---
title: ClickFix-Style User-Executed Terminal Command (AMOS/Atomic Stealer Delivery)
id: 7a1c2e41-8f3b-4c5d-9e2a-1b4f6d8a0c11
status: experimental
description: Detects ClickFix social engineering pattern where users paste curl/wget piped to shell, commonly delivering AMOS/Atomic macOS Stealer or cross-platform RATs such as NetSupport.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: macos
detection:
  selection_shell:
    Image|endswith:
      - '/zsh'
      - '/bash'
      - '/sh'
  selection_pipe:
    CommandLine|contains:
      - 'curl'
      - 'wget'
  selection_exec:
    CommandLine|contains:
      - '| sh'
      - '| bash'
      - '| zsh'
      - 'base64 -d'
      - 'osascript'
  filter_terminal:
    ParentImage|endswith:
      - '/Terminal.app/Contents/MacOS/Terminal'
      - '/iTerm2'
  condition: selection_shell and selection_pipe and selection_exec and filter_terminal
level: high
tags:
  - attack.t1204
  - attack.t1059
  - attack.t1105
falsepositives:
  - Legitimate developer install scripts pasted manually
fields:
  - CommandLine
  - User
  - ParentImage
date: 2026/08/21
---
title: npm Install Script Spawning Suspicious Child Process (BRIDGEHEAD Typosquatting)
id: 9b3d5f62-2a4c-4e6f-8d1b-3c5e7a9b1d22
status: experimental
description: Detects npm/node install scripts spawning curl, wget, or direct executables — consistent with BRIDGEHEAD npm typosquat packages fetching Rust-based in-memory credential stealers from GitHub.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npm.exe'
      - '\npx.cmd'
  selection_child:
    Image|endswith:
      - '\curl.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\wsl.exe'
  selection_args:
    CommandLine|contains:
      - 'github.com'
      - 'raw.githubusercontent.com'
      - 'http'
  condition: selection_parent and selection_child and selection_args
level: high
tags:
  - attack.t1195.002
  - attack.t1105
  - attack.t1059
falsepositives:
  - Legitimate packages with native build steps fetching dependencies
fields:
  - CommandLine
  - ParentCommandLine
  - User
date: 2026/08/21
---
title: N4D Mesh Controller / go-titan C2 or MCP Exploitation Artifact
id: 4e6a8b13-7d5f-4a2b-9c3e-5f7a9c1e3d44
status: experimental
description: Detects network connections to known N4D Mesh Controller C2 infrastructure (209.99.186.235, cdnorigin.net) and execution of UPX-packed Go binaries from temporary paths consistent with the go-titan agent.
author: Security Arsenal Threat Intel
logsource:
  category: network_connection
  product: linux
detection:
  selection_c2_ip:
    DestinationIp:
      - '209.99.186.235'
  selection_c2_domain:
    DestinationHostname|contains:
      - 'cdnorigin.net'
  selection_tmp_exec:
    Image|startswith:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
  condition: selection_c2_ip or selection_c2_domain or (selection_tmp_exec and selection_c2_ip)
level: critical
tags:
  - attack.t1071
  - attack.t1059
  - attack.t1027.002
falsepositives:
  - None expected for hard C2 indicators
fields:
  - DestinationIp
  - DestinationHostname
  - Image
  - User
date: 2026/08/21

// BRIDGEHEAD + ClickFix + N4D + Wallet Factory combined network hunt — 30-day lookback
let BadDomains = dynamic(["docsend.online","1foqo.lat","gapidriver.com","cdnorigin.net","browser-app.com","browsify.net","gemachriverdale.org","e-wl.com","checkmyschool.org","education-gov.com","studentdiscount.online","studentloansyyyy.com","students-portal.com"]);
let BadIPs = dynamic(["209.99.186.235"]);
let NetEvents = DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any (BadDomains) or RemoteIP in (BadIPs)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort;
// Fileless BRIDGEHEAD behavior: node/npm spawning network-capable children hitting GitHub or Telegram
let NpmBehavior = DeviceProcessEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName has_any ("node.exe","npm.cmd","npm.exe","npx.cmd","node")
| where FileName in~ ("curl.exe","powershell.exe","pwsh.exe","cmd.exe","wsl.exe","wget")
   or ProcessCommandLine has_any ("raw.githubusercontent.com","api.telegram.org","IEX","Invoke-WebRequest")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256;
// ClickFix pattern: Terminal-spawned shells piping downloads (macOS via MDE)
let ClickFix = DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("zsh","bash","sh","osascript")
| where ProcessCommandLine has_all ("curl", "| ") or ProcessCommandLine has "base64"
| where InitiatingProcessFileName has_any ("Terminal","iTerm2")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine;
NetEvents
| union NpmBehavior, ClickFix
| sort by Timestamp desc

# Security Arsenal — Infostealer Campaign IOC Hunt (AMOS/BRIDGEHEAD/N4D cross-surface sweep)
# Run elevated on Windows endpoints; adapt paths for macOS/Linux triage.

$BadHashes = @(
    "281f1d9e0638517ac90d61e47fd8be60","6dd77235aaa99153ad790b5e59b49372",
    "8ca79bd95f73a7f984b95e487dc1552b","cd08e22dbfe032d15b54217f4f4ed350",
    "f4769ba9e8065727ef26cca72e894f83","325d5de03758e3850dfae33e509afee9",
    "6d0bd9615d730b0b828f7f91c346085f","ca024acead8f54cfe5b07ac4bdf7fcea"
)
$BadSha256 = @(
    "6f088ade49456db2422c3edfbb9998f4a3e9cce7c4c00a7279fb45d672a82b7d",
    "52c11f246309cce5556a00408bafb9868622114903dbd8128dc4ce3eca2df27a",
    "6888d4c54ef2b5bf23889f9637c2efe77e1d2af4724d315b73d646cf5547dc73"
)
$BadDomains = @("docsend.online","1foqo.lat","gapidriver.com","cdnorigin.net","browser-app.com","browsify.net","e-wl.com","checkmyschool.org","education-gov.com","studentdiscount.online","studentloansyyyy.com","students-portal.com")

Write-Host "[*] Checking DNS cache for malicious domain resolution..." -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $e=$_.Entry; $BadDomains | Where-Object { $e -like "*$_*" } } |
    Select-Object Entry, Data, TimeToLive

Write-Host "[*] Checking active/recent TCP connections to N4D C2 209.99.186.235..." -ForegroundColor Cyan
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq "209.99.186.235" } |
    Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess

Write-Host "[*] Hashing suspicious temp/download locations for known payloads..." -ForegroundColor Cyan
$SearchPaths = @("$env:TEMP","$env:USERPROFILE\Downloads","C:\ProgramData","$env:LOCALAPPDATA\Temp")
foreach ($p in $SearchPaths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue |
          Where-Object { $_.Length -lt 60MB } | ForEach-Object {
            $md5 = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($BadHashes -contains $md5) { Write-Host "[HIT-MD5] $($_.FullName)" -ForegroundColor Red }
            $s256 = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($BadSha256 -contains $s256) { Write-Host "[HIT-SHA256] $($_.FullName)" -ForegroundColor Red }
        }
    }
}

Write-Host "[*] Auditing for NetSupport RAT persistence (services/tasks/run keys)..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.TaskName -match "NetSupport|client32|NSM" } | Select-Object TaskName,TaskPath,State
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue |
    Out-String | Select-String -Pattern "netsupport|client32|nsm" -AllMatches
Get-Service | Where-Object { $_.Name -match "NetSupport|NSM|client32" } | Select-Object Name,Status,StartType

Write-Host "[*] Checking WSL for BRIDGEHEAD crossover artifacts..." -ForegroundColor Cyan
wsl -e bash -c "grep -ril 'api.telegram.org' /tmp /home 2>/dev/null; ls -la /tmp | head -50" 2>$null

Write-Host "[*] Audit complete. Escalate any [HIT] findings to IR immediately." -ForegroundColor Green