ClickFix RAT Campaign, n0n AI-Assisted Ransomware, and Convertr Magecart Skimmer: OTX Pulse Analysis — Enterprise Detection Pack

---
title: ClickFix Fake CAPTCHA PowerShell Execution
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects suspicious PowerShell execution patterns consistent with ClickFix social engineering campaigns delivering Lumma Stealer, SectopRAT, or AMOS. ClickFix tricks users into pasting malicious commands via fake CAPTCHA pages.
author: Security Arsenal Threat Intelligence
date: 2026/10/29
references:
    - https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat
logsource:
    category: process_creation
    product: windows
detection:
    selection_powershell:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_obfuscation:
        CommandLine|contains:
            - 'FromBase64String'
            - 'IEX'
            - 'Invoke-Expression'
            - 'DownloadString'
            - 'Net.WebClient'
            - 'Start-Process'
            - '-enc '
            - '-e '
            - 'bypass'
            - 'hidden'
    selection_clipboard_pattern:
        CommandLine|contains:
            - 'mshta'
            - 'curl'
            - 'certutil'
            - 'bitsadmin'
    condition: selection_powershell and (selection_obfuscation or selection_clipboard_pattern)
falsepositives:
    - Legitimate IT administration scripts
    - Software deployment tools
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204
---
title: SectopRAT Persistence via Registry Run Key
id: 9a4b3c2d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects registry Run key modifications commonly used by SectopRAT and follow-on payloads for persistence after ClickFix-driven initial compromise.
author: Security Arsenal Threat Intelligence
date: 2026/10/29
references:
    - https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\CurrentVersion\Run'
            - '\CurrentVersion\RunOnce'
    filter_legitimate:
        Image|endswith:
            - '\msiexec.exe'
            - '\setup.exe'
            - '\Teams.exe'
            - '\OneDriveSetup.exe'
    condition: selection and not filter_legitimate
falsepositives:
    - Software installations
    - Legitimate application auto-start configuration
level: medium
tags:
    - attack.persistence
    - attack.t1547.001
---
title: Magecart Skimmer WebSocket Exfiltration
id: 0b5c4d3e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects network connections to known Magecart skimmer exfiltration infrastructure identified in the Convertr supply chain attack.
author: Security Arsenal Threat Intelligence
date: 2026/10/29
references:
    - https://sansec.io/research/convertr-plausible-supply-chain-attack
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - '1x0.is'
            - 'ecomscan.com'
            - 'antiddos-protection.net'
            - 'deepveindrilling.com'
            - 'analytics.convertr.app.br'
    condition: selection_domain
falsepositives:
    - None expected for these specific indicators
level: critical
tags:
    - attack.exfiltration
    - attack.t1041
    - attack.t1189

// Hunt for ClickFix campaign artifacts, n0n ransomware C2, and Magecart exfiltration
// Coverage: Process execution, network connections, and DNS queries

// Part 1: ClickFix PowerShell Execution Pattern
let ClickFixProcesses = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "cmd.exe")
    | where ProcessCommandLine has_any (
        "FromBase64String", "IEX", "Invoke-Expression",
        "DownloadString", "Net.WebClient", "-enc ",
        "bypass", "hidden", "certutil", "bitsadmin"
    )
    | where InitiatingProcessFileName in~ ("explorer.exe", "msedge.exe", "chrome.exe", "firefox.exe", "brave.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName, SHA256;

// Part 2: n0n Ransomware C2 Communication
let N0nNetworkEvents = DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteIP in ("198.13.158.143", "217.18.55.185", "45.132.114.241")
       or RemoteUrl contains "beaconipv4185.157.161.93ntpsync.io"
    | project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType;

// Part 3: Magecart Skimmer Exfiltration
let MagecartNetworkEvents = DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (
        "1x0.is", "ecomscan.com", "antiddos-protection.net",
        "deepveindrilling.com", "analytics.convertr.app.br"
    )
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType;

// Part 4: Known Malicious File Hashes
let MaliciousHashes = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where SHA256 in (
        "22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4",
        "0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f",
        "14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335",
        "20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53",
        "278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48",
        "3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621",
        "ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7"
    )
    or MD5 in (
        "6ab595ad6554819181b686d4876efb80",
        "6ab6ba039440819185ed491740b11cf8"
    )
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, MD5, AccountName, ProcessCommandLine;

// Combine all results
union ClickFixProcesses, N0nNetworkEvents, MagecartNetworkEvents, MaliciousHashes
| sort by TimeGenerated desc

<#
.SYNOPSIS
    Security Arsenal — OTX IOC Hunt Script
    Campaigns: ClickFix RAT (Lumma/SectopRAT/AMOS), n0n Ransomware, Magecart Skimmer
.DESCRIPTION
    Checks endpoints for IOCs including file hashes, registry persistence,
    network connections, and DNS cache entries across all three campaigns.
.NOTES
    Run as Administrator. Requires network connectivity for DNS checks.
#>

$report = @()
$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

Write-Host "[+] Security Arsenal IOC Hunt — $timestamp" -ForegroundColor Cyan
Write-Host "[+] Campaigns: ClickFix RAT | n0n Ransomware | Magecart Skimmer`n" -ForegroundColor Cyan

# --- 1. File Hash Hunt ---
Write-Host "[*] Checking for malicious file hashes..." -ForegroundColor Yellow

$maliciousHashes = @(
    "22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4",
    "0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f",
    "14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335",
    "20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53",
    "278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48",
    "3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621",
    "ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7"
)

$searchPaths = @(
    "$env:TEMP",
    "$env:APPDATA",
    "$env:LOCALAPPDATA",
    "$env:USERPROFILE\Downloads",
    "$env:USERPROFILE\Desktop",
    "C:\Users\Public"
)

foreach ($path in $searchPaths) {
    if (Test-Path $path) {
        $files = Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue |
                 Where-Object { $_.Length -lt 50MB }
        foreach ($file in $files) {
            try {
                $hash = (Get-FileHash -Path $file.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
                if ($maliciousHashes -contains $hash.ToLower()) {
                    $finding = [PSCustomObject]@{
                        Type    = "MaliciousFile"
                        Path    = $file.FullName
                        Hash    = $hash
                        Campaign = "ClickFix RAT / Magecart"
                        Severity = "CRITICAL"
                    }
                    $report += $finding
                    Write-Host "  [!] FOUND: $($file.FullName) — $hash" -ForegroundColor Red
                }
            } catch { }
        }
    }
}

# --- 2. Registry Persistence Hunt ---
Write-Host "`n[*] Checking registry Run keys for suspicious persistence..." -ForegroundColor Yellow

$runKeyPaths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

$suspiciousPatterns = @("powershell", "mshta", "certutil", "bitsadmin", "cmd /c", "wscript", "cscript", ".tmp", "AppData")

foreach ($keyPath in $runKeyPaths) {
    if (Test-Path $keyPath) {
        $values = Get-ItemProperty -Path $keyPath -ErrorAction SilentlyContinue
        if ($values) {
            $values.PSObject.Properties | Where-Object {
                $_.Name -notmatch "^PS"
            } | ForEach-Object {
                $val = $_.Value.ToString()
                foreach ($pattern in $suspiciousPatterns) {
                    if ($val -match [regex]::Escape($pattern)) {
                        $finding = [PSCustomObject]@{
                            Type    = "SuspiciousPersistence"
                            Path    = "$keyPath\$($_.Name)"
                            Value   = $val
                            Campaign = "SectopRAT / Generic"
                            Severity = "HIGH"
                        }
                        $report += $finding
                        Write-Host "  [!] SUSPICIOUS: $($_.Name) = $val" -ForegroundColor Red
                    }
                }
            }
        }
    }
}

# --- 3. Network Connection Hunt ---
Write-Host "`n[*] Checking active network connections for malicious IPs..." -ForegroundColor Yellow

$maliciousIPs = @("198.13.158.143", "217.18.55.185", "45.132.114.241")

$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($conn in $connections) {
    if ($maliciousIPs -contains $conn.RemoteAddress) {
        $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        $finding = [PSCustomObject]@{
            Type    = "MaliciousConnection"
            Path    = "$($conn.LocalAddress):$($conn.LocalPort) -> $($conn.RemoteAddress):$($conn.RemotePort)"
            Process = "$($process.Name) (PID: $($conn.OwningProcess))"
            Campaign = "n0n Ransomware"
            Severity = "CRITICAL"
        }
        $report += $finding
        Write-Host "  [!] ACTIVE C2: $($conn.RemoteAddress):$($conn.RemotePort) — $($process.Name)" -ForegroundColor Red
    }
}

# --- 4. DNS Cache Hunt ---
Write-Host "`n[*] Checking DNS cache for malicious domains..." -ForegroundColor Yellow

$maliciousDomains = @(
    "1x0.is",
    "ecomscan.com",
    "antiddos-protection.net",
    "deepveindrilling.com",
    "analytics.convertr.app.br",
    "beaconipv4185.157.161.93ntpsync.io"
)

$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($entry in $dnsCache) {
    foreach ($domain in $maliciousDomains) {
        if ($entry.Entry -match [regex]::Escape($domain)) {
            $finding = [PSCustomObject]@{
                Type    = "MaliciousDNS"
                Path    = $entry.Entry
                Value   = $entry.Data
                Campaign = "Magecart / n0n"
                Severity = "HIGH"
            }
            $report += $finding
            Write-Host "  [!] DNS HIT: $($entry.Entry) -> $($entry.Data)" -ForegroundColor Red
        }
    }
}

# --- 5. Scheduled Task Hunt ---
Write-Host "`n[*] Checking scheduled tasks for suspicious entries..." -ForegroundColor Yellow

$tasks = Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.TaskPath -notmatch "Microsoft"
}
foreach ($task in $tasks) {
    $actions = $task.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }
    foreach ($pattern in $suspiciousPatterns) {
        if ($actions -match [regex]::Escape($pattern)) {
            $finding = [PSCustomObject]@{
                Type    = "SuspiciousScheduledTask"
                Path    = "$($task.TaskPath)$($task.TaskName)"
                Value   = ($actions -join "; ")
                Campaign = "SectopRAT / Generic"
                Severity = "HIGH"
            }
            $report += $finding
            Write-Host "  [!] TASK: $($task.TaskName) — $($actions -join '; ')" -ForegroundColor Red
        }
    }
}

# --- Summary ---
Write-Host "`n=========================================" -ForegroundColor Cyan
Write-Host "  IOC HUNT COMPLETE" -ForegroundColor Cyan
Write-Host "  Total Findings: $($report.Count)" -ForegroundColor $(if ($report.Count -gt 0) { "Red" } else { "Green" })
Write-Host "=========================================" -ForegroundColor Cyan

if ($report.Count -gt 0) {
    $outputPath = "$env:USERPROFILE\Desktop\IOC_Hunt_Report_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
    $report | Export-Csv -Path $outputPath -NoTypeInformation
    Write-Host "`n[+] Report exported to: $outputPath" -ForegroundColor Yellow
    Write-Host "[!] CRITICAL: Isolate affected endpoints and initiate incident response." -ForegroundColor Red
} else {
    Write-Host "`n[+] No IOC matches found on this endpoint." -ForegroundColor Green
}