PavinLoader Multi-Stage Campaign: ClickFix, Fake Captchas & EtherHiding Blockchain C2 — OTX Pulse Analysis with Enterprise Detection Pack

---
title: ClickFix Social Engineering - Run Dialog or Clipboard-Spawned LOLBin Execution
id: 8f3a1b2c-9e4d-4f6a-b7c1-2d5e8a9f0b11
status: experimental
description: Detects mshta/powershell/curl spawned by explorer.exe consistent with ClickFix fake-CAPTCHA lures delivering PavinLoader, where victims paste malicious commands into the Run dialog.
author: Security Arsenal Threat Intelligence
date: 2026/09/24
references:
    - https://www.malwarebytes.com/blog/threat-intel/2026/08/tracking-pavinloader-across-clickfix-and-fake-download-campaigns
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_child:
        Image|endswith:
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\curl.exe'
            - '\rundll32.exe'
    selection_cmdline:
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - 'Invoke-Expression'
            - 'IEX'
            - 'DownloadString'
            - 'msbuild'
    condition: selection_parent and selection_child and selection_cmdline
falsepositives:
    - Rare; legitimate admin scripts pasted into Run dialog. Tune by parent process and user context.
level: high
tags:
    - attack.initial_access
    - attack.t1204
    - attack.t1059
---
title: MSBuild Inline Task Execution - PavinLoader LOLBin Compile-and-Run
id: 7c2d9e1a-5b3f-4a8c-9d2e-1f6b4c8a0d22
status: experimental
description: Detects MSBuild.exe invoked from user-writable paths or with suspicious project files, consistent with PavinLoader abusing MSBuild inline C# tasks to execute obfuscated .NET payloads.
author: Security Arsenal Threat Intelligence
date: 2026/09/24
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\MSBuild.exe'
    selection_suspicious:
        CommandLine|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Users\Public\'
            - '\ProgramData\'
            - '.tmp'
            - '.txt'
            - '.xml'
    filter_dev:
        CommandLine|contains:
            - '.sln'
            - '.csproj'
            - 'C:\Program Files'
        ParentImage|contains:
            - '\devenv.exe'
            - '\dotnet.exe'
            - '\VisualStudio'
    condition: selection_img and selection_suspicious and not filter_dev
falsepositives:
    - Developer workstations; CI/CD build agents. Whitelist build server hostnames and Visual Studio parent processes.
level: high
tags:
    - attack.defense_evasion
    - attack.t1127
    - attack.t1127.001
---
title: EtherHiding - Non-Browser Process Querying Public Blockchain RPC Endpoints
id: 4e1a7c3b-8d2f-4e9b-a6c5-3f7d9b1e0c33
status: experimental
description: Detects non-browser processes establishing connections to public blockchain RPC endpoints (BNB Smart Chain, Ethereum), consistent with PavinLoader EtherHiding C2 domain retrieval.
author: Security Arsenal Threat Intelligence
date: 2026/09/24
logsource:
    category: network_connection
    product: windows
detection:
    selection_rpc:
        DestinationHostname|contains:
            - 'bsc-dataseed'
            - 'binance.org'
            - 'publicnode.com'
            - 'rpc.ankr.com'
            - 'llamarpc.com'
            - 'mainnet.infura.io'
            - 'eth-mainnet'
            - 'cloudflare-eth.com'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
    filter_wallet:
        Image|contains:
            - '\MetaMask'
            - '\Ledger'
            - '\Trust Wallet'
    condition: selection_rpc and not filter_browsers and not filter_wallet
falsepositives:
    - Legitimate Web3 development tools, node.js blockchain clients, enterprise crypto applications. Baseline developer endpoints before enforcing.
level: medium
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1071.001

// PavinLoader / ClickFix / EtherHiding multi-surface hunt - Microsoft Sentinel
// Run over last 14 days; extend to 90d for retro-hunt after first confirmed hit
let OtxDomains = dynamic([
    "more-arpc.icu","rpcsecnoweb.pro","kelemet.shop","nexahub.lat",
    "stellar-minds.cfd","perfectverified.com","catalyst-pro.lat","twigoamwu.cfd"
]);
let BlockchainRpc = dynamic([
    "bsc-dataseed.binance.org","bsc.publicnode.com","rpc.ankr.com",
    "eth.llamarpc.com","cloudflare-eth.com","mainnet.infura.io"
]);
let Browsers = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe"]);
// Surface 1: DNS/network hits on OTX pulse IOC domains
let IocHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (OtxDomains)
    | project IocHitTime=TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
// Surface 2: ClickFix-style LOLBin execution spawned by explorer with web args
let ClickFix =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName =~ "explorer.exe"
    | where FileName in~ ("mshta.exe","powershell.exe","pwsh.exe","curl.exe","rundll32.exe")
    | where ProcessCommandLine has_any ("http://","https://","IEX","DownloadString","msbuild")
    | project ClickFixTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName;
// Surface 3: MSBuild inline-task abuse from user-writable paths
let MsBuildAbuse =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where FileName =~ "MSBuild.exe"
    | where ProcessCommandLine has_any ("\\AppData\\","\\Temp\\","\\Users\\Public\\","\\ProgramData\\")
    | where InitiatingProcessFileName !in~ ("devenv.exe","dotnet.exe")
    | project MsBuildTime=TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine;
// Surface 4: EtherHiding - non-browser process reaching public blockchain RPC
let EtherHiding =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (BlockchainRpc)
    | where InitiatingProcessFileName !in~ (Browsers)
    | project RpcTime=TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl;
union IocHits, ClickFix, MsBuildAbuse, EtherHiding
| summarize arg_max(*, *) by DeviceName, tostring(coalesce(IocHitTime, ClickFixTime, MsBuildTime, RpcTime))
| sort by DeviceName asc

<#
.SYNOPSIS
    PavinLoader / ClickFix / EtherHiding endpoint hunt script.
.DESCRIPTION
    Checks a host for PavinLoader campaign artifacts: OTX IOC domain resolution,
    blockchain-RPC connections from non-browser processes, suspicious MSBuild
    executions, RunMRU ClickFix evidence, and persistence in Run keys / tasks.
    Run elevated. Output: CSV-style findings to console; export with -OutCsv.
.PARAMETER OutCsv
    Optional path to export findings.
#>
param([string]$OutCsv = "")

$findings = New-Object System.Collections.Generic.List[object]
function Add-Finding([string]$Check,[string]$Detail) {
    $findings.Add([pscustomobject]@{Host=$env:COMPUTERNAME; Time=(Get-Date); Check=$Check; Detail=$Detail})
    Write-Host "[HIT] $Check :: $Detail" -ForegroundColor Red
}

# 1. OTX IOC domains - DNS cache + active connections
$iocDomains = @("more-arpc.icu","rpcsecnoweb.pro","kelemet.shop","nexahub.lat",
                "stellar-minds.cfd","perfectverified.com","catalyst-pro.lat","twigoamwu.cfd")
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $iocDomains) {
    $hit = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) { Add-Finding "IOC-DNSCache" "Resolved OTX domain: $d ($($hit.Data -join ','))" }
}
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $r = Resolve-DnsName $_.RemoteAddress -ErrorAction Stop
        foreach ($d in $iocDomains) { if ($r.NameHost -like "*$d*") { Add-Finding "IOC-Connection" "$d -> $($_.RemoteAddress):$($_.RemotePort) PID $($_.OwningProcess)" } }
    } catch {}
}

# 2. EtherHiding - non-browser processes with blockchain RPC connections
$rpcHosts = "bsc-dataseed","publicnode.com","rpc.ankr.com","llamarpc","infura.io","cloudflare-eth"
$browsers = "chrome","msedge","firefox","brave","opera"
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $e = $_.Entry; $rpcHosts | Where-Object { $e -like "*$_*" }
} | ForEach-Object { Add-Finding "EtherHiding-DNS" "Blockchain RPC in DNS cache: $($_.Entry)" }

# 3. MSBuild abuse - prefetch + recent executions from user paths
$pf = Get-ChildItem "$env:SystemRoot\Prefetch\MSBUILD.EXE-*.pf" -ErrorAction SilentlyContinue
if ($pf) { foreach ($p in $pf) { Add-Finding "MSBuild-Prefetch" "MSBuild executed: $($p.Name) LastWrite $($p.LastWriteTime)" } }

# 4. ClickFix evidence - RunMRU one-liners (mshta/powershell/curl + URL)
$runMru = Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue
if ($runMru) {
    $runMru.PSObject.Properties | Where-Object { $_.Name -match '^[a-z]$' } | ForEach-Object {
        if ($_.Value -match '(mshta|powershell|curl|rundll32|msbuild)' -and $_.Value -match 'https?://') {
            Add-Finding "ClickFix-RunMRU" "Suspicious Run-dialog entry: $($_.Value)"
        }
    }
}

# 5. Persistence sweep - Run keys and suspicious scheduled tasks
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
             "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
    Get-ItemProperty $k -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match '(AppData|Temp|Public)' -and $_.Value -match '(mshta|powershell|rundll32|regsvr32|\.dll|\.tmp)'
        } | ForEach-Object { Add-Finding "Persistence-RunKey" "$k :: $($_.Name) = $($_.Value)" }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match '(mshta|powershell|msbuild|rundll32)' -and
    ($_.Actions.Arguments -match 'https?://' -or $_.Actions.Execute -match 'AppData')
} | ForEach-Object { Add-Finding "Persistence-Task" "$($_.TaskName): $($_.Actions.Execute) $($_.Actions.Arguments)" }

# 6. Summary
if ($findings.Count -eq 0) { Write-Host "[CLEAN] No PavinLoader campaign artifacts found on $env:COMPUTERNAME" -ForegroundColor Green }
else {
    Write-Host "`n$($findings.Count) finding(s). If any IOC/ClickFix hit: ISOLATE host, assume credential compromise (Amatera Stealer risk)." -ForegroundColor Yellow
    if ($OutCsv) { $findings | Export-Csv $OutCsv -NoTypeInformation; Write-Host "Exported: $OutCsv" }
}