---
title: Suspicious Python Execution via LOLBINs (ClickFix Activity)
id: 8f8c8f8c-1234-5678-9101-112233445566
status: experimental
description: Detects execution of portable Python runtimes spawned by Windows LOLBINs (finger.exe, cmd.exe) characteristic of ClickFix campaigns delivering CastleLoader.
author: Security Arsenal
date: 2026/06/09
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\python.exe'
            - '\pythonw.exe'
            - '\ipy.exe'
        ParentImage|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
            - '\finger.exe'
    condition: selection
falsepositives:
    - Legitimate developer usage of Python scripts from CLI
level: high
---
title: macOS Suspicious Terminal/AppleScript Execution (ClickFix)
id: 9f9d9f9d-2345-6789-0121-223344556677
status: experimental
description: Detects execution of commands via osascript or terminal that download and execute binaries, associated with ClickFix campaigns delivering AMOS or Shub Stealer.
author: Security Arsenal
date: 2026/06/09
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    category: process_creation
    product: macos
detection:
    selection_download:
        CommandLine|contains:
            - 'curl '
            - 'wget '
    selection_suspicious_flags:
        CommandLine|contains:
            - 'nohup'
            - '&>/dev/null'
            - '/bin/bash'
    condition: all of selection_*
falsepositives:
    - Legitimate system administration scripts
level: medium
---
title: EarthWorm and ReverseSocks5 Tunneling Tool Execution
id: a0a0a0a0-3456-7890-1232-334455667788
status: experimental
description: Detects execution of known tunneling tools EarthWorm or ReverseSocks5 used by CL-STA-1132 for lateral movement after exploiting boundary devices.
author: Security Arsenal
date: 2026/06/09
tags:
    - attack.command_and_control
    - attack.t1090
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\ew.exe'
        - CommandLine|contains: 'reversesocks5'
        - Image|endswith: '\ssocks.exe'
    condition: 1 of selection
falsepositives:
    - Rare legitimate usage of tunneling tools by admins
level: critical

// Hunt for ClickFix domains in network traffic
DeviceNetworkEvents
| where RemoteUrl in ("teamsvoicehub.com", "dapala.net", "staruxaproruha.com", "ai-like.net", "mtg-life.net", "novayastaruxa.com", "kevinnotanother.com", "jihiz.com", "kayeart.com", "bintail.com", "wusetail.com", "malext.com", "miappl.com", "pla7ina.cfd", "vagturk.com")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| extend ThreatIntel = "ClickFix_Domain"

// Hunt for suspicious Python execution patterns
DeviceProcessEvents
| where (ProcessVersionInfoOriginalFileName in ("python.exe", "pythonw.exe") or ProcessCommandLine contains "python") 
and (InitiatingProcessFileName in ("cmd.exe", "powershell.exe", "finger.exe") or InitiatingProcessCommandLine contains "google.com")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256

<#
.SYNOPSIS
    Hunt script for CastleLoader and ClickFix artifacts.
.DESCRIPTION
    Checks for the presence of the specific CastleLoader SHA256 hash and suspicious scheduled tasks often associated with Python RAT persistence.
#>

$TargetHash = "08a474368a2f94f347ad9e1a0a08d4258fcf49c6b9373214f7901bb770bacca4"
$Drives = @("C:", "D:", "E:")

Write-Host "[+] Hunting for CastleLoader Hash..."
foreach ($Drive in $Drives) {
    if (Test-Path $Drive) {
        Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Length -gt 0 } | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($hash -eq $TargetHash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking for suspicious Python persistence..."
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*python*" -and $_.Author -eq "" } | Select-Object TaskName, TaskPath, Actions

Write-Host "[+] Checking recent network connections to ClickFix domains..."
$Domains = @("teamsvoicehub.com", "jihiz.com", "kayeart.com")
$DNSCache = Get-DnsClientCache | Where-Object { $Domains -contains $_.Entry }
if ($DNSCache) {
    Write-Host "[!] Suspicious DNS cache entries found:" -ForegroundColor Yellow
    $DNSCache | Format-Table Entry, Data, TimeToLive
} else {
    Write-Host "[-] No suspicious DNS cache entries found."
}


# Response Priorities

*   **Immediate:** Block all listed domains at the perimeter (DNS Proxy/SWG). Review firewall logs for indicators of PAN-OS Captive Portal exploitation. Apply emergency patches for CVE-2026-1340 and CVE-2026-1731.
*   **24h:** Conduct a credential audit for users who may have interacted with the ClickFix job scams. Scan endpoints for the CastleLoader SHA256 hash.
*   **1 week:** Update security awareness training to include "fake browser update/captcha" and "job scam" lures. Review network segmentation policies to limit lateral movement from compromised perimeter devices.