title: Potential ClickFix Fake CAPTCHA PowerShell Execution
id: 4d8e4f2a-1b3c-4e8d-9f1a-2b3c4d5e6f7a
description: Detects suspicious PowerShell execution patterns often associated with ClickFix campaigns, specifically those involving Base64 or XOR obfuscation triggered by user interaction or mshta.
status: experimental
date: 2026/06/20
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66555b3c8c35e1d4c4a6e7b9
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\mshta.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\edge.exe'
        Image|endswith:
            - '\powershell.exe'
        CommandLine|contains:
            - 'FromBase64String'
            - 'Char['
            - 'Xor'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: Malicious NPM Package Installation (Shai-Hulud Copycat)
id: 5f9g5g3b-2c4d-5f9e-0g2b-3c4d5e6f7g8a
description: Detects the installation of known malicious npm packages associated with the Shai-Hulud copycat campaign or typosquatting attacks.
status: experimental
date: 2026/06/20
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66544a2b7b24e1d3c3b5d6a8
tags:
    - attack.initial_access
    - attack.t1195.001
logsource:
    category: process_creation
    product: windows
    definition: 'Requirements: Sysmon or EDR logging command lines'
detection:
    selection_npm:
        Image|endswith:
            - '\npm.cmd'
            - '\node.exe'
    selection_cli:
        CommandLine|contains:
            - 'chalk-tempalte'
            - '@deadcode09284814/axios-util'
            - 'axois-utils'
            - 'color-style-utils'
    condition: all of selection_*
falsepositives:
    - Legitimate development (unlikely given specific malicious package names)
level: critical
---
title: SocGholish Fake Browser Update Activity
id: 6a0h6h4c-3d5e-6g0f-1h3c-4d5e6f7g8h9b
description: Detects potential execution of payloads delivered via SocGholish fake browser updates, often characterized by specific DLL loading or JS execution patterns.
status: experimental
date: 2026/06/18
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/66533a1a6a13d1c2c2b4c5a7
tags:
    - attack.initial_access
    - attack.t1189
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\msiexec.exe'
            - '\rundll32.exe'
    selection_cli:
        CommandLine|contains:
            - '/update'
            - 'chrome_update'
            - 'firefox_update'
    selection_parent:
        ParentImage|endswith:
            - '\iexplore.exe'
            - '\chrome.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate software updates
level: medium

// Hunt for ClickFix PowerShell Obfuscation and Network Connections
let MaliciousDomains = pack_array("platform.exathomeswebuyarizona.com", "87e0bbc636999b.lhr.life", "edcf8b03c84634.lhr.life", "www.fidestrento.com", "kiitec.ac.tz");
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (MaliciousDomains) or RemoteUrl contains ".lhr.life"
| join kind=inner (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where ProcessName =~ "powershell.exe"
    | where ProcessCommandLine has "FromBase64String" or ProcessCommandLine has "Xor"
) on DeviceId
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteUrl, RemoteIP

<#
.SYNOPSIS
    Hunt for Shai-Hulud copycat artifacts and malicious npm packages.
.DESCRIPTION
    Scans common node_modules directories for the presence of specific malicious package names identified in OTX pulses.
#>

$MaliciousPackages = @(
    "chalk-tempalte",
    "@deadcode09284814/axios-util",
    "axois-utils",
    "color-style-utils"
)

$SearchPaths = @(
    "$env:USERPROFILE\node_modules",
    "$env:APPDATA\npm\node_modules",
    "C:\Program Files\nodejs\node_modules",
    # Add project roots as needed
    "C:\Projects"
)

Write-Host "[+] Starting scan for Shai-Hulud copycat packages..." -ForegroundColor Cyan

foreach ($path in $SearchPaths) {
    if (Test-Path $path) {
        Write-Host "[?] Scanning $path..." -ForegroundColor Yellow
        Get-ChildItem -Path $path -Recurse -Directory -ErrorAction SilentlyContinue | ForEach-Object {
            if ($_.Name -in $MaliciousPackages) {
                Write-Host "[!] MALICIOUS PACKAGE FOUND: $($_.FullName)" -ForegroundColor Red
                # Optional: Remove-Item -Path $_.FullName -Recurse -Force -WhatIf
            }
        }
    }
}

Write-Host "[+] Scan complete. Check for any RED alerts." -ForegroundColor Green


# Response Priorities