Woodgnat Node.js Loader Campaign + PaperCut MF Zero-Day AdaptixC2 Intrusions: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Node.exe Executing Suspicious JavaScript Payload
description: Detects the legitimate Node.js runtime executing inline or downloaded JavaScript — the core execution primitive of the Woodgnat ClickFix campaign delivering ModeloRAT, EtherRAT, and AdaptixC2.
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_image:
    Image|endswith: '\node.exe'
  selection_cmd:
    CommandLine|contains:
      - ' -e '
      - '--eval'
      - 'Invoke-Expression'
      - 'https://'
      - 'http://'
      - 'fetch('
      - 'require(''child_process'')'
  filter_userprofile:
    Image|contains:
      - '\AppData\'
      - '\Users\Public\'
      - '\ProgramData\'
  condition: selection_image and selection_cmd and not filter_userprofile
falsepositives:
  - Developer workstations running Node.js with inline eval
  - Legitimate npm tooling
tags:
  - attack.defense_evasion
  - attack.t1218
  - attack.t1059.007
level: high
status: experimental
date: 2026/10/03
author: Security Arsenal Threat Intelligence
---
title: ClickFix Clipboard Execution via PowerShell or mshta
logsource:
  category: process_creation
  product: windows
  service: sysmon
description: Detects ClickFix-style user-driven execution where a fake verification page causes a user to paste commands launching node.js installers, mshta, or curl-based payload retrieval.
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\msiexec.exe'
  selection_cmd:
    CommandLine|contains:
      - 'nodejs.org'
      - 'node-v'
      - '-enc'
      - 'IEX'
      - 'iwr '
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - Administrators installing Node.js from a browser-initiated download
level: high
status: experimental
date: 2026/10/03
author: Security Arsenal Threat Intelligence
tags:
  - attack.initial_access
  - attack.t1204
---
title: PaperCut MF Web Shell or Java Loader Process Spawn
description: Detects PaperCut MF application server spawning shells, Java loaders, or scripting interpreters — consistent with CVE-2026-82078 / CVE-2026-81578 exploitation leading to web shell deployment and AdaptixC2 delivery.
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|contains:
      - '\papercut\'
      - 'pc-app.exe'
      - 'pc-server.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\java.exe'
      - '\javaw.exe'
      - '\w3wp.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; PaperCut spawning system shells is highly anomalous
level: critical
status: experimental
date: 2026/10/03
author: Security Arsenal Threat Intelligence
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution

let ioc_domains = dynamic(["mueleer.com","grande-luna.top","oeannon.com","challenge-refernow.com","csa-humanchecknow.com","mail.authorized-logins.net","www.xt24.com","mainnet.gateway.tenderly.co"]);
let ioc_ips = dynamic(["156.227.0.13"]);
let ioc_hashes = dynamic(["d2e55213a02fd16a077298c986130522eb63196bdf8a8c1aec0eed6ef318b222","cf6dd15baf5ef66432a95b5a2ec64ba5c6de565b3fb9e10ae01b1a91612a1c2c","bc5fd75b307c2a11a602fbedb8275e0836ddf81cdd43af00a6bf0d850ff6cf58"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteUrl has_any (ioc_domains) or RemoteIP in (ioc_ips)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort),
(DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where SHA256 in (ioc_hashes)
   or (FileName =~ "node.exe" and ProcessCommandLine has_any ("--eval"," -e ","fetch(","http"))
   or (InitiatingProcessFolderPath has "papercut" and FileName in~ ("cmd.exe","powershell.exe","java.exe","rundll32.exe"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine),
(DeviceFileEvents
| where TimeGenerated > ago(90d)
| where SHA256 in (ioc_hashes)
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName)
| sort by TimeGenerated desc

# Security Arsenal — Woodgnat Node.js / AdaptixC2 / PaperCut Hunt Script
$IOCs = @{
    Domains = @('mueleer.com','grande-luna.top','oeannon.com','challenge-refernow.com','csa-humanchecknow.com','mail.authorized-logins.net','www.xt24.com','mainnet.gateway.tenderly.co')
    IPs     = @('156.227.0.13')
    Hashes  = @('d2e55213a02fd16a077298c986130522eb63196bdf8a8c1aec0eed6ef318b222','cf6dd15baf5ef66432a95b5a2ec64ba5c6de565b3fb9e10ae01b1a91612a1c2c','bc5fd75b307c2a11a602fbedb8275e0836ddf81cdd43af00a6bf0d850ff6cf58')
}

Write-Host "[1] Checking active network connections to C2 infrastructure..."
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -in $IOCs.IPs } |
  Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess |
  Format-Table -AutoSize

Write-Host "[2] Checking DNS cache for malicious domain resolutions..."
Get-DnsClientCache -ErrorAction SilentlyContinue |
  Where-Object { $d = $_.Entry; ($IOCs.Domains | Where-Object { $d -like "*$_*" }) } |
  Select-Object Entry, Data, Status | Format-Table -AutoSize

Write-Host "[3] Hunting rogue node.exe instances outside standard install paths..."
Get-Process -Name node -ErrorAction SilentlyContinue |
  Where-Object { $_.Path -notlike '*Program Files*' } |
  Select-Object Id, Path, StartTime | Format-Table -AutoSize

Write-Host "[4] Checking persistence: Run keys referencing node.js or suspicious JS..."
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
  Get-ItemProperty $key -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty |
    Where-Object { $_.Name -notmatch 'PS' } | ForEach-Object {
      $val = (Get-ItemProperty $key -Name $_.Name).$($_.Name)
      if ($val -match 'node\.exe|\.js|mshta|powershell.*-enc') {
        Write-Host "  SUSPICIOUS: $key :: $($_.Name) = $val" -ForegroundColor Red
      }
    }
}

Write-Host "[5] Checking scheduled tasks executing node.exe, mshta, or JS payloads..."
Get-ScheduledTask | ForEach-Object {
  $actions = $_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }
  if ($actions -match 'node\.exe|mshta|\.js |iwr |curl ') {
    Write-Host "  REVIEW: $($_.TaskName) :: $actions" -ForegroundColor Yellow
  }
}

Write-Host "[6] Sweeping common staging paths for known malicious hashes..."
$paths = @("$env:TEMP","$env:PUBLIC","$env:ProgramData","$env:APPDATA")
foreach ($p in $paths) {
  Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($h -and ($IOCs.Hashes -contains $h.ToLower())) {
      Write-Host "  MALICIOUS FILE: $($_.FullName) [$h]" -ForegroundColor Red
    }
  }
}

Write-Host "[7] Checking for trojanized Copilot binary / unsigned Copilot instances..."
Get-ChildItem "$env:LOCALAPPDATA\Microsoft","$env:ProgramFiles" -Recurse -Filter '*copilot*.exe' -ErrorAction SilentlyContinue |
  ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    if ($sig.Status -ne 'Valid' -or $sig.SignerCertificate.Subject -notmatch 'Microsoft') {
      Write-Host "  INVALID SIGNER: $($_.FullName) — Status: $($sig.Status)" -ForegroundColor Red
    }
  }

Write-Host "Hunt complete. Review any RED output immediately and isolate the host."