ClickFix & KICS Supply Chain: Trigona, GlassWorm, and Stealer Swarm — Enterprise Detection Pack

title: Potential ClickFix PowerShell Execution
description: Detects PowerShell execution patterns often associated with ClickFix campaigns where users are tricked into running "fix" commands. Includes encoded commands and clipboard manipulation.
references:
  - https://otx.alienvault.com/pulse/662a1b1c8f4b10b123456789
author: Security Arsenal Research
date: 2026/04/26
status: experimental
tags:
  - attack.execution
  - attack.initial_access
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_clipboard:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Get-Clipboard'
      - 'Set-Clipboard'
  selection_encoded:
    Image|endswith: '\powershell.exe'
    CommandLine|contains: '-e '
    CommandLine|contains: 'FromBase64'
  condition: 1 of selection_*
falsepositives:
  - Legitimate administrative scripts
level: high
---
title: Trigona Ransomware Custom Exfiltration Tool
description: Detects the execution of uploader_client.exe, a custom tool used by Trigona affiliates for data theft with connection rotation.
references:
  - https://otx.alienvault.com/pulse/662a1b1c8f4b10b123456790
author: Security Arsenal Research
date: 2026/04/26
status: experimental
tags:
  - attack.exfiltration
  - attack.t1041
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\uploader_client.exe'
    OriginalFileName: 'uploader_client.exe'
  condition: selection
falsepositives:
  - Unknown
level: critical
---
title: Compromised KICS Docker or VS Code Execution
description: Detects the execution of specific malicious hashes associated with the TeamPCP supply chain attack on Checkmarx KICS.
references:
  - https://otx.alienvault.com/pulse/662a1b1c8f4b10b123456791
author: Security Arsenal Research
date: 2026/04/26
status: experimental
tags:
  - attack.supply_chain
  - attack.t1195.002
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Hashes|contains:
      - 'MD5=d47de3772f2d61a043e7047431ef4cf4'
      - 'SHA256=222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b'
  condition: selection
falsepositives:
  - None (Critical supply chain indicators)
level: critical

// Hunt for Trigona Exfil Tool and ClickFix Suspicious Activity
let TrigonaHashes = dynamic(["e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173", "816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019"]);
let MaliciousDomains = dynamic(["ustazazharidrus.com", "account-help.info", "elive123go.com", "ucaboodle.com"]);
// 1. Process Creation Hunt for Trigona Tool
DeviceProcessEvents
| where InitiatingProcessFileName =~ "powershell.exe" or FileName =~ "powershell.exe"
| where ProcessCommandLine has "-e " or ProcessCommandLine has "Get-Clipboard"
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| union (
    DeviceProcessEvents
    | where SHA256 in TrigonaHashes or FileName == "uploader_client.exe"
)
| union (
    // 2. Network Connections to Malicious Domains
    DeviceNetworkEvents
    | where RemoteUrl in MaliciousDomains
)

<#
    .SYNOPSIS
    Hunts for Trigona and TeamPCP KICS Supply Chain Compromise artifacts.
#>

$TargetHashes = @(
    "d47de3772f2d61a043e7047431ef4cf4", # KICS MD5
    "e1023db24a29ab0229d99764e2c8deba", # KICS MD5
    "e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173"  # Trigona Uploader SHA256
)

Write-Host "[*] Scanning for Trigona uploader_client.exe and compromised KICS binaries..."

# Check Processes
$Processes = Get-Process | Where-Object { $_.Path -ne $null }
foreach ($Proc in $Processes) {
    $Hash = (Get-FileHash -Path $Proc.Path -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
    $Hash256 = (Get-FileHash -Path $Proc.Path -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    
    if ($TargetHashes -contains $Hash -or $TargetHashes -contains $Hash256) {
        Write-Host "[!] MALICIOUS PROCESS DETECTED: $($Proc.ProcessName) - $($Proc.Path) - Hash: $Hash" -ForegroundColor Red
    }

    if ($Proc.ProcessName -eq "uploader_client.exe") {
        Write-Host "[!] CRITICAL: Trigona Exfil Tool Running: $($Proc.Id)" -ForegroundColor Red
    }
}

# Check file system for specific process names in common download/appdata paths
$PathsToScan = @("$env:USERPROFILE\Downloads", "$env:APPDATA", "$env:LOCALAPPDATA")
foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Where-Object { 
            $_.Name -eq "uploader_client.exe" -or 
            $_.Name -eq "kics.exe" -or
            $_.Name -eq "mcpAddon.js"
        } | ForEach-Object {
            Write-Host "[!] SUSPICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Yellow
        }
    }
}