ClickFix, GlassWorm & EtherRAT: Multi-Vector APT Campaign Analysis

title: Potential ClickFix Browser Spawning Shell
id: 8c7b3c1d-5e6f-4a2b-9c1d-8e7f6a5b4c3d
description: Detects potential ClickFix activity where a browser process spawns a shell (cmd/ps) often used to trick users into fixing fake browser errors.
status: experimental
date: 2026/04/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64273d7f8e4c4
tags:
    - attack.initial_access
    - attack.user_execution
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Legitimate developer tools launching shells
level: high
---
title: Suspicious Node.js Process with Network Connection
id: 9d8e4f2a-6f7g-5b3c-0d2e-1f9g8h7i6j5k
description: Detects Node.js processes (used by EtherRAT) initiating network connections, potentially to C2 or RPC endpoints.
status: experimental
date: 2026/04/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64273d8f9e5c5
tags:
    - attack.execution
    - attack.c2
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        Initiated: 'true'
    filter_legit_rpc:
        DestinationPort:
            - 8545 # Ethereum JSON-RPC
            - 8900 # Solana RPC
    condition: selection and not filter_legit_rpc
falsepositives:
    - Legitimate Node.js applications
level: medium
---
title: GlassWorm Suspicious Browser Extension Registry Modification
id: 0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
description: Detects modifications to browser extension registry keys indicative of GlassWorm installing a malicious extension.
status: experimental
date: 2026/04/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64273d9f0e6c6
tags:
    - attack.persistence
    - attack.t1543
logsource:
    category: registry_set
    product: windows
detection:
    selection_chrome:
        TargetObject|contains: 'Software\Google\Chrome\Extensions'
    selection_edge:
        TargetObject|contains: 'Software\Microsoft\Edge\Extensions'
    condition: 1 of selection*
falsepositives:
    - Admin installing legitimate extensions
level: medium

// Hunt for connections to ClickFix and EtherRAT IOCs
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in (
    'ustazazharidrus.com', 'account-help.info', 'quiptly.com', 'elive123go.com', 
    'visitbundala.com', 'nhacaired88.com', 'subsgod.com', 'ariciversontile.com',
    'o-parana.com', 'rpc.payload.de', 'jariosos.com', 'hayesmed.com',
    'regancontrols.com', 'salinasrent.com', 'justtalken.com', 'mebeliotmasiv.com'
)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP

# Hunt for ClickFix & EtherRAT artifacts
$IOC_Domains = @(
    "ustazazharidrus.com", "account-help.info", "quiptly.com", "elive123go.com",
    "visitbundala.com", "nhacaired88.com", "subsgod.com", "ariciversontile.com",
    "o-parana.com", "rpc.payload.de", "jariosos.com", "hayesmed.com",
    "regancontrols.com", "salinasrent.com", "justtalken.com", "mebeliotmasiv.com"
)

Write-Host "[+] Checking DNS Cache for malicious domains..."
$DNS_Cache = Get-DnsClientCache | Where-Object { $IOC_Domains -contains $_.Data }
if ($DNS_Cache) {
    Write-Host "[!] ALERT: Found malicious domain entries in DNS Cache:" -ForegroundColor Red
    $DNS_Cache | Format-Table Entry, Data, TimeToLive
} else {
    Write-Host "[-] No malicious domains found in local DNS cache."
}

Write-Host "[+] Checking for suspicious Node.js processes (EtherRAT/GlassWorm)..."
$NodeProcesses = Get-Process -Name node -ErrorAction SilentlyContinue
if ($NodeProcesses) {
    Write-Host "[!] WARNING: Node.exe processes found. Verify if legitimate." -ForegroundColor Yellow
    foreach ($proc in $NodeProcesses) {
        Write-Host "PID: $($proc.Id), Path: $($proc.Path)"
        # Check for network connections
        Get-NetTCPConnection -OwningProcess $proc.Id -ErrorAction SilentlyContinue | Select-Object LocalAddress, RemoteAddress, State
    }
}