---
title: Potential ClickFix PowerShell Execution
date: 2026/08/04
status: experimental
description: Detects PowerShell commands launched via mshta or browser processes typical of ClickFix campaigns leading to Starland RAT.
references:
    - https://blog.polyswarm.io/clickfix-themed-campaign-deploys-starland-rat-and-wldr-framework
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\msedge.exe'
            - '\chrome.exe'
            - '\firefox.exe'
            - '\mshta.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'DownloadString'
            - 'IEX'
            - 'FromBase64String'
    condition: selection
falsepositives:
    - Administrative scripts
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.user_execution
    - attack.t1204
---
title: Suspicious Software Installer Execution
id: 4b0e2e3c-1a2b-4c3d-8e5f-6a7b8c9d0e1f
date: 2026/08/04
status: experimental
description: Detects execution of MobaXterm, WebEx, or Zoom installers from suspicious directories (User Profile or Temp) associated with UAT-11795.
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\MobaXterm.exe'
            - '\WebEx.exe'
            - '\Zoom.exe'
            - '\DBeaver.exe'
    selection_path:
        CurrentDirectory|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
    condition: all of selection_*
falsepositives:
    - Legitimate software updates initiated by users
level: medium
tags:
    - attack.initial_access
    - attack.t1190
---
title: Linux Privilege Escalation via PwnKit (CVE-2021-4034)
id: 5c1f3d4e-2b3c-4d5e-9f0a-1b2c3d4e5f6a
date: 2026/08/04
status: experimental
description: Detects exploitation attempts of the Polkit pkexec vulnerability (PwnKit) referenced in NightLedger campaign.
author: Security Arsenal
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/pkexec'
        CommandLine|contains: 'GCONV_PATH='
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.privilege_escalation
    - attack.cve-2021-4034
    - attack.t1068

// Hunt for ClickFix-related PowerShell activity and suspicious installers
let ProcessEvents = DeviceProcessEvents
| where Timestamp > ago(7d);
// 1. PowerShell spawned by browsers or HTA
let ClickFixHunt = ProcessEvents
| where InitiatingProcessFileName in ('msedge.exe', 'chrome.exe', 'firefox.exe', 'mshta.exe')
| where FileName =~ 'powershell.exe'
| where ProcessCommandLine has_any ('DownloadString', 'IEX', 'FromBase64String');
// 2. Suspicious Installer execution paths
let InstallerHunt = ProcessEvents
| where FileName in~ ('MobaXterm.exe', 'WebEx.exe', 'Zoom.exe', 'DBeaver.exe')
| where FolderPath has_any ('Downloads', 'Temp', 'AppData');
// 3. Unix Auditd for PwnKit attempts (if Linux data is ingested)
let PwnKitHunt = DeviceProcessEvents
| where Timestamp > ago(30d)
| where OSPlatform == "Linux"
| where FileName has "pkexec"
| where ProcessCommandLine has "GCONV_PATH";
union ClickFixHunt, InstallerHunt, PwnKitHunt
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName

# Hunt script for Starland/WLDR persistence mechanisms and PwnKit vulnerability check
Write-Host "[+] Checking for Starland/WLDR Persistence Registry Keys..." -ForegroundColor Cyan
$paths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)
$malware_patterns = @("Starland", "WLDR", "CastleStealer")

foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-Item $path | Select-Object -ExpandProperty Property | ForEach-Object {
            $prop = $_
            $value = (Get-ItemProperty -Path $path -Name $prop).$prop
            if ($malware_patterns | Where-Object { $value -match $_ }) {
                Write-Host "[!] Suspicious persistence found in $path : $prop = $value" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking Scheduled Tasks for suspicious actions..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { 
    $_.Actions.Execute -like "*powershell*" -or 
    $_.Actions.Execute -like "*cmd.exe*" 
} | Select-Object TaskName, TaskPath, Actions | ForEach-Object {
    if ($_.Actions.Execute -match "http" -or $_.Arguments -match "encodedcommand") {
        Write-Host "[!] Suspicious Task Detected: $($_.TaskName)" -ForegroundColor Yellow
    }
}

Write-Host "[+] Checking Linux Subsystem or remote hosts for PwnKit vulnerability (CVE-2021-4034) indication..." -ForegroundColor Cyan
# Note: This checks the local policy kit version if running on Linux/WSL, otherwise informational for the analyst.
if ($IsLinux -or $IsMacOS) {
    $polkit_version = (dpkg -l policykit-1 2>$null) || (rpm -q polkit 2>$null)
    if ($polkit_version) { Write-Host "[*] Polkit version info: $polkit_version" }
} else {
    Write-Host "[*] Manual check required: Verify linux patch level for CVE-2021-4034 (pkexec) on compromised hosts."
}


# Response Priorities

*   **Immediate**:
    *   Block execution of installers (`MobaXterm.exe`, `WebEx.exe`, `Zoom.exe`) from user-writable directories (`Downloads`, `Temp`) via AppLocker or SRP.
    *   Patch systems against the high-profile CVEs listed, specifically **CVE-2021-4034 (PwnKit)** and **CVE-2022-30190 (Follina)**.
    *   Block indicators associated with Starland RAT and WLDR frameworks if specific domains/IPs are extracted from full pulse data.

*   **24 Hours**:
    *   Initiate credential reset for users in the Finance and IT departments if CastleStealer infection is suspected.
    *   Hunt for signs of `NightLedger` or `BridgeHead` persistence on endpoints in the Middle East/Africa regions.
    *   Review web proxies for "ClickFix" patterns (HTML files with JS causing `mshta.exe` spawns).

*   **1 Week**:
    *   Implement strict application whitelisting to prevent unauthorized trojanized installers.
    *   Conduct security awareness training focusing on fake browser errors and software update scams.
    *   Enhance email gateway filtering to detect Mirage Kitten spear-phishing lures targeting the Aerospace/Defense sector.