title: Potential ClickFix PowerShell Execution Pattern
date: 2026/07/17
status: experimental
description: Detects suspicious PowerShell execution patterns often associated with ClickFix campaigns where users are tricked into running commands via clipboard or copy-paste. Looks for encoded commands and common obfuscation used in SmartRAT and OkoBot delivery.
references:
    - https://otx.alienvault.com/pulse/66971c2f8d2b1f0f8c2b1f8c
author: Security Arsenal
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'CopyToClipboard'
            - 'IEX'
            - 'Invoke-Expression'
            - 'DownloadString'
    condition: selection
falsepositives:
    - Administrative scripts
level: high
---
title: SmartRAT & OkoBot C2 Domain Connection
date: 2026/07/17
status: experimental
description: Detects network connections to known Command and Control (C2) domains associated with the active SmartRAT and OkoBot campaigns targeting Brazil and Crypto users.
references:
    - https://otx.alienvault.com/pulse/66971c2f8d2b1f0f8c2b1f8c
author: Security Arsenal
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains:
            - 'crefisa.online'
            - 'windowsupdate-cdn.com'
            - 'coffeesaloon.online'
            - 'livewallpapers.online'
            - '2baserec2.guru'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Malicious Browser Extension Injection - Rilide/OkoBot
date: 2026/07/17
status: experimental
description: Detects registry modifications indicative of malicious browser extension injection used by the OkoBot framework (Rilide).
references:
    - https://otx.alienvault.com/pulse/66971c2f8d2b1f0f8c2b1f8c
author: Security Arsenal
tags:
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    category: registry_add
detection:
    selection:
        TargetObject|contains:
            - '\Software\Google\Chrome\Extensions'
            - '\Software\Microsoft\Edge\Extensions'
        Details|contains:
            - 'update_url'
            - ''
    condition: selection
falsepositives:
    - Legitimate software installing extensions
level: medium


kql
// Hunt for network connections to known SmartRAT and OkoBot C2 domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "crefisa.online", 
    "windowsupdate-cdn.com", 
    "coffeesaloon.online", 
    "livewallpapers.online",
    "2baserec2.guru",
    "kbeautyreviews.com"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend URLHex = hash(tostring(RemoteUrl))
// Hunt for suspicious PowerShell execution often used in ClickFix
DeviceProcessEvents  
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("IEX", "DownloadString", "FromBase64String", "CopyToClipboard")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| summarize count() by DeviceName, InitiatingProcessFileName


powershell
# IOC Hunt Script for SmartRAT and OkoBot Artifacts
# Run as Administrator

Write-Host "[+] Starting Hunt for SmartRAT and OkoBot Artifacts..." -ForegroundColor Cyan

# 1. Check Hosts File for Malicious Domains
$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$maliciousDomains = @(
    "crefisa.online", 
    "windowsupdate-cdn.com", 
    "coffeesaloon.online", 
    "livewallpapers.online"
)

if (Test-Path $hostsPath) {
    $hostsContent = Get-Content $hostsPath
    foreach ($domain in $maliciousDomains) {
        if ($hostsContent -match $domain) {
            Write-Host "[!] ALERT: Malicious domain found in hosts file: $domain" -ForegroundColor Red
        }
    }
}

# 2. Check for Suspicious Scheduled Tasks (GhostLoader/HDUtil Persistence)
Write-Host "[+] Checking Scheduled Tasks for suspicious patterns..."
Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -like "*powershell*" -or 
    $_.Actions.Execute -like "*cmd.exe*" -and
    ($_.Actions.Arguments -like "*DownloadString*" -or $_.Actions.Arguments -like "*IEX*")
} | Select-Object TaskName, TaskPath, State | Format-Table

# 3. Scan for Specific File Hashes (Requires Hash computation)
Write-Host "[+] Scanning user directories for suspicious executables..."
$targetHashes = @(
    "297eb45f028d44d750297d2f932b9c91",
    "3c72e1f37f115b00c3ad6ed31bacfe8a",
    "b07d451ee65a1580f20a784c8f0e7a46",
    "187a1f68ae786e53d3831166dc84e6d2"
)

$pathsToScan = @("$env:USERPROFILE\Downloads", "$env:APPDATA", "$env:TEMP")

foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue -File | 
        ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash.ToLower()
            if ($targetHashes -contains $hash) {
                Write-Host "[!] CRITICAL: Malware found at $($_.FullName) with hash $hash" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Hunt Complete." -ForegroundColor Green


# Response Priorities

**Immediate (0-4 hours):**
*   **Block IOCs:** Immediately block all listed domains and IP addresses at the perimeter firewall and proxy.
*   **Scan Endpoints:** Initiate a targeted scan for the MD5 file hashes provided in the IOCs.
*   **Hunt PowerShell:** Use the provided KQL and PowerShell scripts to identify active infections or past execution attempts.

**Within 24 Hours:**
*   **Identity Verification:** Given the presence of banking trojans (SmartRAT) and crypto-stealers (OkoBot), perform forced password resets and MFI challenges for users who may have been exposed, particularly in finance departments or those known to hold crypto assets.
*   **Browser Review:** Audit browser extensions on corporate endpoints to identify instances of Rilide or unknown/unsigned extensions.

**Within 1 Week:**
*   **Architecture Hardening:** Implement strict browser extension policies (allowlist only) to prevent Rilide-style injection.
*   **User Awareness:** Conduct security awareness training specifically focusing on "ClickFix" and fake CAPTCHA/tech support scams.
*   **PowerShell Constrained Mode:** Evaluate enforcing Constrained Language Mode for PowerShell to prevent the execution of the obfuscated scripts used in these campaigns.