Woodgnat 'Node.js Resurgence' Campaign: ClickFix → ModeloRAT + EtherHiding C2 — OTX Detection Engineering Pack

---
title: Node.exe Executing Remote or Suspicious JavaScript Payload
id: 7f3a9c21-4b8e-4d2a-9f6c-woodgnat0001
status: experimental
description: Detects the signed node.exe binary being used to execute JavaScript from suspicious locations or with inline/remote script arguments, consistent with Woodgnat ClickFix-to-ModeloRAT delivery (T1218, T1059.007).
author: Security Arsenal Threat Intel
references:
  - https://www.security.com/threat-intelligence/node-js-returns-ransomware
date: 2026/09/03
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\node.exe'
  selection_cli:
    CommandLine|contains:
      - ' -e '
      - '--eval'
      - 'http://'
      - 'https://'
      - '\Temp\'
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '.js"'
      - ".js'"
  filter_legit_paths:
    CommandLine|contains:
      - '\node_modules\'
      - '\npm\'
      - 'Program Files\nodejs'
    CommandLine|endswith:
      - 'npm.js'
      - 'npx-cli.js'
  condition: selection_img and selection_cli and not filter_legit_paths
falsepositives:
  - Developer workstations running ad-hoc node scripts
level: high
tags:
  - attack.defense_evasion
  - attack.t1218
  - attack.execution
  - attack.t1059.007
---
title: ClickFix Execution Chain — Run Dialog Spawning Script or LOLBin Chain
id: 8a4bd732-5c9f-4e3b-a17d-woodgnat0002
status: experimental
description: Identifies explorer.exe (Run dialog) spawning mshta, powershell, cmd, wscript, or node — the hallmark ClickFix user-pasted command chain used by Woodgnat (T1204).
author: Security Arsenal Threat Intel
references:
  - https://www.security.com/threat-intelligence/node-js-returns-ransomware
date: 2026/09/03
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\node.exe'
  selection_suspicious:
    CommandLine|contains:
      - 'iex'
      - 'Invoke-Expression'
      - 'downloadstring'
      - 'curl'
      - 'msiexec'
      - 'nodejs.org'
      - '.js'
      - 'bit.ly'
      - 'pastebin'
  condition: selection_parent and selection_child and selection_suspicious
falsepositives:
  - IT admin quick tasks via Run dialog (rare in most orgs)
level: critical
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059
---
title: EtherHiding C2 — Non-Browser Process Querying Blockchain RPC Gateways
id: 9c5ce843-6d1a-4f4c-b28e-woodgnat0003
status: experimental
description: Detects non-browser processes (especially node.exe) making network connections to blockchain RPC infrastructure such as tenderly.co, indicative of EtherRAT EtherHiding C2 resolution (T1102, T1071.001).
author: Security Arsenal Threat Intel
references:
  - https://www.security.com/threat-intelligence/node-js-returns-ransomware
date: 2026/09/03
logsource:
  category: network_connection
  product: windows
detection:
  selection_dst:
    DestinationHostname|contains:
      - 'tenderly.co'
      - 'bsc-dataseed'
      - 'mainnet.infura.io'
      - 'rpc.ankr.com'
      - 'cloudflare-eth.com'
  selection_proc:
    Image|endswith:
      - '\node.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\brave.exe'
  condition: selection_dst and selection_proc and not filter_browsers
falsepositives:
  - Web3 development workstations
  - Crypto trading tools on finance team endpoints
level: high
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1071.001

// Woodgnat Node.js Campaign Hunt — Microsoft Sentinel
// Hunts for node.exe execution anomalies, ClickFix chains, EtherHiding C2, and pulse IOCs
let Lookback = 14d;
let IOC_IPs = dynamic(["94.156.114.250", "178.16.55.232"]);
let IOC_Domains = dynamic(["mueleer.com", "grande-luna.top", "oeannon.com", "www.xt24.com", "mail.authorized-logins.net"]);
let EtherHiding_RPC = dynamic(["mainnet.gateway.tenderly.co", "bsc-dataseed.binance.org", "rpc.ankr.com", "mainnet.infura.io"]);
// Part 1: node.exe executing JS from user-writable paths or with remote URLs
let NodeAbuse = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName =~ "node.exe"
| where ProcessCommandLine has_any ("-e ", "--eval", ".js", "http://", "https://")
| where ProcessCommandLine has_any (@"\Temp\", @"\AppData\", @"\Downloads\", "http")
| where not(ProcessCommandLine has_any ("node_modules", "npm", "npx"))
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
// Part 2: ClickFix chain — explorer spawning script interpreters
let ClickFix = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","cmd.exe","wscript.exe","node.exe")
| where ProcessCommandLine has_any ("iex", "downloadstring", "Invoke-Expression", "nodejs.org", "msiexec", ".js")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine;
// Part 3: EtherHiding — non-browser processes reaching blockchain RPC
let EtherC2 = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl has_any (EtherHiding_RPC)
| where not(InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
// Part 4: Direct IOC hits
let IOCHits = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteIP in (IOC_IPs) or RemoteUrl has_any (IOC_Domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort;
union NodeAbuse, ClickFix, EtherC2, IOCHits
| sort by TimeGenerated desc

# Woodgnat Node.js Campaign — Endpoint IOC & Artifact Hunt
# Run via EDR live response or PS remoting across fleet. Checks persistence,
# node.exe artifacts, staging dirs, and live C2 connections.

$ErrorActionPreference = 'SilentlyContinue'
$IOC_IPs     = @('94.156.114.250','178.16.55.232')
$IOC_Domains = @('mueleer.com','grande-luna.top','oeannon.com','xt24.com','authorized-logins.net')
$report = @()

Write-Host '[*] Checking persistence: Run keys referencing node/.js payloads...' -ForegroundColor Cyan
$runKeys = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $runKeys) {
  if (Test-Path $key) {
    Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
      $val = (Get-ItemProperty $key).($_.Name)
      if ($val -match 'node\.exe|\.js|wscript|cscript') {
        $report += [pscustomobject]@{Type='Persistence-RunKey'; Path=$key; Name=$_.Name; Value=$val}
      }
    }
  }
}

Write-Host '[*] Checking scheduled tasks masquerading as Node.js update jobs...' -ForegroundColor Cyan
Get-ScheduledTask | Where-Object {
  $_.TaskName -match 'node|npm|jsupdate' -or
  ($_.Actions.Execute -match 'node\.exe|wscript|cscript|mshta') -or
  ($_.Actions.Arguments -match '\.js|http')
} | ForEach-Object {
  $report += [pscustomobject]@{Type='Persistence-SchedTask'; Path=$_.TaskPath+$_.TaskName; Name=$_.Actions.Execute; Value=$_.Actions.Arguments}
}

Write-Host '[*] Hunting dropped JS payloads in user-writable staging dirs...' -ForegroundColor Cyan
$stagingDirs = @("$env:TEMP", "$env:LOCALAPPDATA\Temp", "$env:USERPROFILE\Downloads", "$env:APPDATA", 'C:\ProgramData')
foreach ($dir in $stagingDirs) {
  Get-ChildItem $dir -Recurse -Include *.js -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) -and $_.DirectoryName -notmatch 'node_modules' } |
    ForEach-Object {
      $head = Get-Content $_.FullName -TotalCount 5 -ErrorAction SilentlyContinue | Out-String
      if ($head -match 'eval\(|child_process|require\(.http|fetch\(|ActiveXObject|WScript\.Shell') {
        $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
        $report += [pscustomobject]@{Type='Suspicious-JSPayload'; Path=$_.FullName; Name=$_.LastWriteTime; Value=$hash}
      }
    }
}

Write-Host '[*] Checking live network connections to campaign C2 and EtherHiding RPC...' -ForegroundColor Cyan
Get-NetTCPConnection -State Established | ForEach-Object {
  $proc = (Get-Process -Id $_.OwningProcess).ProcessName
  if ($IOC_IPs -contains $_.RemoteAddress -or ($proc -in @('node','powershell','wscript','mshta','rundll32'))) {
    try {
      $dns = (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost
    } catch { $dns = '' }
    if (($IOC_IPs -contains $_.RemoteAddress) -or ($dns -match ($IOC_Domains -join '|')) -or ($dns -match 'tenderly\.co|bsc-dataseed|infura|ankr')) {
      $report += [pscustomobject]@{Type='Network-C2'; Path=$proc; Name=$_.RemoteAddress; Value="$dns :$($_.RemotePort)"}
    }
  }
}

Write-Host '[*] Checking for rogue Node.js installs outside Program Files...' -ForegroundColor Cyan
Get-ChildItem "$env:LOCALAPPDATA","$env:TEMP",'C:\ProgramData' -Recurse -Filter node.exe -ErrorAction SilentlyContinue |
  ForEach-Object {
    $sig = Get-AuthenticodeSignature $_.FullName
    $report += [pscustomobject]@{Type='Rogue-NodeBinary'; Path=$_.FullName; Name=$sig.SignerCertificate.Subject; Value=$sig.Status}
  }

Write-Host "`n[+] Hunt complete. $($report.Count) findings:" -ForegroundColor Green
$report | Format-Table -AutoSize | Out-String -Width 300
$report | Export-Csv -Path ".\woodgnat_hunt_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation