ClickFix RAT MaaS, Kimsuky Gomir Variants & Mirage2FA AiTM Phishing: OTX Pulse Analysis — Enterprise Detection Pack

---
title: ClickFix MSI Execution via User-Pasted Command (mshta/powershell)
id: 7c3a1f2e-9b41-4d2a-a6c8-1e5f0a9b2c01
status: experimental
description: Detects ClickFix-style social engineering where users are tricked into running commands that fetch and execute MSI installers (NodeJS RAT delivery pattern).
author: Security Arsenal
date: 2026/08/19
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\wscript.exe'
  selection_cmd:
    CommandLine|contains:
      - 'msiexec'
      - '.msi'
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'Start-BitsTransfer'
      - 'curl '
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - Legitimate software deployment (SCCM/Intune) — filter on known management account contexts
level: high
tags:
  - attack.initial_access
  - attack.t1204
  - attack.t1105
  - attack.t1218
---
title: Outbound gRPC over Tor Port 50051 (Modular RAT C2)
id: 8d4b2g3f-0c52-5e3b-b7d9-2f6g1b0c3d02
status: experimental
description: Detects outbound connections to port 50051 (gRPC default) or Tor network processes, matching the ClickFix NodeJS RAT C2 channel.
author: Security Arsenal
date: 2026/08/19
logsource:
  category: network_connection
  product: windows
  service: sysmon
detection:
  selection_port:
    DestinationPort: 50051
  selection_tor_image:
    Image|endswith:
      - '\tor.exe'
      - '\tor\tor.exe'
      - '\obfs4proxy.exe'
  selection_tor_domain:
    DestinationHostname|contains: '.onion'
  condition: selection_port or selection_tor_image or selection_tor_domain
falsepositives:
  - Legitimate gRPC microservices (rare on endpoints; validate destination)
level: critical
tags:
  - attack.command_and_control
  - attack.t1573
  - attack.t1090
---
title: Non-Browser QUIC HTTP/3 C2 or Cloud Storage API Abuse (BirdTroy / DriveTroy)
id: 9e5c3h4g-1d63-6f4c-c8e0-3g7h2c1d4e03
status: experimental
description: Detects UDP/443 (QUIC) connections from non-browser processes or unexpected Google Drive API access, matching Kimsuky BirdTroy HTTP/3 C2 and DriveTroy Google Drive C2 patterns.
author: Security Arsenal
date: 2026/08/19
logsource:
  category: network_connection
  product: windows
  service: sysmon
detection:
  selection_quic:
    DestinationPort: 443
    Protocol: 'udp'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_gdrive:
    DestinationHostname|contains:
      - 'googleapis.com'
      - 'drive.google.com'
  selection_unusual_proc:
    Image|endswith:
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
  condition: (selection_quic and not filter_browsers) or (selection_gdrive and selection_unusual_proc)
falsepositives:
  - Chrome-based Electron apps using QUIC; scheduled backup tools using Drive API — tune per environment
level: high
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1102
  - attack.t1567

// Mirage2FA AiTM phishing + ClickFix RAT + Kimsuky C2 hunt (Microsoft Sentinel / Defender)
let phishingIPs = dynamic(["192.52.166.55","209.205.197.130","181.214.165.173","83.147.53.130"]);
let phishingDomains = dynamic(["galatasaraydanhaberler.com","sopbtech.store","pcvgtech.store","verpox.shop","bull-run.fun","spot-wave.fun","cloud-verificate.com"]);
let kimsukyHosts = dynamic(["commit.hanbiro.o-r.kr","node828765.dwservice.net","node896147.dwservice.net","dwservice.net"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (phishingIPs)
   or RemoteUrl has_any (phishingDomains)
   or RemoteUrl has_any (kimsukyHosts)
   or (RemotePort == 50051)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort;
let ClickFixProc = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where (FileName in~ ("powershell.exe","cmd.exe","mshta.exe","wscript.exe"))
  and (ProcessCommandLine has_any (".msi","msiexec","Invoke-WebRequest","iwr ","Start-BitsTransfer"))
  and InitiatingProcessFileName in~ ("explorer.exe","msedge.exe","chrome.exe","firefox.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
let QUICC2 = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemotePort == 443 and Protocol == "Udp"
| where InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe","ms-teams.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl;
union NetHits, ClickFixProc, QUICC2
| sort by TimeGenerated desc

# Security Arsenal — IOC Hunt: ClickFix RAT / Kimsuky / Mirage2FA artifacts
# Run elevated on suspect endpoints. Outputs JSON to $env:TEMP\sa_ioc_hunt.json
$report = [ordered]@{ Host=$env:COMPUTERNAME; Timestamp=(Get-Date -Format o); Findings=@() }

# 1) ClickFix RAT — suspicious MSI installs & NodeServer payload remnants
$msiEvents = Get-WinEvent -FilterHashtable @{LogName='Application'; Id=1033,1034,11707} -MaxEvents 200 -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'NodeServer|cloud-verificate|Setup-Full' }
if ($msiEvents) { $report.Findings += @{Type='MSI_Install'; Detail=($msiEvents | Select-Object TimeCreated,Message | ConvertTo-Json -Compress)} }

# 2) NodeJS RAT loader — rogue node.exe outside sanctioned paths
$nodeProcs = Get-CimInstance Win32_Process -Filter "Name='node.exe'" -ErrorAction SilentlyContinue |
  Where-Object { $_.ExecutablePath -notmatch 'Program Files|nodejs|nvm|AppData\\Local\\Programs' }
if ($nodeProcs) { $report.Findings += @{Type='Rogue_NodeJS'; Detail=($nodeProcs | Select-Object ProcessId,ExecutablePath,CommandLine | ConvertTo-Json -Compress)} }

# 3) Tor / gRPC C2 — active or recent connections to :50051 or Tor processes
$grpcConns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $_.RemotePort -eq 50051 }
if ($grpcConns) { $report.Findings += @{Type='gRPC_C2_50051'; Detail=($grpcConns | ConvertTo-Json -Compress)} }
$torProc = Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'tor.exe|obfs4proxy' }
if ($torProc) { $report.Findings += @{Type='Tor_Process'; Detail=($torProc | Select-Object ProcessId,ExecutablePath | ConvertTo-Json -Compress)} }

# 4) Persistence — Run keys & scheduled tasks referencing MSI/node/temp paths
$runKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
foreach ($k in $runKeys) {
  Get-ItemProperty -Path $k -ErrorAction SilentlyContinue | ForEach-Object {
    $_.PSObject.Properties | Where-Object { $_.Value -match 'node|\.msi|AppData\\Local\\Temp|cloud-verificate' } |
      ForEach-Object { $report.Findings += @{Type='RunKey_Persistence'; Key=$k; Name=$_.Name; Value=$_.Value} }
  }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
  ($_.Actions.Execute -match 'node.exe|powershell|mshta') -and ($_.TaskPath -notmatch 'Microsoft')
} | ForEach-Object { $report.Findings += @{Type='Suspicious_ScheduledTask'; Task=$_.TaskName; Action=$_.Actions.Execute} }

# 5) Kimsuky — DWService remote access & BirdTroy hash presence
if (Test-Path "$env:ProgramFiles\DWService","$env:LOCALAPPDATA\DWService" -ErrorAction SilentlyContinue) {
  $report.Findings += @{Type='DWService_Install'; Detail='Unauthorized remote access tooling present (Kimsuky TTP)'}
}
$hashes = '84e9b066bebd49036b7fc71b5f5f8d83','a452a860f973c7a43ea804c17e9427d2','aa61e76255a6e13313439655bc02bdf5','b1c72139f2cdd9419562369fc6ced4fc'
Get-ChildItem -Path "$env:TEMP","$env:LOCALAPPDATA\Temp","$env:ProgramData" -Recurse -File -ErrorAction SilentlyContinue -Depth 3 |
  ForEach-Object { $h=(Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
    if ($hashes -contains $h.ToLower()) { $report.Findings += @{Type='Kimsuky_Implant_Hash'; Path=$_.FullName; MD5=$h} } }

# 6) Mirage2FA — HTML smuggling lure files in Downloads
Get-ChildItem "$env:USERPROFILE\Downloads" -Filter *.html -ErrorAction SilentlyContinue |
  Where-Object { (Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue) -match 'atob\(|Blob\(|login\.microsoftonline|msauth' } |
  ForEach-Object { $report.Findings += @{Type='HTML_Smuggling_Lure'; Path=$_.FullName; LastWrite=$_.LastWriteTime} }

$report | ConvertTo-Json -Depth 5 | Out-File "$env:TEMP\sa_ioc_hunt.json" -Encoding utf8
Write-Host "[+] Hunt complete. $($report.Findings.Count) finding groups -> $env:TEMP\sa_ioc_hunt.json"