title: Potential ClickFix Activity via Finger.exe
id: 4a8b1c9d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
description: Detects the suspicious use of finger.exe to download content, a behavior associated with the ClickFix campaign and CastleLoader delivery.
status: experimental
date: 2026/06/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/667a6e8f8e9f9c0d1e2f3a4b
tags:
    - attack.initial_access
    - attack.t1190
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\finger.exe'
    filter:
        CommandLine|contains:
            - 'http'
            - '.exe'
            - '.ps1'
    condition: selection and filter
falsepositives:
    - Legitimate use of finger.exe (rare in modern environments)
level: high
---
title: JINX-0164 Typosquatting Domain Connection
id: 5b9c2d0e-6f7a-5b8c-9d0e-1f2a3b4c5d6e
description: Detects network connections to known typosquatted domains used by JINX-0164 for phishing and C2 infrastructure.
status: experimental
date: 2026/06/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/667a6e8f8e9f9c0d1e2f3a4c
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'teamicrosoft.com'
            - 'live.us.org'
            - 'driver-updater.net'
    condition: selection
falsepositives:
    - None
level: critical
---
title: Suspicious Node.js Loader Pattern (LofyStealer)
id: 6c0d3e1f-7g8b-6c9d-0e1f-2a3b4c5d6e7f
description: Detects Node.js processes spawning suspicious child processes like PowerShell or Cmd, indicative of loader activity seen in LofyStealer campaigns.
status: experimental
date: 2026/06/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/667a6e8f8e9f9c0d1e2f3a4d
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    parent:
        Image|endswith: '\node.exe'
    child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
    condition: parent and child
falsepositives:
    - Legitimate Node.js development tooling
level: medium

// Hunt for ClickFix Finger.exe activity and Domain connections
let IOCs = dynamic(["trindastal.com", "poronto.com", "brionter.com", "giovettiadv.com", "driver-updater.net", "login.teamicrosoft.com", "live.ong", "teams.live.us.org", "www.live.us.org"]);
let MaliciousHashes = dynamic(["bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92", "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9", "f5dbaa09e60343f252a80d4a313a36ac11442d96b0896022d1a83744e3c11feb", "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881", "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7", "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17"]);
// Check for Network Events
DeviceNetworkEvents
| where RemoteUrl in (IOCs) or RemotePort == 688
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemotePort
| union (
    DeviceProcessEvents
    | where ProcessVersionInfoSHA256 in (MaliciousHashes) or (FolderPath endswith "\\finger.exe" and ProcessCommandLine contains "http")
    | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
)

<#
.SYNOPSIS
    IOC Hunt Script for ClickFix, LofyStealer, and JINX-0164.
.DESCRIPTION
    Scans the file system for known malicious hashes and checks for the presence of suspicious processes like finger.exe.
#>

$MaliciousSHA256 = @(
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9",
    "f5dbaa09e60343f252a80d4a313a36ac11442d96b0896022d1a83744e3c11feb",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881",
    "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7",
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17"
)

Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Cyan

$DrivesToScan = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($Drive in $DrivesToScan) {
    try {
        $Files = Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue -File
        foreach ($File in $Files) {
            $Hash = (Get-FileHash -Path $File.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($Hash -in $MaliciousSHA256) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($File.FullName)" -ForegroundColor Red
            }
        }
    } catch {
        # Ignore access errors
    }
}

Write-Host "[+] Checking for suspicious 'finger.exe' execution..." -ForegroundColor Cyan

$Processes = Get-Process -Name "finger" -ErrorAction SilentlyContinue
if ($Processes) {
    Write-Host "[!] WARNING: finger.exe is currently running. This is highly suspicious in modern environments." -ForegroundColor Red
    foreach ($Proc in $Processes) {
        Write-Host "    PID: $($Proc.Id), Path: $($Proc.Path)"
    }
} else {
    Write-Host "[-] No finger.exe processes detected."
}

Write-Host "[+] Hunt Complete."


# Response Priorities

*   **Immediate**:
    *   Block all domains and hostnames listed in the IOC Analysis at the network perimeter.
    *   Scan endpoints for the specific file hashes associated with CastleLoader, LofyStealer, and JINX-0164 payloads.
    *   Kill any instances of `finger.exe` not initiated by a verified system administrator.

*   **24 Hours**:
    *   Initiate credential resets for developers or users in the Finance/Crypto sectors if credential theft is suspected (LofyStealer/AUDIOFIX).
    *   Review LinkedIn messages for recruitment-themed phishing targeting your organization's technical staff.

*   **1 Week**:
    *   Implement application control policies to restrict the usage of `finger.exe` and unsigned Node.js executables in user environments.
    *   Conduct security awareness training focused on "Clipboard Hijacking" and technical support scams.
    *   Audit software supply chains and verify the integrity of NPM packages used in development environments.