---
title: Potential ClickFix BackgroundFix Activity
id: 4c8f9a2b-1c3d-4f5e-8b9a-1c2d3e4f5a6b
description: Detects the execution chain associated with ClickFix involving finger.exe or suspicious background fix patterns.
status: experimental
date: 2026/05/31
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\finger.exe'
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\explorer.exe'
  condition: selection
falsepositives:
  - Legitimate administration usage of finger.exe (rare)
level: critical
tags:
  - attack.execution
  - attack.t1059.001
  - c2.clickfix
---
title: LofyStealer Node.js Loader Execution
id: 5d9g0b3c-2d4e-5g6f-9c0b-2d3e4f5g6a7c
description: Detects Node.js processes spawning suspicious child processes or loading large memory modules indicative of LofyStealer.
status: experimental
date: 2026/05/31
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    Image|endswith:
      - '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\rundll32.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate Node.js development workflows
level: high
tags:
  - attack.defense_evasion
  - attack.t1055.001
  - malware.lofystealer
---
title: JINX-0164 Spoofed Microsoft Domain Connection
id: 6e0h1c4d-3e5f-6h7g-0d1c-3e4f5g6h7a8d
description: Detects network connections to domains spoofing Microsoft services associated with JINX-0164.
status: experimental
date: 2026/05/31
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'teamicrosoft.com'
      - 'live.us.org'
      - 'driver-updater.net'
  condition: selection
falsepositives:
  - Unknown
level: critical
tags:
  - attack.initial_access
  - attack.t1566.002
  - apt.jinx-0164


kql
// Hunt for ClickFix and JINX-0164 Network Indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ ("trindastal.com", "poronto.com", "brionter.com", "giovettiadv.com", "login.teamicrosoft.com", "teams.live.us.org", "live.ong", "driver-updater.net")
   or RemotePort == 688
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemotePort, RemoteIP
| extend MITRE = "Command and Control / Initial Access"

// Hunt for LofyStealer Process Anomalies
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName =~ "node.exe" and (ProcessFileName in~ ("cmd.exe", "powershell.exe") or ProcessCommandLine contains "-e ")
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, FolderPath
| extend MITRE = "Execution / Defense Evasion"


powershell
# IOC Hunt Script for ClickFix, LofyStealer, and JINX-0164
# Requires Administrator privileges

$IoCs = @{
    "Hashes" = @(
        "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92", # ClickFix
        "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9", # ClickFix
        "f5dbaa09e60343f252a80d4a313a36ac11442d96b0896022d1a83744e3c11feb", # ClickFix
        "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881", # LofyStealer
        "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7", # LofyStealer
        "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17"  # JINX-0164
    )
    "Domains" = @(
        "trindastal.com", "poronto.com", "brionter.com", "giovettiadv.com",
        "login.teamicrosoft.com", "teams.live.us.org", "live.ong", "driver-updater.net"
    )
}

Write-Host "[+] Scanning for file IOCs..." -ForegroundColor Cyan
$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($Hash in $IoCs.Hashes) {
    foreach ($Drive in $Drives) {
        try {
            Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
            Where-Object { $_.Length -gt 0 } | 
            ForEach-Object { 
                $FileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                if ($FileHash -eq $Hash) {
                    Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
                }
            }
        } catch {}
    }
}

Write-Host "[+] Checking Hosts file for malicious domains..." -ForegroundColor Cyan
$HostsPath = "$env:windir\System32\drivers\etc\hosts"
$HostsContent = Get-Content $HostsPath
foreach ($Domain in $IoCs.Domains) {
    if ($HostsContent -match $Domain) {
        Write-Host "[!] SUSPICIOUS ENTRY IN HOSTS FILE: $Domain" -ForegroundColor Yellow
    }
}

Write-Host "[+] Scan Complete." -ForegroundColor Green


# Response Priorities