Detects network connections to Telegram API commonly used by VOLTA infostealer for exfiltration
author: Security Arsenal Threat Intelligence
date: 2026/11/10
logsource:
    category: network_connection
    product: windows
detection:
    selection_destination:
        DestinationHostname|contains:
            - 'api.telegram.org'
    selection_suspicious_process:
        Image|endswith:
            - '.exe'
    filter_legitimate_telegram:
        Image|contains:
            - 'Telegram.exe'
            - 'Telegram Desktop'
    condition: selection_destination and selection_suspicious_process and not filter_legitimate_telegram
falsepositives:
    - Legitimate automation scripts using Telegram bots
    - Security tools with Telegram alerting
level: medium
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.exfiltration
    - attack.t1567

---
title: Qubole AWS Cross-Account Role Assumption Anomaly
id: 5c8d2f1a-4b6e-4a9c-7e3d-5b9a2e4c6f8d
status: experimental
description: Detects suspicious AssumeRole API calls from external AWS accounts (cloud logs required)
author: Security Arsenal Threat Intelligence
date: 2026/11/10
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_event:
        eventName: 'AssumeRole'
    selection_external_account:
        userIdentity.accountId: '805246085872'
    filter_known_integration:
        userIdentity.arn|contains:
            - 'qubole-expected-role'
    condition: selection_event and selection_external_account and not filter_known_integration
falsepositives:
    - Legitimate Qubole operations (tune filter to expected role names)
    - Other SaaS providers with cross-account access
level: high
tags:
    - attack.initial_access
    - attack.t1078.004
    - attack.lateral_movement
    - attack.t1550

// Hunt for VOLTA infostealer indicators and behaviors
// Requires: DeviceNetworkEvents, DeviceProcessEvents (Microsoft Defender for Endpoint)

let VoltaHashes = dynamic([
    "57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279",
    "4632e6d7c4ea43050d5b57b2106c9f3d",
    "072863bda727c6859004d8324c20cbfb9ff816cf"
]);

// Hunt 1: File hash matches
union withsource=tableName *
| where tableName == "DeviceFileEvents"
| where SHA256 in~ (VoltaHashes) or MD5 in~ (VoltaHashes) or SHA1 in~ (VoltaHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| extend HuntType = "FileHash"

// Hunt 2: OpenRouter API usage (LLM assessment phase)
| union (
    DeviceNetworkEvents
    | where RemoteUrl contains "openrouter.ai" or RemoteUrl contains "api.telegram.org"
    | where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "Telegram.exe")
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend HuntType = "C2Communication"
)

// Hunt 3: Suspicious browser credential access
| union (
    DeviceProcessEvents
    | where ProcessCommandLine has_any ("Local State", "Login Data", "Cookies", "Web Data")
    | where ProcessCommandLine has_any ("Google\\Chrome", "Microsoft\\Edge", "BraveSoftware")
    | where FileName !in~ ("chrome.exe", "msedge.exe", "brave.exe", "1Password.exe", "KeePass.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName
    | extend HuntType = "CredentialAccess"
)

// Hunt 4: Qubole-related IP addresses
| union (
    DeviceNetworkEvents
    | where RemoteIP in ("45.83.220.211", "57.129.54.120", "185.209.199.73", "89.37.63.175")
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
    | extend HuntType = "QuboleIOCs"
)

| order by TimeGenerated desc
| summarize count() by HuntType, DeviceName, bin(TimeGenerated, 1h)
| render timechart

<#
.SYNOPSIS
    VOLTA Infostealer and Qubole IOC Hunt Script
.DESCRIPTION
    Hunts for VOLTA infostealer artifacts, suspicious network connections,
    and browser credential access patterns on Windows endpoints
.NOTES
    Author: Security Arsenal Threat Intelligence
    Requires: PowerShell 5.1+, Administrative privileges
#>

# Configuration
$ErrorActionPreference = "Continue"
$ReportPath = "$env:TEMP\ThreatHunt_Report_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt"

# Known IOCs
$IOCHashes = @(
    "57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279",
    "4632e6d7c4ea43050d5b57b2106c9f3d",
    "072863bda727c6859004d8324c20cbfb9ff816cf"
)

$IOCIPs = @(
    "45.83.220.211",
    "57.129.54.120",
    "185.209.199.73",
    "89.37.63.175"
)

function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $LogEntry = "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] [$Level] $Message"
    Write-Host $LogEntry
    Add-Content -Path $ReportPath -Value $LogEntry
}

Write-Log "Starting VOLTA Infostealer and Qubole IOC Hunt" "INFO"
Write-Log "Report will be saved to: $ReportPath" "INFO"

# Hunt 1: Check running processes for hash matches
Write-Log "Hunting for malicious file hashes in running processes..." "INFO"
$SuspiciousProcesses = Get-Process | Where-Object {
    $_.Path -and (Test-Path $_.Path)
} | ForEach-Object {
    $FileHash = Get-FileHash -Path $_.Path -Algorithm SHA256 -ErrorAction SilentlyContinue
    if ($IOCHashes -contains $FileHash.Hash) {
        [PSCustomObject]@{
            ProcessName = $_.ProcessName
            PID = $_.Id
            Path = $_.Path
            SHA256 = $FileHash.Hash
        }
    }
}

if ($SuspiciousProcesses) {
    Write-Log "ALERT: Found $($SuspiciousProcesses.Count) processes matching VOLTA IOCs!" "CRITICAL"
    $SuspiciousProcesses | Format-Table -AutoSize | Out-String | Add-Content -Path $ReportPath
} else {
    Write-Log "No hash matches found in running processes" "INFO"
}

# Hunt 2: Check network connections to known C2/exfil IPs
Write-Log "Hunting for network connections to malicious IPs..." "INFO"
$SuspiciousConnections = Get-NetTCPConnection | Where-Object {
    $IOCIPs -contains $_.RemoteAddress
} | ForEach-Object {
    $Process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    [PSCustomObject]@{
        LocalAddress = $_.LocalAddress
        LocalPort = $_.LocalPort
        RemoteAddress = $_.RemoteAddress
        RemotePort = $_.RemotePort
        State = $_.State
        ProcessName = $Process.ProcessName
        PID = $_.OwningProcess
        ProcessPath = $Process.Path
    }
}

if ($SuspiciousConnections) {
    Write-Log "ALERT: Found $($SuspiciousConnections.Count) connections to malicious IPs!" "CRITICAL"
    $SuspiciousConnections | Format-Table -AutoSize | Out-String | Add-Content -Path $ReportPath
} else {
    Write-Log "No connections to known malicious IPs detected" "INFO"
}

# Hunt 3: Check for suspicious access to browser credential stores
Write-Log "Checking for suspicious browser credential file access..." "INFO"
$BrowserPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data",
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Cookies",
    "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Login Data",
    "$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data\Default\Login Data"
)

foreach ($Path in $BrowserPaths) {
    if (Test-Path $Path) {
        $RecentAccess = Get-Item $Path | Select-Object Name, LastAccessTime, LastWriteTime
        $TimeDiff = (Get-Date) - $RecentAccess.LastAccessTime
        
        if ($TimeDiff.TotalMinutes -lt 60) {
            Write-Log "Recent access detected to $($RecentAccess.Name) at $($RecentAccess.LastAccessTime)" "WARNING"
        }
    }
}

# Hunt 4: Check for suspicious registry Run keys (persistence)
Write-Log "Checking registry Run keys for suspicious entries..." "INFO"
$RunKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($KeyPath in $RunKeys) {
    if (Test-Path $KeyPath) {
        $KeyEntries = Get-ItemProperty -Path $KeyPath -ErrorAction SilentlyContinue
        $KeyEntries.PSObject.Properties | ForEach-Object {
            if ($_.Name -notmatch "^(PSPath|PSParentPath|PSChildName|PSDrive|PSProvider)") {
                $Value = $_.Value
                # Check for suspicious patterns
                if ($Value -match "(Temp|AppData\\Local\\Temp|Public\\Documents)" -and 
                    $Value -match "\.(exe|dll|ps1|bat|vbs|js)$") {
                    Write-Log "Suspicious Run key detected: $($_.Name) = $Value" "WARNING"
                }
            }
        }
    }
}

# Hunt 5: Check for scheduled tasks with suspicious characteristics
Write-Log "Checking scheduled tasks for persistence mechanisms..." "INFO"
$SuspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.TaskPath -notlike "\\Microsoft\\*" -and
    $_.State -eq "Ready"
} | ForEach-Object {
    $TaskInfo = $_ | Get-ScheduledTaskInfo
    $Actions = $_.Actions
    foreach ($Action in $Actions) {
        if ($Action.Execute -match "(Temp|AppData|Users\\Public)" -and
            $Action.Execute -match "\.(exe|ps1|bat|vbs|js)$") {
            [PSCustomObject]@{
                TaskName = $_.TaskName
                TaskPath = $_.TaskPath
                Execute = $Action.Execute
                Arguments = $Action.Arguments
                LastRunTime = $TaskInfo.LastRunTime
            }
        }
    }
}

if ($SuspiciousTasks) {
    Write-Log "Found $($SuspiciousTasks.Count) suspicious scheduled tasks" "WARNING"
    $SuspiciousTasks | Format-Table -AutoSize | Out-String | Add-Content -Path $ReportPath
} else {
    Write-Log "No suspicious scheduled tasks detected" "INFO"
}

# Hunt 6: Check DNS cache for OpenRouter/Telegram API calls
Write-Log "Checking DNS cache for LLM/C2 domain resolution..." "INFO"
$DNSCache = Get-DnsClientCache | Where-Object {
    $_.Entry -match "(openrouter\.ai|api\.telegram\.org)"
}

if ($DNSCache) {
    Write-Log "Found DNS cache entries for suspicious domains:" "WARNING"
    $DNSCache | Format-Table -AutoSize | Out-String | Add-Content -Path $ReportPath
}

# Summary
Write-Log "===== HUNT SUMMARY =====" "INFO"
Write-Log "Suspicious Processes: $($SuspiciousProcesses.Count)" "INFO"
Write-Log "Suspicious Connections: $($SuspiciousConnections.Count)" "INFO"
Write-Log "Suspicious Tasks: $($SuspiciousTasks.Count)" "INFO"
Write-Log "Hunt completed. Full report: $ReportPath" "INFO"

# Output to console
if ($SuspiciousProcesses -or $SuspiciousConnections -or $SuspiciousTasks) {
    Write-Host "`n[!] POTENTIAL COMPROMISE DETECTED - Review report: $ReportPath" -ForegroundColor Red
    exit 1
} else {
    Write-Host "`n[+] No indicators of compromise found" -ForegroundColor Green
    exit 0
}