ClickFix, GlassWorm & EtherRAT Campaigns: Social Engineering + Blockchain C2 Tactics

---
title: Potential ClickFix Social Engineering Activity
id: 4b0d1e2e-7c1a-4a5e-9f8a-1b2c3d4e5f6a
description: Detects suspicious PowerShell or CMD execution often associated with ClickFix campaigns where users are tricked into pasting commands.
status: experimental
date: 2026/04/26
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - 'copy-item'
      - 'iex'
      - 'invoke-expression'
  condition: selection
falsepositives:
  - Legitimate administration tasks performed by IT staff
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1059.001
  - clickfix
level: high
---
title: Suspicious Node.js Network Connection (EtherRAT)
id: 5c1e2f3f-8d2b-5b6f-0a9b-2c3d4e5f6a7b
description: Detects Node.js processes establishing network connections, indicative of EtherRAT or other Node-based backdoors in non-dev environments.
status: experimental
date: 2026/04/26
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\node.exe'
    Initiated: 'true'
  filter:
    DestinationPort|startswith:
      - '80'
      - '443'
  condition: selection and not filter
falsepositives:
  - Legitimate Node.js development servers
tags:
  - attack.command_and_control
  - attack.c2
  - etherrat
level: medium
---
title: Ethereum RPC Interaction via Non-Standard Client
id: 6d2f3g4g-9e3c-6c7g-1b2c-3d4e5f6a7b8c
description: Detects processes connecting to Ethereum RPC endpoints or ports, associated with GlassWorm or EtherHiding C2 mechanisms.
status: experimental
date: 2026/04/26
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 8545
      - 8546
      - 30303
    DestinationHostname|contains:
      - '.eth.'
      - 'rpc.'
  condition: selection
falsepositives:
  - Legitimate Web3 applications or developer tools
tags:
  - attack.command_and_control
  - glassworm
  - etherrat
level: high

// Hunt for ClickFix domains and Node.js C2 activity
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemoteUrl has_any ("ustazazharidrus.com", "account-help.info", "o-parana.com", "rpc.payload.de") 
   or InitiatingProcessFileName == "node.exe"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| extend ThreatType = iif(InitiatingProcessFileName == "node.exe", "Potential EtherRAT Node Activity", "Known Malicious C2 Domain")

<#
.SYNOPSIS
    IOC Hunt Script for ClickFix and EtherRAT Campaigns
.DESCRIPTION
    Checks local DNS cache and Hosts file for indicators associated with ClickFix and EtherRAT.
#>

$MaliciousDomains = @(
    "ustazazharidrus.com", "account-help.info", "quiptly.com", 
    "o-parana.com", "rpc.payload.de", "jariosos.com"
)

# Check DNS Cache
Write-Host "Checking DNS Cache for Malicious Domains..." -ForegroundColor Cyan
$DnsCache = Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry }
if ($DnsCache) {
    Write-Host "[ALERT] Malicious entries found in DNS Cache:" -ForegroundColor Red
    $DnsCache | Format-Table Entry, Data, Type
} else {
    Write-Host "No malicious entries found in DNS Cache." -ForegroundColor Green
}

# Check Hosts File
Write-Host "Checking Hosts File..." -ForegroundColor Cyan
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    $Matches = @()
    foreach ($Domain in $MaliciousDomains) {
        if ($HostsContent -match $Domain) {
            $Matches += $Domain
        }
    }
    if ($Matches) {
        Write-Host "[ALERT] Malicious entries found in Hosts File: $Matches" -ForegroundColor Red
    } else {
        Write-Host "No malicious entries found in Hosts File." -ForegroundColor Green
    }
}