Most loader takedowns follow a familiar playbook: identify the command-and-control domains or IPs, get them sinkholed or seized, and watch the botnet's operators lose the ability to task their implants. AvisLoader, a new Windows malware loader analyzed by Varonis researchers, was engineered specifically to break that playbook. By moving its command-and-control onto an encrypted peer-to-peer (P2P) channel, AvisLoader eliminates the centralized chokepoints that defenders and law enforcement have historically relied on for disruption.
Combined with ClickFix-style social engineering delivery — tricking users into executing malicious commands themselves — and shortcut (LNK) file-based persistence, AvisLoader represents the current state of the art in initial-access tooling. If your SOC's detection strategy still leans heavily on domain blocking and IOC feeds, this loader is purpose-built to route around you. This post breaks down how AvisLoader operates and gives you concrete detection logic, hunting queries, and eradication steps you can deploy today.
Technical Analysis
What AvisLoader Is
AvisLoader is a Windows malware loader — a first-stage implant whose primary job is to establish persistence on a victim host and then pull down additional payloads (stealers, ransomware precursors, RATs) on demand. Loaders like this are the workhorses of the cybercrime economy: initial access brokers and affiliate groups buy or rent them to convert a phish into a foothold.
Delivery: ClickFix Social Engineering
AvisLoader is being delivered via the ClickFix technique — fake error dialogs, CAPTCHA pages, or "browser update" prompts that instruct the victim to manually paste and run a command (typically in the Windows Run dialog, a terminal, or PowerShell). From a defender's perspective, this is critical: the malicious process is executed interactively by the user, which means it often inherits legitimate parent processes like explorer.exe or powershell.exe launched via Win+R, and it sidesteps email-gateway and attachment-sandbox detections entirely because no malicious file is ever delivered as an attachment.
Typical ClickFix execution chains involve:
- A user pasting a command that invokes PowerShell or
mshta.exeto fetch a remote script - The script downloading and staging the loader payload, often into user-writable directories (
%AppData%,%Temp%,%ProgramData%) - In-memory or staged execution to minimize disk artifacts
Persistence: Shortcut (LNK) Files
AvisLoader achieves persistence through shortcut (.lnk) files — a technique (MITRE ATT&CK T1547.009) that places a malicious LNK in a startup location, such as the user's Startup folder (%AppData%\Microsoft\Windows\Start Menu\Programs\Startup) or modifies shortcuts the user routinely clicks so the loader executes alongside a legitimate application. LNK persistence is attractive to operators because it blends into a folder most users never inspect and survives reboots without touching traditional registry Run keys — though defenders should check both, as variants often use multiple mechanisms for redundancy.
Command-and-Control: Encrypted Peer-to-Peer
The defining feature of AvisLoader is its P2P-based C2 channel with encrypted communications. Rather than beaconing to a static list of domains or IPs that can be seized or sinkholed, infected nodes communicate with peers in a distributed overlay network. This means:
- No single point of failure — taking down one node or a block of IPs does not sever the botnet
- Encrypted peer traffic — network inspection sees connections to otherwise-unremarkable hosts rather than known-bad infrastructure
- Remote command execution — operators can push commands and second-stage payloads to any infected host through the mesh
For defenders, the practical implication is that DNS-based detection and egress blocklists will under-detect this threat. Detection must shift toward behavioral signals: unsigned or unusual binaries establishing sustained outbound peer connections, processes spawned from user-context interactive shells making non-standard network connections, and the host artifacts (LNK files, staged payloads) left behind.
Exploitation Status
This is confirmed in-the-wild malware distribution, not a theoretical capability. No CVE is associated with AvisLoader — it relies on social engineering and native Windows functionality rather than a software vulnerability, which means patching alone will not stop it. Defense is a detection, hardening, and user-behavior problem.
Detection & Response
The detections below target AvisLoader's three weakest points: the ClickFix interactive execution chain, the LNK persistence artifacts, and the anomalous network behavior of a loader operating from user-context processes. Deploy all three — each alone has gaps, but together they create overlapping coverage.
Sigma Rules
---
title: ClickFix-Style Interactive PowerShell Execution via Run Dialog or Paste
id: 3f8a2c41-9d7e-4b5a-a1c6-8e2d5f7b9a01
status: experimental
description: Detects PowerShell launched as a child of explorer.exe with download/cradle patterns, consistent with ClickFix social engineering where users paste malicious commands into the Run dialog.
references:
- https://www.bleepingcomputer.com/news/security/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption/
- https://attack.mitre.org/techniques/T1059/001/
- https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059.001
- attack.t1204
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\explorer.exe'
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\mshta.exe'
- '\wscript.exe'
- '\cscript.exe'
selection_cradle:
CommandLine|contains:
- 'Invoke-Expression'
- 'IEX'
- 'DownloadString'
- 'Invoke-WebRequest'
- 'curl '
- 'http://'
- 'https://'
- '-enc'
- '-e '
- 'FromBase64String'
condition: selection_parent and selection_cradle
falsepositives:
- Helpdesk-driven troubleshooting where analysts walk users through PowerShell commands
- Software deployment tools that invoke PowerShell from explorer context
level: high
---
title: Malicious Shortcut File Created in Startup Folder
id: 7c1e4b92-5a3d-4f68-b2d9-1e6c8a4f0b73
status: experimental
description: Detects creation of .lnk files in user or all-users Startup folders, a persistence mechanism used by AvisLoader (T1547.009).
references:
- https://www.bleepingcomputer.com/news/security/inside-avisloader-a-windows-malware-loader-built-to-resist-disruption/
- https://attack.mitre.org/techniques/T1547/009/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1547.009
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|contains:
- '\Start Menu\Programs\Startup\'
TargetFilename|endswith: '.lnk'
filter_known_writers:
Image|endswith:
- '\msiexec.exe'
- '\setup.exe'
condition: selection and not filter_known_writers
falsepositives:
- Legitimate software installers adding startup shortcuts (usually msiexec or vendor setup binaries)
- IT provisioning scripts
level: medium
---
title: Suspicious Process Launch from LNK in Startup Folder
id: 9b2d6e17-3c5a-4f89-a7d4-6e1b9c3f8a52
status: experimental
description: Detects execution of executables or scripts from the Startup folder path, including chains where a shortcut launches PowerShell, mshta, or script hosts, consistent with LNK-based loader persistence.
references:
- https://attack.mitre.org/techniques/T1547/009/
- https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1547.009
logsource:
category: process_creation
product: windows
detection:
selection_path:
Image|contains: '\Start Menu\Programs\Startup\'
selection_suspicious_child:
CommandLine|contains: '\Start Menu\Programs\Startup\'
Image|endswith:
- '\powershell.exe'
- '\mshta.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\rundll32.exe'
condition: selection_path or selection_suspicious_child
falsepositives:
- Rare legitimate utilities that self-install into Startup
level: high
KQL Hunting Query (Microsoft Sentinel / Defender)
This query correlates the ClickFix-style interactive execution pattern with subsequent network connections — surfacing hosts where a user-context shell spawned a script interpreter that then established outbound connections, the hallmark of a loader staging its P2P client or pulling a second-stage payload.
let suspiciousInterpreters = dynamic(["powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "rundll32.exe"]);
let userShellSpawns = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ (suspiciousInterpreters)
| where ProcessCommandLine has_any ("Invoke-Expression", "IEX", "DownloadString",
"Invoke-WebRequest", "FromBase64String", "-enc", "http://", "https://")
| project SpawnTime = TimeGenerated, DeviceId, DeviceName, AccountName,
SpawnProcess = FileName, SpawnCmd = ProcessCommandLine, SpawnProcessId = ProcessId;
let networkActivity = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ (suspiciousInterpreters)
| where RemoteIPType == "Public"
| summarize Connections = count(),
RemoteIPs = make_set(RemoteIP, 25),
RemotePorts = make_set(RemotePort, 25)
by DeviceId, InitiatingProcessFileName, bin(TimeGenerated, 5m);
userShellSpawns
| join kind=leftouter (networkActivity) on DeviceId
| where isnotempty(Connections) or isnotempty(SpawnCmd)
| project DeviceName, AccountName, SpawnTime, SpawnProcess, SpawnCmd,
Connections, RemoteIPs, RemotePorts
| order by SpawnTime desc
Tune the time join window and RemoteIP exclusions for your environment (e.g., exclude known update/CDN ranges your helpdesk tooling touches). The high-fidelity signal is explorer.exe-spawned script interpreters with public-IP egress within minutes of launch.
Velociraptor VQL Hunt
This artifact hunts for LNK persistence artifacts in Startup locations and enumerates processes running from user-writable staging paths — the two on-disk footprints AvisLoader leaves even when its network traffic is encrypted.
-- AvisLoader hunt: Startup-folder LNK artifacts and suspicious user-context processes
SELECT Fqdn, User, StartupLnk.Name AS LnkName, StartupLnk.Data AS LnkTarget,
StartupLnk.Mtime AS LnkModified
FROM foreach(
row={
SELECT OSPath FROM glob(globs='C:/Users/*/AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup/*.lnk')
},
query={
SELECT parse_file_with_regex(filename=OSPath,
regex='(?i).*(powershell|mshta|wscript|cscript|rundll32|\.exe)') AS StartupLnk
})
WHERE StartupLnk
-- Companion: processes executing from user-writable staging directories
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(AppData|ProgramData|Temp)\\'
AND CommandLine =~ '(?i)(powershell|mshta|wscript|cscript|rundll32|http)'
Deploy the glob half as a standalone artifact (Windows.Detection.StartupLnkHunt) across your fleet if you want cleaner output — the combined form above is optimized for a quick triage sweep.
Remediation / Eradication Script
Use this PowerShell script on suspected infected hosts (or deploy fleet-wide via your EDR's live response) to enumerate and remove LNK persistence artifacts and kill loader processes running from user-writable paths. Review output before running with -Remove in production.
# AvisLoader eradication script - run as Administrator or via EDR live response
# Use -Remove to delete artifacts; default is audit-only
param([switch]$Remove)
$report = @()
# 1. Enumerate LNK files in all user Startup folders
$startupPaths = Get-ChildItem "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.lnk" -ErrorAction SilentlyContinue
$shell = New-Object -ComObject WScript.Shell
foreach ($lnk in $startupPaths) {
$shortcut = $shell.CreateShortcut($lnk.FullName)
$suspicious = $shortcut.TargetPath -match '(?i)(powershell|mshta|wscript|cscript|rundll32|AppData|ProgramData|Temp)'
$report += [PSCustomObject]@{
Type = 'StartupLNK'; Path = $lnk.FullName
Target = $shortcut.TargetPath; Suspicious = $suspicious
}
if ($Remove -and $suspicious) {
Remove-Item $lnk.FullName -Force
Write-Host "[REMOVED] $($lnk.FullName) -> $($shortcut.TargetPath)"
}
}
# 2. Kill processes running from user-writable staging paths with script interpreters in the chain
$susProcs = Get-CimInstance Win32_Process | Where-Object {
$_.ExecutablePath -match '(?i)(AppData|ProgramData|\\Temp\\)' -and
$_.CommandLine -match '(?i)(powershell|mshta|wscript|cscript|rundll32|http)'
}
foreach ($p in $susProcs) {
$report += [PSCustomObject]@{
Type = 'Process'; Path = $p.ExecutablePath
Target = $p.CommandLine; Suspicious = $true
}
if ($Remove) {
Stop-Process -Id $p.ProcessId -Force -ErrorAction SilentlyContinue
Write-Host "[KILLED] PID $($p.ProcessId) - $($p.ExecutablePath)"
}
}
# 3. Check registry Run keys for good measure (variants often stack persistence)
$runKeys = @(
'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($key in $runKeys) {
if (Test-Path $key) {
Get-ItemProperty $key | ForEach-Object {
$_.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' -and $_.Value -match '(?i)(powershell|mshta|AppData|Temp)' } | ForEach-Object {
$report += [PSCustomObject]@{ Type = 'RunKey'; Path = "$key\$($_.Name)"; Target = $_.Value; Suspicious = $true }
}
}
}
}
$report | Format-Table -AutoSize
$report | Export-Csv ".\avisloader_triage_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
Remediation
Since AvisLoader exploits user behavior, not a software vulnerability, there is no patch. Your remediation plan has three layers:
1. Block the ClickFix delivery vector
- Disable or restrict the Run dialog and script interpreters for standard users where operationally feasible (AppLocker/WDAC policies blocking user-context
mshta.exe,wscript.exe, and unsigned PowerShell execution). ClickFix attacks collapse if the user cannot execute the pasted command. - Enable PowerShell Constrained Language Mode via WDAC for non-admin users, and enforce Script Block Logging and Module Logging fleet-wide — the ClickFix execution chain will light up your logs even if it succeeds.
- User awareness with teeth: run internal ClickFix simulations. This technique succeeds precisely because it looks like IT support. Train users that no legitimate site will ever ask them to paste a command into Run/PowerShell.
2. Harden against LNK persistence
- Audit Startup folders and registry Run keys fleet-wide (the script above operationalizes this). Baseline what's expected; alert on deviation.
- Restrict write access to shared/all-users Startup folders to administrators.
- Deploy the Sigma rules above to catch both LNK creation and execution-from-Startup behaviors in near real time.
3. Detect the P2P C2 behaviorally
- You cannot sinkhole a P2P mesh, so hunt the behavior: script interpreters and unsigned binaries in user-writable paths making sustained public-IP egress is abnormal in almost every enterprise. The KQL query above is your starting point.
- Enforce egress filtering so that only approved processes (browsers, sanctioned tools) can reach the internet from workstations. A loader that cannot reach its peers is a loader that cannot receive second-stage payloads.
- If you identify an infected host, isolate it immediately — every online AvisLoader node potentially serves as a relay for other victims' C2 traffic.
If you find an infection: treat it as a full compromise, not a malware nuisance. Loaders exist to deliver follow-on payloads — assume credentials were harvested and additional stages may have been deployed. Isolate the host, capture memory before remediation if your IR retainer supports it, reset credentials for any accounts used on the box, and sweep the fleet with the VQL artifact for lateral spread. Our incident response team handles loader-to-ransomware escalations regularly; the window between loader deployment and second-stage payload is often measured in hours, not days.
Related Resources
Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.