BlackX UEFI Bootkit, ClickFix/Lumma Stealer Chains & INC Ransomware: OTX Pulse Analysis — Enterprise Detection Pack

---
title: APT41 BlackX UEFI Bootkit - ESP Modification and Baton Drop Exploitation
id: 7f3a1c2e-4b9d-4e1a-9c5f-2a8d6b3e7f01
status: experimental
description: Detects suspicious writes to the EFI System Partition and boot component tampering consistent with BlackX/BlackLotus-style bootkits exploiting CVE-2022-21894 (Baton Drop).
author: Security Arsenal Threat Intel
references:
    - https://securelist.com/uefi-bootkit-blackx/121539/
logsource:
    category: file_event
    product: windows
detection:
    selection_esp:
        TargetFilename|contains:
            - '\EFI\Microsoft\Boot\'
            - '\EFI\Boot\'
        TargetFilename|endswith:
            - 'bootmgfw.efi'
            - 'bootmgr.efi'
            - 'winload.efi'
    filter_system:
        Image|endswith: '\System32\svchost.exe'
    condition: selection_esp and not filter_system
falsepositives:
    - Legitimate Windows Update servicing of boot components (correlate with KB installation events)
level: critical
tags:
    - attack.persistence
    - attack.t1542
    - attack.defense_evasion
    - attack.t1553
---
title: ClickFix Social Engineering - Finger.exe LOLBin Abuse for Payload Retrieval
id: 2d8b4e6a-1c3f-4a7b-8e9d-5f2c6a4b8d02
status: experimental
description: Detects execution of the legacy Windows finger.exe utility with network arguments, abused in ClickFix campaigns to stage Doina/Lumma Stealer/NetSupport RAT payloads.
author: Security Arsenal Threat Intel
references:
    - https://www.huntress.com/blog/amazon-clickfix-finger
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\finger.exe'
    selection_args:
        CommandLine|contains:
            - '@'
            - '|'
            - 'http'
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\cmd.exe'
            - '\powershell.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
    condition: selection_img and (selection_args or selection_parent)
falsepositives:
    - Extremely rare; finger.exe is deprecated and has no legitimate use in modern enterprise environments
level: high
tags:
    - attack.execution
    - attack.t1204
    - attack.t1105
    - attack.t1218
---
title: INC Ransomware TTPs - Randomized Scheduled Task and Impacket-Style Lateral Movement
id: 9c1e5f3a-6d2b-4c8e-a7f4-3b9e1d5c6a03
status: experimental
description: Detects remote scheduled task creation and service execution patterns associated with INC ransomware affiliates using Impacket, AnyDesk staging, and randomized task names.
author: Security Arsenal Threat Intel
references:
    - https://www.huntress.com/blog/two-inc-ransom-notes
logsource:
    category: process_creation
    product: windows
detection:
    selection_schtasks_remote:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains:
            - '/create'
            - '/s '
    selection_impacket:
        CommandLine|contains:
            - 'wmiexec'
            - 'psexec'
            - 'smbexec'
            - 'atexec'
    selection_anydesk:
        CommandLine|contains:
            - 'anydesk'
            - '--install'
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative remote task creation (allowlist known admin workstations and service accounts)
    - Enterprise deployment of AnyDesk by IT (verify against authorized software inventory)
level: high
tags:
    - attack.persistence
    - attack.t1053
    - attack.lateral_movement
    - attack.t1021
    - attack.execution
    - attack.t1569

// Security Arsenal - Unified Hunt: ClickFix/Lumma, INC Ransomware, BlackX infrastructure
// Lookback: 30 days | Tables: DeviceNetworkEvents, DeviceProcessEvents, DeviceEvents

let lookback = 30d;
let ioc_domains = dynamic(["grillmasterchef.com","ashevilleroofingcontractor.com","grillrecipespro.com","throughoutes.net","archivetj.com"]);
let ioc_ip = "167.148.201.106";

// 1) Network connections to pulse IOCs
let net_hits = DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where RemoteUrl has_any (ioc_domains) or RemoteIP == ioc_ip
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| extend Hunt = "IOC_Network";

// 2) ClickFix LOLBin execution: finger.exe, plus NetSupport/Lumma staging
let clickfix = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName =~ "finger.exe"
   or ProcessCommandLine has_any ("client32.exe","NetSupport","finger.exe @")
   or (InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe")
       and FileName in~ ("cmd.exe","powershell.exe","mshta.exe","rundll32.exe","finger.exe"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend Hunt = "ClickFix_Execution";

// 3) INC ransomware behaviors: remote schtasks, Impacket artifacts, AnyDesk, suspicious RDP lateral movement
let inc = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where (FileName =~ "schtasks.exe" and ProcessCommandLine has_all ("/create","/s"))
   or ProcessCommandLine has_any ("wmiexec","psexec","smbexec","atexec")
   or (FileName has "anydesk" and ProcessCommandLine has "--install")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend Hunt = "INC_TTPs";

// 4) BlackX: ESP/boot file tampering telemetry (requires file events on mounted ESP)
let bootkit = DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "FileModified" or ActionType == "FileCreated"
| extend Parsed = parse_json(AdditionalFields)
| extend FileName = tostring(Parsed.FileName), FolderPath = tostring(Parsed.FolderPath)
| where FolderPath has "EFI\\Microsoft\\Boot" or FileName in~ ("bootmgfw.efi","winload.efi")
| project Timestamp, DeviceName, ActionType, FolderPath, FileName, InitiatingProcessFileName
| extend Hunt = "BlackX_ESP_Tamper";

net_hits | union clickfix, inc, bootkit
| order by Timestamp desc

# Security Arsenal - IOC Hunt Script: BlackX / ClickFix-Lumma / INC Ransomware
# Run elevated on endpoints or deploy via GPO/SCCM/Intune. Read-only hunt.

$report = @()

function Add-Finding($Category, $Detail) {
    $script:report += [PSCustomObject]@{
        Host      = $env:COMPUTERNAME
        Category  = $Category
        Detail    = $Detail
        Timestamp = (Get-Date).ToString("u")
    }
}

Write-Host "[*] === 1. BlackX UEFI Bootkit Checks ===" -ForegroundColor Cyan

# 1a. Secure Boot state - disabled Secure Boot on UEFI systems is a red flag
try {
    $sb = Confirm-SecureBootUEFI -ErrorAction Stop
    if (-not $sb) { Add-Finding "BlackX" "Secure Boot DISABLED on UEFI system" }
} catch {
    Add-Finding "BlackX" "Confirm-SecureBootUEFI failed (non-UEFI or error): $($_.Exception.Message)"
}

# 1b. CVE-2022-21894 patch state - check for Jan 2023+ cumulative updates
$hotfixes = Get-HotFix | Where-Object { $_.InstalledOn -gt (Get-Date "2023-01-01") }
if (-not $hotfixes) { Add-Finding "BlackX" "No cumulative updates since Jan 2023 - Baton Drop exposure likely" }

# 1c. Hash hunt - BlackX/OxiDLLRunner artifacts
$badHashes = @(
    "af8a983b9ada07eae1259bf2953abd40",
    "0bcdf5e0da32d68900b8b7638459d072",
    "2bb937c7eac0843313ee402735768e25"
)
$scanPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData","C:\Windows\Temp")
foreach ($p in $scanPaths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue -Depth 3 | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($badHashes -contains $h.ToLower()) { Add-Finding "HashMatch" "MALWARE HASH: $($_.FullName) MD5=$h" }
    }
}

# 1d. ESP inspection - mount and look for unexpected/modified boot files
mountvol S: /s 2>$null
if (Test-Path "S:\EFI\Microsoft\Boot\bootmgfw.efi") {
    $bootFiles = Get-ChildItem "S:\EFI" -Recurse -File -ErrorAction SilentlyContinue
    foreach ($bf in $bootFiles) {
        $sig = Get-AuthenticodeSignature $bf.FullName -ErrorAction SilentlyContinue
        if ($sig.Status -ne "Valid") { Add-Finding "BlackX" "Unsigned/invalid EFI binary: $($bf.FullName) Status=$($sig.Status)" }
        if ($bf.LastWriteTime -gt (Get-Date).AddDays(-90) -and $bf.Name -notmatch "^BCD") {
            Add-Finding "BlackX" "Recently modified boot file: $($bf.FullName) @ $($bf.LastWriteTime)"
        }
    }
}
mountvol S: /d 2>$null

Write-Host "[*] === 2. ClickFix / Lumma Stealer / NetSupport Checks ===" -ForegroundColor Cyan

# 2a. finger.exe execution artifacts - prefetch
Get-ChildItem "C:\Windows\Prefetch\FINGER.EXE-*.pf" -ErrorAction SilentlyContinue | ForEach-Object {
    Add-Finding "ClickFix" "finger.exe Prefetch artifact: $($_.Name) LastWrite=$($_.LastWriteTime)"
}

# 2b. NetSupport RAT install paths and service
$nsPaths = @("C:\Program Files\NetSupport","C:\Program Files (x86)\NetSupport","$env:APPDATA\NetSupport","$env:LOCALAPPDATA\client32.exe")
foreach ($nsp in $nsPaths) { if (Test-Path $nsp) { Add-Finding "ClickFix" "NetSupport artifact present: $nsp" } }
Get-Service -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -match "NetSupport|client32" } | ForEach-Object {
    Add-Finding "ClickFix" "NetSupport service: $($_.Name) ($($_.Status))"
}

# 2c. Lumma Stealer staging dirs and run keys
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($rk in $runKeys) {
    Get-ItemProperty $rk -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | ForEach-Object {
        $val = (Get-ItemProperty $rk -Name $_.Name -ErrorAction SilentlyContinue).$($_.Name)
        if ($val -match "AppData|Temp|client32|\.ps1|mshta|rundll32") {
            Add-Finding "ClickFix" "Suspicious Run key: $rk\$($_.Name) = $val"
        }
    }
}

Write-Host "[*] === 3. INC Ransomware Checks ===" -ForegroundColor Cyan

# 3a. Randomized scheduled tasks (INC persistence pattern)
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.TaskName -match "^[A-Za-z0-9]{8,16}$" -and $_.TaskPath -eq "\"
} | ForEach-Object { Add-Finding "INC" "Randomized-name scheduled task: $($_.TaskName) - $($_.Actions.Execute) $($_.Actions.Arguments)" }

# 3b. AnyDesk installation and connection logs
$adPaths = @("$env:APPDATA\AnyDesk","$env:ProgramData\AnyDesk","C:\Program Files (x86)\AnyDesk","C:\Program Files\AnyDesk")
foreach ($adp in $adPaths) { if (Test-Path $adp) { Add-Finding "INC" "AnyDesk artifact: $adp" } }

# 3c. Ransom notes (INC double-extortion artifacts)
Get-ChildItem -Path "C:\","D:\" -Recurse -Include "*INC*README*","*HOW*TO*RECOVER*","*.INC*" -ErrorAction SilentlyContinue -Depth 4 | ForEach-Object {
    Add-Finding "INC" "Possible ransom note: $($_.FullName)"
}

# 3d. Active connections to pulse IOCs
$iocIP = "167.148.201.106"
Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq $iocIP } | ForEach-Object {
    Add-Finding "IOC-Network" "ACTIVE connection to $iocIP from PID $($_.OwningProcess)"
}
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $_.Entry -match "grillmasterchef|ashevilleroofingcontractor|grillrecipespro|throughoutes|archivetj"
} | ForEach-Object { Add-Finding "IOC-Network" "DNS cache hit: $($_.Entry) -> $($_.Data)" }

Write-Host "`n[*] === HUNT COMPLETE ===" -ForegroundColor Green
if ($report.Count -gt 0) {
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path ".\threat_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
    Write-Host "[!] $($report.Count) findings exported to threat_hunt_$env:COMPUTERNAME.csv" -ForegroundColor Red
} else {
    Write-Host "[+] No indicators found on this host." -ForegroundColor Green
}