HookBot Android Banking Trojan Leak, ClickFix Clipboard Poisoning & Konni VelvetCake LNK Campaign: OTX Pulse Analysis — Enterprise Detection Pack

---
title: ClickFix Clipboard Poisoning PowerShell Execution
id: 8f3a1c2e-9b4d-4e7a-a1c5-6d2f8e9b3a41
status: experimental
description: Detects user-driven PowerShell execution consistent with ClickFix fake-CAPTCHA clipboard poisoning (Run dialog / Win+R spawned commands with download cradles or encoded payloads), as served by third-party[.]com per OTX pulse.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\rundll32.exe'
      - '\msedge.exe'
      - '\chrome.exe'
  selection_cmd:
    CommandLine|contains:
      - 'iex'
      - 'Invoke-Expression'
      - 'Invoke-WebRequest'
      - 'wget '
      - 'curl '
      - '-enc'
      - '-e '
      - 'FromBase64String'
      - 'mshta'
  filter_legit:
    CommandLine|contains:
      - 'powershell_ise'
  condition: selection_parent and selection_cmd and not filter_legit
falsepositives:
  - Admin-driven one-liner scripts pasted into Run dialog (rare)
level: high
tags:
  - attack.t1204
  - attack.t1204.002
  - attack.t1059.001
date: 2026/09/25
---
title: LNK File Spawning PowerShell or Script Interpreter
id: 2c7d4e1a-5b8f-4a3c-9d6e-1f4a7b8c2d53
status: experimental
description: Detects execution of shortcut (.lnk) files spawning PowerShell, cmd, wscript, or mshta — matching Konni Opal Sleet Operation Conflict Compass delivery of VelvetCake via LNK files disguised as PDFs in spear-phishing ZIPs.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentCommandLine|contains: '.lnk'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  selection_zip_paths:
    CommandLine|contains:
      - '\Downloads\'
      - '\Temp\'
      - 'AppData\Local\Temp'
  condition: selection_parent and selection_child and selection_zip_paths
falsepositives:
  - Legitimate shortcuts to administrative scripts (uncommon from Temp/Downloads paths)
level: high
tags:
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1566.001
date: 2026/09/25
---
title: Scheduled Task Creation from PowerShell or Script Process
id: 4a9b6c3d-7e2f-4b1a-8c5d-3e6f9a1b4c72
status: experimental
description: Detects scheduled task creation via schtasks or PowerShell cmdlets executed from script interpreters — VelvetCake persistence mechanism observed in Konni Operation Conflict Compass.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains: '/create'
  selection_ps_task:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Register-ScheduledTask'
      - 'New-ScheduledTask'
      - 'Set-ScheduledTask'
  selection_github_stage:
    CommandLine|contains:
      - 'github.com'
      - 'raw.githubusercontent'
  condition: (selection_schtasks or selection_ps_task) and selection_github_stage
falsepositives:
  - Software deployment tooling staging from GitHub (validate against change records)
level: critical
tags:
  - attack.t1053.005
  - attack.t1059.001
date: 2026/09/25

// Security Arsenal — OTX Pulse Hunt: HookBot panels, ClickFix staging, Konni VelvetCake C2
let maliciousHosts = dynamic(["havijmail.com", "ces.yeyr.lol", "errr.onllee.com", "www.racon.online", "elxxvvx.xyz", "third-party.com", "p1o2i3u4y5t6r7e8w9q0.medianewsonline.com"]);
let maliciousIPs = dynamic(["111.92.246.145"]);
let networkHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (maliciousHosts) or RemoteIP in (maliciousIPs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let lnkExecution = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has ".lnk"
  and FileName in~ ("powershell.exe","pwsh.exe","cmd.exe","wscript.exe","mshta.exe","rundll32.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;
let clickfixPaste = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("powershell.exe","pwsh.exe")
  and InitiatingProcessFileName =~ "explorer.exe"
  and ProcessCommandLine has_any ("iex","Invoke-Expression","FromBase64String","-enc","elxxvvx")
| project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine;
union networkHits, lnkExecution, clickfixPaste
| sort by TimeGenerated desc

# Security Arsenal — OTX IOC Hunt: ClickFix artifacts, VelvetCake persistence, HookBot/Konni infrastructure
# Run elevated on Windows endpoints or deploy via your EDR/Intune remediation engine.

$report = @()

# 1) Hunt for suspicious scheduled tasks (VelvetCake persistence)
$tasks = Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'powershell|pwsh|wscript|mshta|rundll32' -or
    $_.Actions.Arguments -match 'github|raw.githubusercontent|iex|FromBase64String'
}
foreach ($t in $tasks) {
    $report += [pscustomobject]@{Check='ScheduledTask'; Finding=$t.TaskName; Detail="$($t.Actions.Execute) $($t.Actions.Arguments)"}
}

# 2) Check DNS cache for OTX indicator domains
$iocs = 'havijmail.com','yeyr.lol','onllee.com','racon.online','elxxvvx.xyz','third-party.com','medianewsonline.com'
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $e=$_.Entry; $iocs | Where-Object { $e -like "*$_*" } }
foreach ($d in $dns) { $report += [pscustomobject]@{Check='DNSCache'; Finding=$d.Entry; Detail=$d.Data} }

# 3) Recent .lnk files in user-writable staging paths (Konni ZIP lures)
$lnks = Get-ChildItem "$env:USERPROFILE\Downloads","$env:TEMP" -Filter *.lnk -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) }
$sh = New-Object -ComObject WScript.Shell
foreach ($l in $lnks) {
    $sc = $sh.CreateShortcut($l.FullName)
    if ($sc.TargetPath -match 'powershell|cmd|mshta|wscript' -or $sc.Arguments -match 'http|github|iex') {
        $report += [pscustomobject]@{Check='MaliciousLNK'; Finding=$l.FullName; Detail="$($sc.TargetPath) $($sc.Arguments)"}
    }
}

# 4) Established/historical TCP connections to Konni C2 IP
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq '111.92.246.145' }
foreach ($c in $conns) { $report += [pscustomobject]@{Check='NetworkIOC'; Finding=$c.RemoteAddress; Detail="State=$($c.State) PID=$($c.OwningProcess)"} }

if ($report) { $report | Format-Table -AutoSize; $report | Export-Csv "$env:TEMP\otx_hunt_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation }
else { Write-Output '[+] No OTX indicator artifacts found on this host.' }