title: Potential ClickFix Social Engineering Activity
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
description: Detects potential ClickFix activity where a browser spawns a shell (PowerShell/CMD) often used in fake browser update scams.
status: experimental
date: 2026/04/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6600000000000000
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\opera.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\pwsh.exe'
    condition: selection
falsepositives:
    - Legitimate admin tasks initiated from browser downloads
level: high
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1204
---
title: Suspicious Node.js Process Network Connection
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects Node.js processes making network connections, potentially indicating EtherRAT or similar malware.
status: experimental
date: 2026/04/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6600000000000000
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith:
            - '\node.exe'
    filter_legit:
        Initiated: 'true'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate Node.js development servers
level: medium
tags:
    - attack.command_and_control
    - attack.t1071
---
title: GlassWorm Browser Extension Persistence
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
description: Detects the creation of files in browser extension directories which may indicate GlassWorm or other extension-based malware.
status: experimental
date: 2026/04/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6600000000000000
logsource:
    category: file_create
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\Default\Extensions'
            - '\Microsoft\Edge\User Data\Default\Extensions'
            - '\Mozilla\Firefox\Profiles\extensions'
    condition: selection
falsepositives:
    - Legitimate software installing extensions
level: low
tags:
    - attack.persistence
    - attack.t1176


kql
// Hunt for connections to known ClickFix and EtherRAT IOCs
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "ustazazharidrus.com", "account-help.info", "quiptly.com", "elive123go.com", 
    "visitbundala.com", "nhacaired88.com", "subsgod.com", "ariciversontile.com",
    "o-parana.com", "rpc.payload.de", "jariosos.com", "hayesmed.com", 
    "regancontrols.com", "salinasrent.com", "justtalken.com", "mebeliotmasiv.com"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| extend FullThreatInfo = strcat("Suspicious Connection detected to known malicious domain: ", RemoteUrl)


powershell
# IOC Hunt Script for ClickFix/GlassWorm/EtherRAT Artifacts
# Requires Administrative Privileges

Write-Host "[+] Hunting for ClickFix/GlassWorm/EtherRAT Indicators..." -ForegroundColor Cyan

# 1. Check DNS Cache for Malicious Domains
$maliciousDomains = @(
    "ustazazharidrus.com", "account-help.info", "quiptly.com", "elive123go.com", 
    "visitbundala.com", "nhacaired88.com", "subsgod.com", "ariciversontile.com",
    "o-parana.com", "rpc.payload.de", "jariosos.com", "hayesmed.com", 
    "regancontrols.com", "salinasrent.com", "justtalken.com", "mebeliotmasiv.com"
)

$dnsCache = Get-DnsClientCache | Where-Object { $maliciousDomains -contains $_.Entry }
if ($dnsCache) {
    Write-Host "[!] ALERT: Found malicious entries in DNS Cache:" -ForegroundColor Red
    $dnsCache | Format-Table Entry, Data, Status -AutoSize
} else {
    Write-Host "[-] No malicious DNS cache entries found." -ForegroundColor Green
}

# 2. Scan for Suspicious Browser Extensions (GlassWorm Indication)
$chromeExtPath = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions"
$edgeExtPath = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions"
$firefoxExtPath = "$env:APPDATA\Mozilla\Firefox\Profiles"

$pathsToCheck = @($chromeExtPath, $edgeExtPath)

foreach ($path in $pathsToCheck) {
    if (Test-Path $path) {
        # Look for recently modified extensions (last 7 days)
        $recentExts = Get-ChildItem -Path $path -Recurse -Directory | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
        if ($recentExts) {
            Write-Host "[!] WARNING: Recently modified browser extensions found at $path (Potential GlassWorm):" -ForegroundColor Yellow
            $recentExts | Select-Object FullName, LastWriteTime
        }
    }
}

# 3. Check for Suspicious Node.js Processes (EtherRAT)
$nodeProcesses = Get-WmiObject Win32_Process | Where-Object { $_.Name -eq "node.exe" }
if ($nodeProcesses) {
    Write-Host "[*] Found Node.js processes running. Investigate command line:" -ForegroundColor Yellow
    $nodeProcesses | Select-Object ProcessId, CommandLine, ParentProcessId
}


# Response Priorities

**Immediate (0-24h):**
*   **Block IOCs:** Immediately block all listed domains and hostnames at the network perimeter, proxy, and DNS layers.
*   **Hunt for Artifacts:** Run the provided PowerShell script across endpoints to identify DNS cache hits or recent browser extension modifications.
*   **Isolate:** Isolate any endpoints with confirmed hits or running suspicious Node.js processes with network connectivity to unknown IPs.

**24h:**
*   **Credential Reset:** If Lumma Stealer, Vidar, or Redline are suspected (based on ClickFix patterns), force a password reset for compromised accounts and invalidate session tokens.
*   **Developer Audit:** Audit developer workstations for signs of GlassWorm (unusual Solana blockchain interactions, unknown browser extensions).

**1 Week:**
*   **Architecture Hardening:** Implement strict allow-listing for PowerShell and CMD to prevent "ClickFix" style execution. Review browser extension management policies to force whitelisting.
*   **Supply Chain Vetting:** Review and enforce controls for third-party code repositories and package managers used by development teams.