ClickFix Evolution: DuskDesk, Matanbuchus, EtherRAT & RMM Abuse — OTX Pulse Analysis — Enterprise Detection Pack

---
title: ClickFix PowerShell Execution with Progress Bar Spoofing
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
status: experimental
description: Detects PowerShell execution patterns associated with ClickFix campaigns using animated progress bars and fake verification prompts
author: Security Arsenal
date: 2026/11/11
references:
    - https://www.huntress.com/blog/the-evolving-tradecraft-of-clickfix
logsource:
    category: process_creation
    product: windows
detection:
    selection_powershell:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_suspicious_flags:
        CommandLine|contains:
            - 'Write-Progress'
            - '-WindowStyle Hidden'
            - '-ExecutionPolicy Bypass'
            - 'IEX'
            - 'Invoke-Expression'
            - 'DownloadString'
            - 'Net.WebClient'
    selection_clickfix_domains:
        CommandLine|contains:
            - 'apirequestaccess.com'
            - 'moziw.com'
            - 'westlaw-signon.com'
    condition: selection_powershell and (selection_suspicious_flags or selection_clickfix_domains)
falsepositives:
    - Legitimate admin scripts using Write-Progress
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204.002
---
title: ClickFix Malvertising Domain Communication
id: 8e7d6c5b-4a3b-2c1d-0e9f-8a7b6c5d4e3f
status: experimental
description: Detects network communication to known ClickFix malvertising and C2 domains
author: Security Arsenal
date: 2026/11/11
logsource:
    category: network_connection
    product: windows
detection:
    selection_domains:
        DestinationHostname|contains:
            - 'apirequestaccess.com'
            - 'moziw.com'
            - 'westlaw-signon.com'
    selection_ports:
        DestinationPort:
            - 80
            - 443
    condition: selection_domains and selection_ports
falsepositives:
    - None expected for these domains
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102
---
title: RMM Tool Execution from Non-Standard Path
id: 7d6c5b4a-3b2c-1d0e-9f8a-7b6c5d4e3f2a
status: experimental
description: Detects execution of RMM tools (abused by DuskDesk/RMMProject) from non-standard directories or with suspicious command lines
author: Security Arsenal
date: 2026/11/11
logsource:
    category: process_creation
    product: windows
detection:
    selection_rmm_tools:
        Image|endswith:
            - '\AnyDesk.exe'
            - '\TeamViewer.exe'
            - '\ScreenConnect.exe'
            - '\Splashtop.exe'
            - '\Atera.exe'
            - '\ConnectWise.exe'
    selection_suspicious_paths:
        Image|contains:
            - '\Temp\'
            - '\AppData\Local\Temp\'
            - '\Downloads\'
            - '\Public\'
    selection_suspicious_cmd:
        CommandLine|contains:
            - 'silent'
            - 'hidden'
            - '/S'
            - '-q'
    condition: selection_rmm_tools and (selection_suspicious_paths or selection_suspicious_cmd)
falsepositives:
    - Legitimate RMM deployment by IT (whitelist known paths)
level: high
tags:
    - attack.persistence
    - attack.t1219
    - attack.t1105

// ClickFix Campaign Hunt — PowerShell Execution + Malvertising Domains
let clickfix_domains = dynamic(["apirequestaccess.com", "moziw.com", "westlaw-signon.com"]);
let clickfix_hashes = dynamic(["4155a4c7e857d9b613e14cf00e148037859cf627cf4004f5a4257f2cd29de2cb", "e921fe5307e29bf6fd00000dd594356affd3a7b044e52720c7f10decbdc305b9", "ed37c12fc4beea98722f6f308cec45e6440c3089e1a002c837bed147fbeb0c52"]);
union isfuzzy=true
(
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | where ProcessCommandLine has_any ("Write-Progress", "-WindowStyle Hidden", "-ExecutionPolicy Bypass", "IEX", "DownloadString", "Net.WebClient")
    | extend HasClickFixDomain = ProcessCommandLine has_any (clickfix_domains)
    | extend HasSuspiciousHash = SHA256 in~ (clickfix_hashes)
    | where HasClickFixDomain or HasSuspiciousHash or ProcessCommandLine has "cfirm.php"
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, HasClickFixDomain, HasSuspiciousHash
),
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (clickfix_domains) or RemoteIP in ("apirequestaccess.com", "moziw.com")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
)
| sort by TimeGenerated desc

<#
.SYNOPSIS
    ClickFix Campaign IOC Hunt — Security Arsenal
.DESCRIPTION
    Hunts for ClickFix-related artifacts: PowerShell execution logs, RMM tool persistence,
    scheduled tasks, and network connections to known malicious domains.
.AUTHOR
    Security Arsenal Threat Intelligence
#>

$ClickFixDomains = @("apirequestaccess.com", "moziw.com", "westlaw-signon.com")
$ClickFixHashes = @(
    "4155a4c7e857d9b613e14cf00e148037859cf627cf4004f5a4257f2cd29de2cb",
    "e921fe5307e29bf6fd00000dd594356affd3a7b044e52720c7f10decbdc305b9",
    "ed37c12fc4beea98722f6f308cec45e6440c3089e1a002c837bed147fbeb0c52"
)
$RMMProcesses = @("AnyDesk", "TeamViewer", "ScreenConnect", "Splashtop", "Atera", "ConnectWise")

Write-Host "=== ClickFix Campaign IOC Hunt ===" -ForegroundColor Cyan
Write-Host "Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')`n"

# 1. Check for suspicious PowerShell execution in Event Logs
Write-Host "[1] Checking PowerShell Operational Logs..." -ForegroundColor Yellow
try {
    $PSLogs = Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104} -MaxEvents 500 -ErrorAction SilentlyContinue
    $SuspiciousPS = $PSLogs | Where-Object {
        $_.Message -match "Write-Progress|DownloadString|Net.WebClient|IEX|Invoke-Expression" -or
        $ClickFixDomains | ForEach-Object { $_.Message -match $_ }
    }
    if ($SuspiciousPS) {
        Write-Host "  [ALERT] Found $($SuspiciousPS.Count) suspicious PowerShell script blocks" -ForegroundColor Red
        $SuspiciousPS | Select-Object -First 5 | ForEach-Object {
            Write-Host "    Time: $($_.TimeCreated) | User: $($_.Properties[0].Value)" -ForegroundColor Red
        }
    } else { Write-Host "  [OK] No suspicious PowerShell blocks found" -ForegroundColor Green }
} catch { Write-Host "  [INFO] PowerShell logging not enabled or no events" -ForegroundColor Gray }

# 2. Check for RMM tool persistence
Write-Host "`n[2] Checking RMM Tool Persistence..." -ForegroundColor Yellow
$RMMFound = $false
foreach ($tool in $RMMProcesses) {
    $svc = Get-Service -Name "*$tool*" -ErrorAction SilentlyContinue
    if ($svc) {
        Write-Host "  [ALERT] RMM service found: $($svc.Name) — Status: $($svc.Status)" -ForegroundColor Red
        $RMMFound = $true
    }
}
if (-not $RMMFound) { Write-Host "  [OK] No suspicious RMM services detected" -ForegroundColor Green }

# 3. Check Scheduled Tasks for persistence
Write-Host "`n[3] Checking Scheduled Tasks..." -ForegroundColor Yellow
$SuspiciousTasks = Get-ScheduledTask | Where-Object {
    $_.TaskName -match "Update|Maintenance|Sync|Check" -and
    ($_.Actions.Execute -match "powershell|cmd|wscript|cscript") -and
    ($_.TaskPath -notmatch "Microsoft")
}
if ($SuspiciousTasks) {
    Write-Host "  [ALERT] Found $($SuspiciousTasks.Count) suspicious scheduled tasks" -ForegroundColor Red
    $SuspiciousTasks | Select-Object -First 5 | ForEach-Object {
        Write-Host "    Task: $($_.TaskName) | Action: $($_.Actions.Execute)" -ForegroundColor Red
    }
} else { Write-Host "  [OK] No suspicious scheduled tasks found" -ForegroundColor Green }

# 4. Check network connections to ClickFix domains
Write-Host "`n[4] Checking Active Network Connections..." -ForegroundColor Yellow
$NetConnections = Get-NetTCPConnection | Where-Object {
    $ClickFixDomains | ForEach-Object { $_.RemoteAddress -match $_ } -or
    $_.RemotePort -in @(80, 443)
}
$SuspiciousNet = $NetConnections | Where-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $proc -and ($proc.ProcessName -match "powershell|wscript|cscript|mshta|rundll32")
}
if ($SuspiciousNet) {
    Write-Host "  [ALERT] Suspicious network connections detected" -ForegroundColor Red
    $SuspiciousNet | Select-Object -First 5 | ForEach-Object {
        $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "    $($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) | Process: $($p.ProcessName)" -ForegroundColor Red
    }
} else { Write-Host "  [OK] No suspicious network connections to ClickFix domains" -ForegroundColor Green }

# 5. Check for malicious file hashes
Write-Host "`n[5] Checking for Malicious File Hashes..." -ForegroundColor Yellow
$HashFound = $false
$SearchPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA\Temp", "$env:USERPROFILE\Downloads")
foreach ($path in $SearchPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($ClickFixHashes -contains $hash) {
                Write-Host "  [ALERT] Malicious file found: $($_.FullName)" -ForegroundColor Red
                $HashFound = $true
            }
        }
    }
}
if (-not $HashFound) { Write-Host "  [OK] No known malicious hashes found in common paths" -ForegroundColor Green }

Write-Host "`n=== Hunt Complete ===" -ForegroundColor Cyan