Remcos RAT, Remus Stealer & macOS ClickFix: OTX Pulse Analysis — Enterprise Detection Pack

title: Potential Remcos RAT Download via PowerShell MSI
id: 4b0e5d9e-8a3c-4b1f-9c2d-3e5f6a7b8c9d
description: Detects PowerShell commands downloading MSI files, associated with the OpenClaw Remcos campaign involving GoToMeeting sideloading.
status: experimental
author: Security Arsenal
date: 2026/05/10
references:
    - https://www.zscaler.com/blogs/security-research/malicious-openclaw-skill-distributes-remcos-rat-and-ghostloader
logsource:
    category: process_creation
    product: windows
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
        CommandLine|contains: 'Invoke-WebRequest'
    selection_msi:
        CommandLine|contains: '.msi'
    filter_legit:
        ParentImage|contains: '\Program Files\'
    condition: selection_pwsh and selection_msi and not filter_legit
falsepositives:
    - Administrative software installation
level: high
tags:
    - attack.initial_access
    - attack.t1204
---
title: macOS ClickFix Terminal Command Execution
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects suspicious Terminal commands piping curl/wget to bash, common in macOS ClickFix campaigns delivering infostealers.
status: experimental
author: Security Arsenal
date: 2026/05/10
references:
    - https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/
logsource:
    category: process_creation
    product: macos
detection:
    selection_shell:
        Image|endswith: '/bin/bash' 
        ParentImage|endswith: '/Terminal'
    selection_download:
        CommandLine|contains:
            - 'curl '
            - 'wget '
    selection_pipe:
        CommandLine|contains: ' | '
    condition: selection_shell and selection_download and selection_pipe
falsepositives:
    - Legitimate developer script execution
level: medium
tags:
    - attack.execution
    - attack.t1059.004
---
title: Remus Stealer Browser Credential Access
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
description: Detects suspicious process access to browser Login Data files, indicative of Remus Stealer or Lumma variants attempting to bypass encryption.
status: experimental
author: Security Arsenal
date: 2026/05/10
references:
    - https://cyberpress.org/remus-bypasses-browser-encryption/
logsource:
    category: file_access
    product: windows
detection:
    selection_target:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\Default\Login Data'
            - '\Google\Chrome\User Data\Local State'
            - '\Microsoft\Edge\User Data\Default\Login Data'
            - '\BraveSoftware\Brave-Browser\User Data\Default\Login Data'
    filter_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\brave.exe'
    condition: selection_target and not filter_browser
falsepositives:
    - Backup software or security scanners
level: high
tags:
    - attack.credential_access
    - attack.t1005

// Hunt for network connections to known Remus/Lumma C2 IPs and OpenClaw domains
let IoC_IPs = dynamic(["45.94.47.204", "217.156.122.57", "217.156.122.75", "217.156.122.12", "45.151.106.110"]);
let IoC_Domains = dynamic(["jihiz.com", "kayeart.com", "bintail.com", "wusetail.com", "dropras.xyz", "trackpipe.dev"]);
DeviceNetworkEvents
| where RemoteIP in (IoC_IPs) or RemoteUrl has_any (IoC_Domains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl
| extend Timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')

<#
.SYNOPSIS
    IOC Hunter for Remcos RAT and Remus Stealer
.DESCRIPTION
    Checks for file hashes associated with the OpenClaw campaign and network connections to Remus C2 infrastructure.
#>

$TargetHashes = @(
    "1c267cab0a800a7b2d598bc1b112d5ce",
    "2a5f619c966ef79f4586a433e3d5e7ba",
    "2c4b7c8b48e6b4e5f3e8854f2abfedb5",
    "82536825e700f4c863238a90dd314687",
    "cc1af839a956c8e2bf8e721f5d3b7373"
)

$TargetIPs = @(
    "217.156.122.57",
    "217.156.122.75",
    "217.156.122.12",
    "45.151.106.110",
    "45.94.47.204"
)

Write-Host "[+] Checking for known malicious file hashes..." -ForegroundColor Cyan
$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($Drive in $Drives) {
    Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0kb -and $_.Length -lt 50MB } | 
    ForEach-Object {
        $Hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($TargetHashes -contains $Hash) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) (Hash: $Hash)" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Checking for active network connections to known C2 IPs..." -ForegroundColor Cyan
$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($IP in $TargetIPs) {
    $Found = $Connections | Where-Object { $_.RemoteAddress -eq $IP }
    if ($Found) {
        Write-Host "[!] SUSPICIOUS CONNECTION: Remote IP $IP connected on local port $($Found.LocalPort) (PID: $($Found.OwningProcess))" -ForegroundColor Red
        Get-Process -Id $Found.OwningProcess | Select-Object ProcessName, Path
    }
}