ClickFix, LofyStealer & JINX-0164: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Potential ClickFix BackgroundFix Activity
id: 8a3b1c9d-5e4f-4a2b-9c1d-8e7f6a5b4c3d
description: Detects the use of finger.exe associated with ClickFix campaigns to retrieve payloads.
status: experimental
date: 2026/06/01
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\finger.exe'
    condition: selection
falsepositives:
    - Legitimate administrative use of finger.exe (rare)
level: high
tags:
    - attack.defense_evasion
    - attack.t1218
---
title: Suspicious Node.js Loader - LofyStealer Pattern
id: 7b2a0c8e-4d3f-3b1a-8b0c-7d6e5a4c3b2a
description: Detects Node.js processes spawning non-node binaries, a pattern associated with the LofyStealer Node.js loader.
status: experimental
date: 2026/06/01
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|contains: 'node.exe'
        Image|endswith: '.exe'
        Image|notcontains: 'node.exe'
    condition: selection
falsepositives:
    - Legitimate Node.js development workflows
level: medium
tags:
    - attack.execution
    - attack.t1059
---
title: JINX-0164 macOS Suspicious Installer Execution
id: 6c1a9b7d-3c2e-2a0c-9a1b-6c5f4e3d2c1b
description: Detects execution of curl or sh scripts associated with JINX-0164 infrastructure on macOS.
status: experimental
date: 2026/06/01
author: Security Arsenal
logsource:
    category: process_creation
    product: macos
detection:
    selection_curl:
        Image|endswith: '/curl'
        CommandLine|contains: 'install.sh'
    selection_domains:
        CommandLine|contains:
            - 'driver-updater.net'
            - 'live.ong'
            - 'teamicrosoft.com'
    condition: 1 of selection*
falsepositives:
    - Legitimate software installation scripts
level: high
tags:
    - attack.initial_access
    - attack.t1190

// Hunt for ClickFix finger.exe activity and network connections
DeviceProcessEvents
| where FileName =~ "finger.exe"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessCommandLine
| join kind=inner (DeviceNetworkEvents 
    | where RemoteUrl in ("trindastal.com", "poronto.com", "brionter.com", "giovettiadv.com") 
    or RemotePort == 688) on DeviceName, Timestamp
| distinct Timestamp, DeviceName, RemoteUrl, RemotePort, ProcessCommandLine

<#
.SYNOPSIS
    IOC Hunt for ClickFix and JINX-0164 domains in hosts file and running processes.
#>

$MaliciousDomains = @(
    "trindastal.com",
    "poronto.com", 
    "brionter.com",
    "driver-updater.net",
    "live.ong",
    "teamicrosoft.com",
    "login.teamicrosoft.com"
)

$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"

Write-Host "[+] Checking Hosts file for malicious domain mappings..."
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($domain in $MaliciousDomains) {
        if ($HostsContent -match $domain) {
            Write-Host "[!] ALERT: Domain found in hosts file: $domain" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Checking for active network connections to malicious domains..."
$Connections = Get-NetTCPConnection | Select-Object -ExpandProperty RemoteAddress
$DNSCache = Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Entry }

if ($DNSCache) {
    Write-Host "[!] ALERT: DNS Cache hit for malicious domains:" -ForegroundColor Red
    $DNSCache | Format-Table Entry, Data -AutoSize
}

Write-Host "[+] Checking for finger.exe process..."
$FingerProcess = Get-Process -Name finger -ErrorAction SilentlyContinue
if ($FingerProcess) {
    Write-Host "[!] ALERT: finger.exe is running (PID: $($FingerProcess.Id))" -ForegroundColor Red
}