title: ClickFix Suspicious PowerShell via Clipboard
date: 2026/04/29
status: experimental
description: Detects potential ClickFix activity where PowerShell is invoked with flags typical of copy-paste social engineering attacks (e.g., hidden window, encoded commands) spawned by user interaction processes like browsers or explorer.
references:
    - https://otx.alienvault.com/pulse/626ba6b3970a16d2f95c8f2c
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\explorer.exe'
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - ' -w hidden'
            - ' -enc '
            - ' -nop '
            - 'CopyToClipboard'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1059.001
    - clickfix
---
title: EtherRAT Node.js Process Network Activity
date: 2026/04/29
status: experimental
description: Detects Node.js processes establishing network connections, suspicious for EtherRAT backdoor activity or malware utilizing Node.js payloads.
references:
    - https://otx.alienvault.com/pulse/626ba6b3970a16d2f95c8f2d
author: Security Arsenal
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        Initiated: 'true'
    filter_legit:
        DestinationPort|contains:
            - '80'
            - '443'
            - '8080'
    condition: selection | not filter_legit
falsepositives:
    - Legitimate Node.js web servers running locally
level: medium
tags:
    - attack.command_and_control
    - attack.t1071.001
    - etherrat
---
title: Suspicious Browser Extension Registry Modification
date: 2026/04/29
status: experimental
description: Detects registry modifications that add or update browser extensions, potentially indicating GlassWorm or other extension-based malware persistence.
references:
    - https://otx.alienvault.com/pulse/626ba6b3970a16d2f95c8f2e
author: Security Arsenal
logsource:
    category: registry_set
    product: windows
detection:
    selection_chrome:
        TargetObject|contains: '\Software\Google\Chrome\Extensions\'
        Details|contains: 'update_url'
    selection_edge:
        TargetObject|contains: '\Software\Microsoft\Edge\Extensions\'
    condition: 1 of selection*
falsepositives:
    - Legitimate software installing extensions
level: medium
tags:
    - attack.persistence
    - attack.t1547.001
    - glassworm

// Hunt for ClickFix and EtherRAT Network Indicators
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any ("ustazazharidrus.com", "account-help.info", "quiptly.com", "elive123go.com", "visitbundala.com", "nhacaired88.com", "subsgod.com", "ariciversontile.com", "o-parana.com", "rpc.payload.de", "jariosos.com", "hayesmed.com", "regancontrols.com", "salinasrent.com", "justtalken.com", "mebeliotmasiv.com")
| summarize Count = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Count desc

<#
.SYNOPSIS
    Hunt script for ClickFix, GlassWorm, and EtherRAT artifacts.
.DESCRIPTION
    Checks DNS cache for malicious domains, registry for suspicious browser extensions, and processes for Node.js anomalies.
#>

$MaliciousDomains = @(
    "ustazazharidrus.com", "account-help.info", "quiptly.com", "elive123go.com",
    "visitbundala.com", "nhacaired88.com", "subsgod.com", "ariciversontile.com",
    "o-parana.com", "rpc.payload.de", "jariosos.com", "hayesmed.com",
    "regancontrols.com", "salinasrent.com", "justtalken.com", "mebeliotmasiv.com"
)

Write-Host "[*] Checking DNS Cache for malicious domains..."
$DnsCache = Get-DnsClientCache
foreach ($Domain in $MaliciousDomains) {
    $Found = $DnsCache | Where-Object { $_.Entry -like "*$Domain*" }
    if ($Found) {
        Write-Host "[!] Suspicious DNS Entry found: $($Found.Entry) - IP: $($Found.Data)" -ForegroundColor Red
    }
}

Write-Host "[*] Checking for Suspicious Browser Extensions (Chrome/Edge)..."
$Paths = @(
    "HKCU:\Software\Google\Chrome\Extensions",
    "HKLM:\Software\Google\Chrome\Extensions",
    "HKCU:\Software\Microsoft\Edge\Extensions",
    "HKLM:\Software\Microsoft\Edge\Extensions"
)

foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem $Path -ErrorAction SilentlyContinue | ForEach-Object {
            $ExtPath = $_.Name
            $UpdateUrl = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue)."update_url"
            if ($UpdateUrl -and $UpdateUrl -notmatch "clients2.google.com") {
                Write-Host "[!] Non-Google update URL found in $ExtPath : $UpdateUrl" -ForegroundColor Yellow
            }
        }
    }
}

Write-Host "[*] Checking for Node.js processes listening on network..."
$NodeProcs = Get-NetTCPConnection -OwningProcess (Get-Process node -ErrorAction SilentlyContinue).Id -ErrorAction SilentlyConnect
if ($NodeProcs) {
    Write-Host $NodeProcs | Format-Table LocalAddress, LocalPort, State, OwningProcess
}