---
title: Potential ClickFix Social Engineering Activity
id: 6d8c4a12-8b2c-4f3d-9e1a-1c5b6d7e8f9a
description: Detects suspicious PowerShell or CMD execution often triggered by ClickFix campaigns where users are tricked into running "fix" commands via browser prompts.
status: experimental
author: Security Arsenal
date: 2026/04/24
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - 'copy'
            - 'paste'
            - 'regsvr32'
    filter_legit:
        CommandLine|contains:
            - 'Microsoft'
            - 'Windows'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administrative scripts launched from browser downloads
level: high
---
title: TeamPCP Supply Chain Compromise - Suspicious KICS/Trivy Network Connection
id: 7e9f1a2b-3c4d-5e6f-7g8h-9i0j1k2l3m4n
description: Detects network connections from compromised developer tools (KICS, Trivy) to known TeamPCP typosquatting domains or non-standard ports associated with data exfiltration.
status: experimental
author: Security Arsenal
date: 2026/04/24
tags:
    - attack.exfiltration
    - attack.t1041
logsource:
    category: network_connection
    product: windows
detection:
    selection_process:
        Image|contains:
            - 'kics'
            - 'trivy'
    selection_suspicious_dest:
        DestinationHostname|contains:
            - 'aquasecurtiy.org' # Typosquat
            - 'checkmarx.zone'
        or
        DestinationPort:
            - 1337
            - 4444
            - 8080
    condition: selection_process and selection_suspicious_dest
falsepositives:
    - Connections to legitimate internal repositories on non-standard ports
level: critical
---
title: TwizAdmin Java RAT and FastAPI C2 Activity
id: 1a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
description: Detects execution patterns associated with TwizAdmin malware, specifically Java processes connecting to FastAPI C2 panels or the presence of specific clipper mechanisms.
status: experimental
author: Security Arsenal
date: 2026/04/24
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection_java:
        Image|endswith: '\java.exe'
        DestinationPort: 1337
    selection_cli:
        Image|endswith: '\cmd.exe'
        CommandLine|contains: 'clip'
        DestinationHostname|contains: '.xyz'
    condition: 1 of selection_*
falsepositives:
    - Legitimate Java applications communicating with internal APIs on port 1337
level: high


kql
// Hunt for ClickFix related process execution and TeamPCP supply chain IOCs
// Combines process creation and network events
let SuspiciousDomains = dynamic(['ustazazharidrus.com', 'account-help.info', 'quiptly.com', 'elive123go.com', 'aquasecurtiy.org', 'checkmarx.zone', 'fanonlyatn.xyz']);
let SuspiciousIPs = dynamic(['31.31.198.206', '94.154.172.43', '103.241.66.238']);
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (SuspiciousDomains) or RemoteIP has_any (SuspiciousIPs)
| extend FullURL = strcat('https://', RemoteUrl, RemotePort)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| union (
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where ProcessCommandLine has_any ("copy", "paste", "regsvr32") and InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
)
| order by Timestamp desc


powershell
# IOC Hunt Script for TwizAdmin, Trigona Exfiltration Tool, and TeamPCP Artifacts
# Requires administrative privileges

$TargetHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "d47de3772f2d61a043e7047431ef4cf4",
    "e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173",
    "222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b"
)

$SuspiciousFiles = @(
    "uploader_client.exe",
    "mcpAddon.js",
    "kics.exe", # Check for version if possible, otherwise verify hash
    "trivy"
)

Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Cyan

# Scan C:\ drive for specific hashes
foreach ($hash in $TargetHashes) {
    $result = Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
        Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | 
        Where-Object { $_.Hash -eq $hash }
    
    if ($result) {
        Write-Host "[!] MALICIOUS FILE FOUND: $($result.Path) (Hash: $($result.Hash))" -ForegroundColor Red
    }
}

Write-Host "[+] Scanning for suspicious filenames..." -ForegroundColor Cyan

foreach ($file in $SuspiciousFiles) {
    $paths = Get-ChildItem -Path C:\ -Filter $file -Recurse -ErrorAction SilentlyContinue -Force
    foreach ($path in $paths) {
        Write-Host "[!] SUSPICIOUS FILENAME FOUND: $($path.FullName)" -ForegroundColor Yellow
    }
}

Write-Host "[+] Checking for TwizAdmin/TeamPCP related scheduled tasks..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -like "*java*" -or 
    $_.Actions.Execute -like "*powershell*" -and 
    $_.TaskName -like "*Update*" 
} | Format-Table TaskName, TaskPath, State -AutoSize

Write-Host "[+] Hunt complete." -ForegroundColor Green


# Response Priorities