Woodgnat, JINX-0164, and Kimsuky Campaigns: OTX Pulse Analysis — Mistic, AUDIOFIX, and KimJongRAT Detection Pack

---
title: Potential DLL Sideloading via Mistic Backdoor Patterns
id: 5c2e9f1a-1b2c-3d4e-5f6a-7b8c9d0e1f2a
description: Detects potential sideloading activity where a system binary loads a DLL from a suspicious or user-writable directory, a technique used by Woodgnat/Mistic.
status: experimental
author: Security Arsenal
date: 2026/06/29
tags:
    - attack.defense_evasion
    - attack.t1574.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\rundll32.exe'
            - '\svchost.exe'
            - '\regsvr32.exe'
            - '\dllhost.exe'
    filter_legit:
        CommandLine|contains:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate software installers
level: high
---
title: Suspicious MacOS Script Execution via JINX-0164 Vector
id: b1c2d3e4-f5a6-7b8c-9d0e-1f2a3b4c5d6e
description: Detects execution of shell scripts downloaded from suspicious external domains, characteristic of JINX-0164 AUDIOFIX/MINIRAT delivery.
status: experimental
author: Security Arsenal
date: 2026/06/29
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    category: process_creation
    product: macos
detection:
    selection_img:
        Image|endswith:
            - '/bin/sh'
            - '/bin/bash'
            - '/usr/bin/osascript'
    selection_cli:
        CommandLine|contains:
            - 'install.sh'
            - 'curl'
            - 'http://'
    selection_suspicious_urls:
        CommandLine|contains:
            - 'driver-updater.net'
            - 'live.ong'
            - 'teamicrosoft.com'
    condition: selection_img and selection_cli and selection_suspicious_urls
falsepositives:
    - Legitimate developer tooling
level: critical
---
title: Kimsuky GitHub LOTS and KimJongRAT Activity
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
description: Detects processes contacting known Kimsuky C2 infrastructure or downloading artifacts from GitHub/servequake.com used in KimJongRAT campaigns.
status: experimental
author: Security Arsenal
date: 2026/06/29
tags:
    - attack.command_and_control
    - attack.t1102
logsource:
    category: network_connection
    product: windows
detection:
    selection_c2:
        Initiated: 'true'
        DestinationHostname|endswith:
            - 'servequake.com'
            - 'corpsecs.com'
    selection_github:
        DestinationHostname|contains:
            - 'github.com'
        DestinationPort: 443
    filter_github_legit:
        UserAgent|contains:
            - 'git/'
            - 'GitHub Desktop'
    condition: selection_c2 or (selection_github and not filter_github_legit)
falsepositives:
    - Legitimate GitHub access via browser
level: high


kql
// Hunt for Woodgnat and JINX-0164 Network Indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in (
    'mail.authorized-logins.net', 'mueleer.com', 'grande-luna.top', 'oeannon.com', 
    'thomphon.com', 'human-check.top', 'update.update-fall.com',
    'driver-updater.net', 'login.teamicrosoft.com', 'live.ong', 'teams.live.us.org', 
    'live.us.org', 'googleoba.servequake.com'
    )
| extend IOC = RemoteUrl, Device = DeviceName
| project Timestamp, Device, IOC, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc


powershell
# IOC Hunter for Mistic, AudioFix, and KimJongRAT Artifacts
# Requires Admin Privileges

$SuspiciousHashes = @(
    "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be",
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17",
    "9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470",
    "221a39856b37e3c682f62427f1e6b965b36a2405764689c914672770a01a1fa9"
)

$C2Domains = @(
    "authorized-logins.net", "update-fall.com", "driver-updater.net", 
    "teamicrosoft.com", "servequake.com", "corpsecs.com"
)

Write-Host "[+] Scanning for process connections to known C2 domains..." -ForegroundColor Yellow
Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess | 
    ForEach-Object {
        $Process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($Process) {
            $RemoteHostName = try { [System.Net.Dns]::GetHostEntry($_.RemoteAddress).HostName } catch { $_.RemoteAddress }
            foreach ($Domain in $C2Domains) {
                if ($RemoteHostName -like "*$Domain*") {
                    Write-Host "[!] Suspicious Connection Found: $($Process.ProcessName) (PID: $($Process.Id)) connected to $RemoteHostName" -ForegroundColor Red
                }
            }
        }
    }

Write-Host "[+] Scanning file system for known malicious hashes..." -ForegroundColor Yellow
$Drives = Get-PSDrive -PSProvider FileSystem
foreach ($Drive in $Drives) {
    Get-ChildItem -Path $Drive.Root -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { !$_.PSIsContainer } | 
        ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($SuspiciousHashes -contains $Hash) {
                Write-Host "[!] Malicious File Found: $($_.FullName) matches known IOCs" -ForegroundColor Red
            }
        }
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green