RMM Exploitation & Supply Chain Worms: TaskWeaver, Djinn Stealer, and npm Attacks

title: Potential ClickFix WebDAV Rundll32 Execution
description: Detects suspicious rundll32 execution with ordinal exports over WebDAV/HTTPS, indicative of ClickFix campaigns.
status: experimental
date: 2026/07/30
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6793a5b18f5f4c0d8c6b5f5f5f5f5f5f
tags:
    - attack.defense_evasion
    - attack.execution
    - attack.t1218.011
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\rundll32.exe'
        CommandLine|contains:
            - '.dll'
            - '.dat'
        CommandLine|contains|all:
            - 'https://'
            - 'ordinal'
    condition: selection
falsepositives:
    - Legitimate system administration (rare)
level: high
---
title: NPM Supply Chain Attack Bun Runtime Spawn
description: Detects npm or Node.js spawning the Bun runtime, a behavior observed in the Shai-Hulud npm worm campaign.
status: experimental
date: 2026/07/30
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6793a5b18f5f4c0d8c6b5f5f5f5f5f5f
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\npm.cmd'
            - '\node.exe'
    selection_child:
        Image|endswith:
            - '\bun.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate developer usage of Bun runtime
level: medium
---
title: TaskWeaver Node.js Suspicious Child Process
description: Detects Node.js spawningcmd or powershell, potentially indicative of TaskWeaver loader activity.
status: experimental
date: 2026/07/30
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6793a5b18f5f4c0d8c6b5f5f5f5f5f5f
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        Image|endswith:
            - '\node.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    filter_legit:
        CommandLine|contains:
            - 'npm'
            - 'yarn'
            - 'webpack'
            - 'vite'
    condition: selection_parent and selection_child and not filter_legit
falsepositives:
    - Legitimate development scripts
level: medium

// Hunt for ClickFix related WebDAV connections and rundll32 activity
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("rundll32.exe")
| where ProcessCommandLine has "https://" and (ProcessCommandLine has ".dll" or ProcessCommandLine has "#1")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend IOCHit = "ClickFix_WebDAV"
;
// Hunt for specific file hashes from OTX Pulses
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in ("00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c", "f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc", "2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96", "f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6")
| project Timestamp, DeviceName, FolderPath, SHA256, InitiatingProcessAccountName
| extend IOCHit = "OTX_FileHash"
;
// Hunt for npm worm domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("git-tanstack.com", "a.dev-tunnels.com")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName
| extend IOCHit = "OTX_C2_Domain"

# IOC Hunter for TaskWeaver, ClickFix, and Phishing Domains
$IOC_Domains = @(
    "a.dev-tunnels.com",
    "git-tanstack.com",
    "gentletouchchiropracticclinicauroracol.com",
    "pasastesintag.pics"
)

$IOC_Hashes = @(
    "00cc86d1144020c24c8fbb3a8dc6b908926497ebd23be3bf854360f93d1c8f4c",
    "f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc",
    "2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96",
    "f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6"
)

Write-Host "[*] Scanning for established network connections to malicious domains..." -ForegroundColor Cyan
Get-NetTCPConnection | ForEach-Object {
    $process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($process) {
        try {
            $remoteHost = [System.Net.Dns]::GetHostEntry($_.RemoteAddress).HostName
        } catch {
            $remoteHost = $_.RemoteAddress
        }
        
        foreach ($domain in $IOC_Domains) {
            if ($remoteHost -like "*$domain*") {
                Write-Host "[!] Suspicious Connection Found: $($process.ProcessName) (PID: $($process.Id)) connected to $remoteHost" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[*] Scanning recent files for known malicious hashes..." -ForegroundColor Cyan
$Drives = Get-PSDrive -PSProvider FileSystem
foreach ($Drive in $Drives) {
    Write-Host "Scanning $($Drive.Root)..."
    Get-ChildItem -Path $Drive.Root -Recurse -ErrorAction SilentlyContinue -File | 
    Where-Object { $_.Length -gt 0kb -and $_.Length -lt 10mb } | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($IOC_Hashes -contains $hash) {
            Write-Host "[!] Malicious File Detected: $($_.FullName) (SHA256: $hash)" -ForegroundColor Red
        }
    }
}