Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Stage 1 – JavaScript Drop: The attacker delivers a malicious .js payload (encoded) via a phishing email. The payload is saved to %TEMP% and executed with wscript.exe.
  2. Stage 2 – PowerShell Launcher: The JavaScript launches PowerShell with the flags -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File, pointing to a secondary script that performs process hollowing.
  3. Stage 3 – Process Hollowing via MsBuild: The PowerShell script spawns MsBuild.exe in suspended mode, injects the malicious payload (a dummy DLL), and resumes the process, achieving execution while appearing as a legitimate build tool.

• Regression Test Script: (PowerShell – run as a normal user, requires no external files)

  # --------------------------------------------------------------
  #  PureLogs Variant Simulation – JavaScript → PowerShell → MsBuild
  # --------------------------------------------------------------
  
  # 1. Create malicious JavaScript (base64‑encoded to mimic obfuscation)
  $jsPayload = @"
  // Malicious JS: launches PowerShell with bypass flags
  var shell = new ActiveXObject("WScript.Shell");
  var psCmd = "powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File ""%TEMP%launch.ps1""";
  shell.Run(psCmd, 0, false);
  "@
  
  $jsPath = "$env:TEMPmalicious.js"
  $jsPayload | Set-Content -Path $jsPath -Encoding ASCII
  
  # 2. Create PowerShell payload that performs process hollowing with MsBuild
  $psPayload = @"
  # Launch MsBuild in suspended mode
  $msbuildPath = (Get-Command MsBuild.exe).Source
  $si = New-Object System.Diagnostics.ProcessStartInfo
  $si.FileName = $msbuildPath
  $si.UseShellExecute = $false
  $si.CreateNoWindow = $true
  $si.Arguments = "/t:Compile"
  $proc = [System.Diagnostics.Process]::Start($si)
  Start-Sleep -Milliseconds 500  # give time for creation
  
  # Simulate hollowing by just writing a dummy file into the process's memory space
  # (real hollowing would use Windows API calls; here we just keep the process alive)
  Write-Host "Process hollowing simulated – MsBuild running"
  "@
  
  $psPath = "$env:TEMPlaunch.ps1"
  $psPayload | Set-Content -Path $psPath -Encoding ASCII
  
  # 3. Execute the JavaScript – this is the entry point the rule watches
  wscript.exe $jsPath
  
  # Wait a short period to ensure logs are generated
  Start-Sleep -Seconds 10

• Cleanup Commands:

  # Terminate any lingering MsBuild processes started by the simulation
  Get-Process MsBuild -ErrorAction SilentlyContinue | Stop-Process -Force
  
  # Remove artefacts
  Remove-Item "$env:TEMPmalicious.js" -ErrorAction SilentlyContinue
  Remove-Item "$env:TEMPlaunch.ps1" -ErrorAction SilentlyContinue