---
title: Potential ClickFix Fake CAPTCHA PowerShell Execution
date: 2026/06/18
description: Detects suspicious PowerShell execution patterns often associated with ClickFix campaigns where users are tricked into running PS commands via fake captchas or browser updates.
references:
    - https://www.zscaler.com/blogs/security-research/clickfix-campaign-generated-ai-delivers-smartrat
author: Security Arsenal
status: experimental
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 4104
    selection_keywords:
        ScriptBlockText|contains:
            - 'iex'
            - 'Invoke-Expression'
            - 'DownloadString'
    filters:
        ScriptBlockText|contains:
            - 'captcha'
            - 'verify'
            - 'human'
            - 'browser-update'
    condition: selection and selection_keywords and filters
falsepositives:
    - Legitimate system administration scripts
level: high
---
title: Suspicious Process Spawn by Wallpaper Engine
date: 2026/06/18
description: Detects Wallpaper Engine spawning suspicious child processes like PowerShell or CMD, which may indicate malicious wallpaper execution as seen in Steam Workshop campaigns.
references:
    - https://securelist.com/dozens-of-malicious-wallpapers-found-on-steam-workshop/120186/
author: Security Arsenal
status: experimental
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\wallpaper32.exe'
            - '\wallpaper64.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate user scripts interacting with Wallpaper Engine
level: medium
---
title: Ransomware precursors SystemBC and Cobalt Strike Beacon
date: 2026/06/18
description: Detects network connections or process execution indicative of SystemBC proxying or Cobalt Strike beacons used by INC and Interlock actors.
references:
    - https://www.ibm.com/think/x-force/interlock-and-rhysida-within-the-ransonware-ecosystem
author: Security Arsenal
status: experimental
tags:
    - attack.c2
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection_cs:
        Initiated: 'true'
        DestinationPort:
            - 443
            - 80
    filter_legit:
        DestinationHostname|endswith:
            - '.microsoft.com'
            - '.google.com'
            - '.amazon.com'
    condition: selection_cs and not filter_legit
falsepositives:
    - Unknown
level: high


kql
// Hunt for ClickFix and Malicious Domain Connections
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in (
    "crefisa.online", 
    "windowsupdate-cdn.com",
    "leadslaw.com",
    "incblog.su"
)
| summarize Count=count() by DeviceName, RemoteUrl, InitiatingProcessAccountName

// Hunt for Suspicious PowerShell Process Creations (SmartRAT indicators)
DeviceProcessEvents 
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe" 
| where ProcessCommandLine contains "DownloadString" or ProcessCommandLine contains "IEX"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

// Hunt for Steam Wallpaper Malware Hashes
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in (
    "fc586cad94e5a10dd5be6a6ae6096bd02dfbfd094365bec87e788ed0798d6f67"
)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256


powershell
# IOC Hunt Script for Steam Wallpaper & ClickFix Campaigns
# Checks for specific file hashes and suspicious registry paths

$TargetHashes = @(
    "f0b3e112ce4807a28e2b5d66a840ed7f",
    "edbf152ed9ac79e5d9e0111d1071af48",
    "297eb45f028d44d750297d2f932b9c91",
    "3c72e1f37f115b00c3ad6ed31bacfe8a",
    "6bf4d4c62b5138ace281ce3d08297787",
    "b17ccdb5531555e43f082d6e77c07227",
    "18dedc0009f0927cba6425c84cce9883",
    "5620f01284329f561b1839a36be55355",
    "74414ed4b63aadec039b603c32762b80",
    "8c2cc585ad8a13a72a704c0fda0c9854",
    "95856f2ce428c728c9781d3296558068"
)

Write-Host "[+] Scanning for malware hashes from OTX Pulses..."

$Drives = Get-PSDrive -PSProvider FileSystem
foreach ($Drive in $Drives) {
    Write-Host "Scanning drive: $($Drive.Root)"
    Get-ChildItem -Path $Drive.Root -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        $Hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($TargetHashes -contains $Hash) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) - MD5: $Hash" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Checking for suspicious Steam Workshop paths..."
$SteamPaths = @(
    "$env:ProgramFiles\Steam\steamapps\workshop\content",
    "$env:ProgramFiles(x86)\Steam\steamapps\workshop\content"
)

foreach ($Path in $SteamPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Filter *.rar -Recurse -ErrorAction SilentlyContinue | 
        ForEach-Object {
            Write-Host "[!] Suspicious Archive found in Steam Workshop: $($_.FullName)" -ForegroundColor Yellow
        }
    }
}


# Response Priorities

*   **Immediate Actions:**
    *   Block all identified domains and IPs at the perimeter and DNS level (e.g., `crefisa.online`, `windowsupdate-cdn.com`, `185.196.9.234`).
    *   Scan endpoints for the provided file hashes associated with Interlock, INC, and Steam malware.
    *   Isolate systems exhibiting PowerShell anomalies consistent with ClickFix or SmartRAT behavior.

*   **24-Hour Actions:**
    *   Conduct credential resets for users in the Finance sector (Brazil target region) and those with confirmed Steam access on corporate assets.
    *   Review logs for access to `incblog.su` or Tor network activity indicating ransomware negotiation sites.
    *   Hunt for `Backdoor.Turn` artifacts and unusual MS Teams traffic patterns using the provided KQL.

*   **1-Week Actions:**
    *   Patch vulnerabilities identified in the pulses, specifically `CVE-2023-36036`, `CVE-2025-61155`, and `CVE-2023-3519`.
    *   Implement application control policies to restrict Steam Wallpaper Engine and unauthorized PowerShell execution.
    *   Review MS Teams tenant logs for anonymous visitor token usage or unexpected relay server connections.