T-SQL Abuse, PEERSTITCH FortiGate Implant & ClickFix CNCmachineRMS RAT: OTX Pulse Detection Pack

---
title: MSSQL Suspicious T-SQL Command Execution - XMRig/Gh0st Delivery
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects suspicious T-SQL commands associated with malware delivery on compromised MSSQL servers including xp_cmdshell abuse, OLE automation, and download cradle patterns
author: Security Arsenal Threat Intelligence
references:
    - https://www.fortinet.com/blog/threat-research/t-sql-being-abused-to-deliver-malware-on-compromised-ms-sql-servers
    - https://otx.alienvault.com/pulse/
date: 2026/11/14
tags:
    - attack.t1059
    - attack.t1105
    - attack.t1190
    - attack.t1078
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\sqlservr.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    selection_cmdline:
        CommandLine|contains:
            - 'certutil -urlcache'
            - 'certutil.exe -urlcache -split -f'
            - 'bitsadmin /transfer'
            - 'Invoke-WebRequest'
            - 'Invoke-Expression'
            - 'IEX'
            - 'DownloadString'
            - 'DownloadFile'
            - 'Start-BitsTransfer'
            - 'wget '
            - 'curl '
    condition: selection_parent and (selection_child or selection_cmdline)
falsepositives:
    - Legitimate database administration activities
    - MSSQL maintenance scripts
level: high
---
title: ClickFix Fake CAPTCHA - HTA Download and DLL Side-Loading
id: b2c3d4e5-f6a7-8901-bcde-f23456789012
status: experimental
description: Detects ClickFix social engineering campaign execution patterns including mshta execution from Run dialog, HTA file downloads, and DLL side-loading indicators associated with CNCmachineRMS RAT
author: Security Arsenal Threat Intelligence
references:
    - https://www.malware-traffic-analysis.net/2026/11/12/index.html
    - https://otx.alienvault.com/pulse/
date: 2026/11/14
tags:
    - attack.t1204
    - attack.t1204.002
    - attack.t1059.005
    - attack.t1574.002
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_mshta:
        Image|endswith: '\mshta.exe'
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - '.hta'
    selection_rundll_sideload:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            - '.dll,'
            - 'AppData\Local\Temp'
            - 'Downloads'
    selection_suspicious_child:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\mshta.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
    condition: selection_mshta or selection_rundll_sideload or selection_suspicious_child
falsepositives:
    - Legitimate HTA applications in enterprise environments
    - Software installation routines
level: high
---
title: FortiManager PEERSTITCH Implant - Suspicious Process and Memory Activity
id: c3d4e5f6-a7b8-9012-cdef-345678901234
status: experimental
description: Detects potential PEERSTITCH implant activity and post-exploitation behavior following CVE-2024-47575 or CVE-2025-61624 exploitation on Fortinet infrastructure
author: Security Arsenal Threat Intelligence
references:
    - https://unit42.paloaltonetworks.com/fortimanager-cve-2024-47575-peerstitch-malware/
    - https://otx.alienvault.com/pulse/
date: 2026/11/14
tags:
    - attack.t1055
    - attack.t1055.012
    - attack.t1071
    - attack.t1190
logsource:
    category: network_connection
    product: fortinet
detection:
    selection_config_exfil:
        eventtype: 'system'
        action:
            - 'backup'
            - 'export'
            - 'download'
        msg|contains:
            - 'config'
            - 'firmware'
            - 'certificate'
    selection_unusual_process:
        process_name|contains:
            - 'unknown'
            - 'tmp'
            - '.elf'
    selection_suspicious_conn:
        dst_port:
            - 4444
            - 8080
            - 8443
            - 9999
        dst_ip|cidr:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection_config_exfil or selection_unusual_process or (selection_suspicious_conn and not dst_ip|cidr: '0.0.0.0/0')
falsepositives:
    - Legitimate configuration backups
    - Internal management traffic
level: critical

// SmartApeSG ClickFix Campaign - CNCmachineRMS RAT Detection Hunt
// Searches for indicators of ClickFix social engineering, HTA execution, and DLL side-loading
// Security Arsenal Threat Intelligence | 2026-11-14

let clickfix_domains = dynamic(["cashewminaret.org", "orchardandbarite.com"]);
let clickfix_hashes = dynamic([
    "2eb387df728fc6f5dd2dcffaf1883cbf8c5e0c489f6cb38021d67f856ee669d0",
    "101e9ac653ccd341e36fae84a5c6920dff47a41822e87db4c72e36da4830d707"
]);

// Hunt 1: DNS queries or network connections to ClickFix infrastructure
let domain_hits = union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (clickfix_domains) or RemoteIP in (
        DeviceDnsEvents
        | where TimeGenerated > ago(7d)
        | where Name has_any (clickfix_domains)
        | summarize by IPAddresses
        | mv-expand IPAddresses
        | summarize by tostring(IPAddresses)
    )
    | project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine),
    (DeviceDnsEvents
    | where TimeGenerated > ago(7d)
    | where Name has_any (clickfix_domains)
    | project TimeGenerated, DeviceName, Name, IPAddresses)
    ;

// Hunt 2: Mshta.exe execution with URL arguments (ClickFix pattern)
let mshta_execution = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName =~ "mshta.exe"
    | where ProcessCommandLine has_any ("http://", "https://", ".hta")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName;

// Hunt 3: File creation events for known CNCmachineRMS hashes
let hash_hits = DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where SHA256 in (clickfix_hashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName;

// Hunt 4: DLL side-loading patterns - rundll32 with suspicious paths
let dll_sideload = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName =~ "rundll32.exe"
    | where ProcessCommandLine has_any ("AppData\\Local\\Temp", "Downloads", ".dll,")
    | where not(ProcessCommandLine has_any ("System32", "SysWOW64"))
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;

// Hunt 5: T-SQL abuse patterns - sqlservr spawning suspicious processes
let tsql_abuse = DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where InitiatingProcessFileName =~ "sqlservr.exe"
    | where FileName in~ ("cmd.exe", "powershell.exe", "certutil.exe", "bitsadmin.exe", "mshta.exe", "wscript.exe")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;

// Combine all hunts
union isfuzzy=true domain_hits, mshta_execution, hash_hits, dll_sideload, tsql_abuse
| sort by TimeGenerated desc

# Security Arsenal - Multi-Campaign IOC Hunt Script
# Targets: T-SQL Abuse (XMRig/Gh0st), ClickFix (CNCmachineRMS), Fortinet PEERSTITCH artifacts
# Requires: Administrative privileges, PowerShell 5.1+
# Date: 2026-11-14

Write-Host "[+] Security Arsenal Threat Hunt - OTX Pulse Analysis" -ForegroundColor Cyan
Write-Host "[+] Campaigns: T-SQL Abuse | ClickFix CNCmachineRMS | PEERSTITCH" -ForegroundColor Cyan
Write-Host "==========================================" -ForegroundColor Cyan

$findings = @()

#region T-SQL Campaign - XMRig/Gh0st RAT Indicators
Write-Host "`n[PHASE 1] Checking T-SQL Campaign Indicators..." -ForegroundColor Yellow

# Known malicious hashes from OTX pulse
$tsql_hashes = @(
    "8ce2cd98ef6ceeece8239936e4aea042c41807f632cd691d5091705bf6c0076d",
    "001546787ee0f3bec75d57fda1d59b60",
    "500351506e1a1218b6b8f968b432b81f",
    "7fd491c23561b3332b0ae7dddda262ea",
    "8924b37f0a01a3fdf4bf228d0c0ef62c",
    "8d16f6a9ccfcbc8a6d6c764bfec8da09",
    "b3d08af95c2a2d086b4a776817b6f5b2",
    "be6ffaec9ea200aee3664047cfbbca9e"
)

# Check for XMRig miner artifacts
$xmrig_paths = @(
    "$env:TEMP\xmrig*",
    "$env:APPDATA\xmrig*",
    "$env:ProgramData\xmrig*",
    "C:\Windows\Temp\xmrig*",
    "$env:USERPROFILE\Downloads\xmrig*"
)

foreach ($path in $xmrig_paths) {
    if (Test-Path $path) {
        $findings += [PSCustomObject]@{
            Campaign = "T-SQL/XMRig"
            Type = "File Artifact"
            Indicator = $path
            Risk = "HIGH"
            Action = "Quarantine and analyze"
        }
        Write-Host "  [!] XMRig artifact found: $path" -ForegroundColor Red
    }
}

# Check for suspicious services (Gh0st RAT persistence)
$suspicious_services = Get-WmiObject -Class Win32_Service | Where-Object {
    $_.PathName -match "(temp|appdata|downloads)" -and
    $_.PathName -notmatch "(microsoft|windows|adobe|google)"
}

foreach ($svc in $suspicious_services) {
    $findings += [PSCustomObject]@{
        Campaign = "T-SQL/Gh0st"
        Type = "Suspicious Service"
        Indicator = "$($svc.Name) - $($svc.PathName)"
        Risk = "HIGH"
        Action = "Investigate service origin"
    }
    Write-Host "  [!] Suspicious service: $($svc.Name)" -ForegroundColor Red
}

# Check registry run keys for persistence
$run_keys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $run_keys) {
    if (Test-Path $key) {
        $values = Get-ItemProperty -Path $key -ErrorAction SilentlyContinue
        $values.PSObject.Properties | ForEach-Object {
            if ($_.Value -match "(temp|appdata|xmrig|miner)" -and $_.Name -notmatch "^PS") {
                $findings += [PSCustomObject]@{
                    Campaign = "T-SQL/Gh0st"
                    Type = "Registry Persistence"
                    Indicator = "$key\$($_.Name) = $($_.Value)"
                    Risk = "MEDIUM"
                    Action = "Verify legitimacy"
                }
                Write-Host "  [!] Suspicious registry: $($_.Name)" -ForegroundColor Yellow
            }
        }
    }
}

# Check for MSSQL spawned processes (requires SQL Server installed)
$sql_processes = Get-Process -Name "sqlservr" -ErrorAction SilentlyContinue
if ($sql_processes) {
    Write-Host "  [i] SQL Server detected - check for xp_cmdshell abuse" -ForegroundColor Cyan
    $suspicious_children = Get-WmiObject Win32_Process | Where-Object {
        $_.ParentProcessId -in $sql_processes.ProcessId -and
        $_.Name -match "(cmd|powershell|certutil|bitsadmin|mshta)"
    }
    foreach ($proc in $suspicious_children) {
        $findings += [PSCustomObject]@{
            Campaign = "T-SQL Abuse"
            Type = "Suspicious SQL Child Process"
            Indicator = "$($proc.Name) - PID: $($proc.ProcessId)"
            Risk = "CRITICAL"
            Action = "Immediate investigation required"
        }
        Write-Host "  [!!!] SQL spawned suspicious process: $($proc.Name)" -ForegroundColor Magenta
    }
}
#endregion

#region ClickFix Campaign - CNCmachineRMS RAT Indicators
Write-Host "`n[PHASE 2] Checking ClickFix/CNCmachineRMS Indicators..." -ForegroundColor Yellow

$clickfix_hashes = @(
    "2eb387df728fc6f5dd2dcffaf1883cbf8c5e0c489f6cb38021d67f856ee669d0",
    "101e9ac653ccd341e36fae84a5c6920dff47a41822e87db4c72e36da4830d707"
)

$clickfix_domains = @("cashewminaret.org", "orchardandbarite.com")

# Check DNS cache for ClickFix domains
$dns_cache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($domain in $clickfix_domains) {
    $dns_hits = $dns_cache | Where-Object { $_.Entry -match $domain }
    if ($dns_hits) {
        $findings += [PSCustomObject]@{
            Campaign = "ClickFix"
            Type = "DNS Resolution"
            Indicator = $domain
            Risk = "HIGH"
            Action = "Block domain, investigate host"
        }
        Write-Host "  [!] DNS cache hit: $domain" -ForegroundColor Red
    }
}

# Check for recent HTA file execution artifacts
$hta_paths = @(
    "$env:TEMP\*.hta",
    "$env:USERPROFILE\Downloads\*.hta",
    "$env:APPDATA\*.hta"
)

foreach ($path in $hta_paths) {
    $files = Get-ChildItem -Path $path -ErrorAction SilentlyContinue | Where-Object {
        $_.LastWriteTime -gt (Get-Date).AddDays(-7)
    }
    foreach ($file in $files) {
        $findings += [PSCustomObject]@{
            Campaign = "ClickFix"
            Type = "HTA File Artifact"
            Indicator = $file.FullName
            Risk = "MEDIUM"
            Action = "Analyze file contents"
        }
        Write-Host "  [!] Recent HTA file: $($file.FullName)" -ForegroundColor Yellow
    }
}

# Check for DLL side-loading indicators in Temp/Downloads
$suspicious_dlls = Get-ChildItem -Path "$env:TEMP", "$env:USERPROFILE\Downloads" -Filter "*.dll" -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
    Select-Object -First 20

foreach ($dll in $suspicious_dlls) {
    $hash = (Get-FileHash -Path $dll.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($hash -in $clickfix_hashes) {
        $findings += [PSCustomObject]@{
            Campaign = "ClickFix/CNCmachineRMS"
            Type = "Known Malicious DLL"
            Indicator = "$($dll.FullName) - $hash"
            Risk = "CRITICAL"
            Action = "Isolate host immediately"
        }
        Write-Host "  [!!!] CONFIRMED CNCmachineRMS DLL: $($dll.FullName)" -ForegroundColor Magenta
    }
}

# Check for mshta.exe network connections
$mshta_connections = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {
    $_.OwningProcess -in (Get-Process -Name "mshta" -ErrorAction SilentlyContinue).Id
}

foreach ($conn in $mshta_connections) {
    $findings += [PSCustomObject]@{
        Campaign = "ClickFix"
        Type = "Mshta Network Activity"
        Indicator = "$($conn.RemoteAddress):$($conn.RemotePort)"
        Risk = "HIGH"
        Action = "Capture traffic, investigate destination"
    }
    Write-Host "  [!] Mshta network connection: $($conn.RemoteAddress)" -ForegroundColor Red
}
#endregion

#region PEERSTITCH Campaign - Fortinet Indicators
Write-Host "`n[PHASE 3] Checking PEERSTITCH/Fortinet Indicators..." -ForegroundColor Yellow

$peerstitch_hashes = @(
    "8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92",
    "b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70",
    "829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11"
)

$fortinet_cves = @("CVE-2024-47575", "CVE-2024-26009", "CVE-2025-59718", "CVE-2025-59719", "CVE-2025-61624")

Write-Host "  [i] PEERSTITCH is memory-resident - disk artifacts unlikely" -ForegroundColor Cyan
Write-Host "  [i] Recommend: Memory capture of FortiManager/FortiGate appliances" -ForegroundColor Cyan
Write-Host "  [i] CVEs to verify patched: $($fortinet_cves -join ', ')" -ForegroundColor Cyan

# Check for Fortinet management interface connections from unusual sources
$fortinet_ports = @(443, 8443, 541, 514)
$fortinet_connections = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {
    $_.RemotePort -in $fortinet_ports -and $_.State -eq "Established"
}

# Flag any external connections to management ports
foreach ($conn in $fortinet_connections) {
    $remote_ip = $conn.RemoteAddress
    if ($remote_ip -notmatch "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)") {
        $findings += [PSCustomObject]@{
            Campaign = "PEERSTITCH"
            Type = "External Fortinet Management Connection"
            Indicator = "$remote_ip`:$($conn.RemotePort)"
            Risk = "HIGH"
            Action = "Verify legitimate admin access"
        }
        Write-Host "  [!] External Fortinet mgmt connection: $remote_ip" -ForegroundColor Yellow
    }
}
#endregion

#region Summary Report
Write-Host "`n==========================================" -ForegroundColor Cyan
Write-Host "[SCAN COMPLETE]" -ForegroundColor Green

if ($findings.Count -gt 0) {
    Write-Host "[!!!] $($findings.Count) POTENTIAL INDICATORS DETECTED" -ForegroundColor Red
    $findings | Format-Table -AutoSize
    
    # Export findings
    $export_path = "$env:USERPROFILE\Desktop\ThreatHunt_Findings_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
    $findings | Export-Csv -Path $export_path -NoTypeInformation
    Write-Host "`n[+] Findings exported to: $export_path" -ForegroundColor Green
    
    Write-Host "`n[RECOMMENDED ACTIONS]" -ForegroundColor Cyan
    Write-Host "  1. Isolate affected hosts from network" -ForegroundColor White
    Write-Host "  2. Capture memory images for forensic analysis" -ForegroundColor White
    Write-Host "  3. Reset credentials for potentially compromised accounts" -ForegroundColor White
    Write-Host "  4. Review firewall logs for C2 communication" -ForegroundColor White
    Write-Host "  5. Contact Security Arsenal IR team: https://securityarsenal.com/services/incident-response" -ForegroundColor White
} else {
    Write-Host "[OK] No indicators detected on this system" -ForegroundColor Green
    Write-Host "    Continue monitoring and maintain defensive posture" -ForegroundColor White
}

Write-Host "`n[+] Hunt completed at $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan
#endregion