Shai-Hulud NPM Worm, The Gentlemen RaaS, & ClickFix Polymorphism: OTX Pulse Analysis

title: Potential Shai-Hulud NPM Malicious Package Installation
id: 4c1a8c9d-5e6f-4a3d-8b2c-1d4e5f6a7b8c
description: Detects installation of known malicious npm packages associated with the Shai-Hulud copycat worm.
status: experimental
date: 2026/06/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6670e6c9f0b4b02e6a0b4c9c
tags:
    - attack.initial_access
    - attack.t1195.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\npm.cmd'
        CommandLine|contains:
            - 'chalk-tempalte'
            - '@deadcode09284814/axios-util'
            - 'axois-utils'
            - 'color-style-utils'
    condition: selection
falsepositives:
    - Legitimate developer usage (unlikely due to specific naming)
level: high
---
title: The Gentlemen RaaS Event Log Clearing
date: 2026/06/21
id: 3b2a1d0e-9f8e-7c6d-5a4b-3c2d1e0f9a8b
description: Detects attempts to clear Windows Event Logs, a TTP observed in The Gentlemen ransomware incidents.
status: experimental
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6671a1b9f0b4b02e6a0b4d0e
tags:
    - attack.defense_evasion
    - attack.t1070.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_tool:
        Image|endswith:
            - '\wevtutil.exe'
            - '\powershell.exe'
    selection_clear:
        CommandLine|contains:
            - 'cl Security'
            - 'cl System'
            - 'cl Application'
            - 'Clear-EventLog'
    condition: all of selection_*
falsepositives:
    - Administrative maintenance scripts
level: high
---
title: ClickFix Browser Spawned PowerShell
date: 2026/06/21
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects browser processes spawning PowerShell, common in ClickFix fake CAPTCHA campaigns.
status: experimental
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6671a1b9f0b4b02e6a0b4d0f
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
    selection_child:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'FromBase64String'
            - 'XOR'
            - 'IEX'
    condition: all of selection_*
falsepositives:
    - Legitimate automation tools
level: medium

// Hunt for Shai-Hulud C2 connections and malicious domains
DeviceNetworkEvents
| where RemoteUrl in (
    "87e0bbc636999b.lhr.life", 
    "edcf8b03c84634.lhr.life",
    "www.fidestrento.com",
    "kiitec.ac.tz",
    "aqarco.com",
    "game-corp.net",
    "pickleballmastery.com",
    "itechhardware.com",
    "shadesking.com",
    "mlm-dra.com"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
;
// Hunt for The Gentlemen ransomware file hash
DeviceFileEvents
| where SHA256 == "f918535f974591ef031bd0f30a8171e3da27a6754e6426a8ba095f83195661c8"
| project Timestamp, DeviceName, FileName, FolderPath, SHA256
;
// Hunt for Log Clearing Activity (The Gentlemen)
DeviceProcessEvents
| where FileName in ("wevtutil.exe", "powershell.exe")
| where ProcessCommandLine has_any ("cl ", "Clear-EventLog") and ProcessCommandLine has_any ("Security", "System", "Application")
| project Timestamp, DeviceName, FileName, ProcessCommandLine

# IOC Hunt Script for Shai-Hulud, The Gentlemen, and ClickFix artifacts

Write-Host "Starting Threat Hunt..." -ForegroundColor Cyan

# 1. Check for The Gentlemen Malicious File Hash
$MaliciousHash = "f918535f974591ef031bd0f30a8171e3da27a6754e6426a8ba095f83195661c8"
Write-Host "Checking for malicious hash $MaliciousHash..." -ForegroundColor Yellow
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0 } | 
    ForEach-Object { 
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hash -eq $MaliciousHash) { 
            Write-Host "MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red 
        }
    }

# 2. Check for Suspicious NPM Packages (Shai-Hulud)
$BadPackages = @("chalk-tempalte", "@deadcode09284814/axios-util", "axois-utils", "color-style-utils")
Write-Host "Checking for malicious NPM packages..." -ForegroundColor Yellow
$NpmPaths = @("$env:APPDATA\npm", "$env:USERPROFILE\node_modules", "$env:ProgramFiles\nodejs")
foreach ($path in $NpmPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Directory -ErrorAction SilentlyContinue | 
            Where-Object { $BadPackages -contains $_.Name } | 
            ForEach-Object { Write-Host "SUSPICIOUS PACKAGE FOUND: $($_.FullName)" -ForegroundColor Red }
    }
}

# 3. Check for Scheduled Tasks associated with The Gentlemen (Generic Detection)
Write-Host "Checking for Suspicious Scheduled Tasks..." -ForegroundColor Yellow
Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -like "*powershell*" -and 
    ($_.Actions.Arguments -like "*IEX*" -or $_.Actions.Arguments -like "*DownloadString*")
} | ForEach-Object { Write-Host "SUSPICIOUS TASK FOUND: $($_.TaskName) - Action: $($_.Actions.Execute)" -ForegroundColor Red }

Write-Host "Hunt Complete." -ForegroundColor Green