WordlistLoader and SynkLoader: Defending Against ClickFix-Delivered Amatera Stealer and Credential Phishing

---
title: ClickFix FakeCaptcha User-Executed Remote Command via Run Dialog
id: 3f8a1c92-7d4e-4b5a-9f21-8c6e2a4d7b10
status: experimental
description: Detects the ClickFix/FakeCaptcha social engineering pattern where a user is tricked into pasting a malicious command into the Windows Run dialog, resulting in explorer.exe spawning mshta, powershell, or wscript with a URL or encoded payload. Associated with ClearFake campaigns delivering WordlistLoader and Amatera Stealer.
references:
  - https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html
  - https://attack.mitre.org/techniques/T1204/001/
  - https://attack.mitre.org/techniques/T1218/005/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.execution
  - attack.t1204.001
  - attack.t1218.005
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
  selection_cli:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - '-enc'
      - '-e '
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'iwr '
      - 'Invoke-WebRequest'
      - 'DownloadString'
      - 'mshta vbscript'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Rare administrative troubleshooting where an admin pastes commands into the Run dialog
level: high
---
title: Mshta Spawning Script Interpreter or Downloader Child Process
id: 6b2e4d18-9a3c-4f7b-8e15-2d9c5a7e3f06
status: experimental
description: Detects mshta.exe spawning PowerShell, cmd, or other script interpreters — a common ClickFix and loader staging pattern observed in WordlistLoader delivery of Amatera Stealer via ClearFake campaigns.
references:
  - https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html
  - https://attack.mitre.org/techniques/T1218/005/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\mshta.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  condition: selection
falsepositives:
  - Legacy line-of-business HTA applications (rare in modern environments; baseline and allowlist)
level: high
---
title: Suspicious Payload Staging in User-Writable Directory Followed by Execution
id: 9d1c7f34-2b8e-4a6d-b392-5e8f4c1a9d27
status: experimental
description: Detects creation and subsequent execution of script or executable payloads in TEMP/APPDATA user-writable directories, consistent with WordlistLoader/Amatera Stealer staging behavior delivered through ClickFix lures.
references:
  - https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1036/
author: Security Arsenal
date: 2026/08/15
tags:
  - attack.execution
  - attack.t1059
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
  selection_ext:
    Image|endswith:
      - '.exe'
      - '.ps1'
      - '.hta'
      - '.js'
      - '.vbs'
      - '.bat'
  filter_known:
    Image|contains:
      - '\AppData\Local\Microsoft\'
      - '\AppData\Local\Google\'
      - '\AppData\Roaming\Microsoft\'
      - '\AppData\Local\Temp\7z'
      - '\AppData\Local\Temp\Rar$'
      - '\AppData\Local\Temp\nsg'
  condition: selection_path and selection_ext and not filter_known
falsepositives:
  - Software updaters (Teams, Zoom, OneDrive) installing per-user — tune with additional signer/parent filters for your environment
level: medium

let lookback = 14d;
let suspiciousBins = @"mshta.exe|powershell.exe|pwsh.exe|wscript.exe|cscript.exe|curl.exe|bitsadmin.exe|rundll32.exe";
let suspiciousCli = @"http://|https://|-enc|-e |FromBase64String|IEX|Invoke-Expression|Invoke-WebRequest|iwr |DownloadString|hidden|-w hidden|mshta vbscript";
union isfuzzy=true
(DeviceProcessEvents
 | where TimeGenerated > ago(lookback)
 | where InitiatingProcessFileName =~ "explorer.exe"
 | where FileName matches regex suspiciousBins
 | where ProcessCommandLine matches regex suspiciousCli
 | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256, ReportId
 | extend Source = "Defender"),
(SecurityEvent
 | where TimeGenerated > ago(lookback)
 | where EventID == 4688
 | where ParentProcessName endswith @"\explorer.exe"
 | where NewProcessName matches regex suspiciousBins
 | where CommandLine matches regex suspiciousCli
 | project TimeGenerated, Computer, Account, NewProcessName, CommandLine, ParentProcessName, Source = "Sysmon4688");

DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("mshta.exe","powershell.exe","wscript.exe","cscript.exe","rundll32.exe")
| where RemoteUrl !has_any ("microsoft.com","windowsupdate.com","office.com","office365.com")  // tune for your environment
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), ConnectionCount = count(), Devices = dcount(DeviceName) by InitiatingProcessFileName, RemoteUrl, RemoteIP
| where ConnectionCount < 50   // focus on low-prevalence, novel destinations
| order by FirstSeen desc;

-- Hunt for ClickFix/FakeCaptcha execution chains and loader staging
-- Targets explorer-spawned LOLBins with remote URLs or encoded payloads,
-- plus executables staged in user-writable directories (WordlistLoader/Amatera behavior)

LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(mshta|powershell|pwsh|wscript|cscript|curl|bitsadmin)'
  AND (CommandLine =~ '(?i)(https?://|FromBase64String|Invoke-Expression|DownloadString|-enc|hidden)')

LET staged = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/AppData/Local/Temp/*.exe','C:/Users/*/AppData/Local/Temp/*.ps1','C:/Users/*/AppData/Roaming/*/*.exe','C:/Users/Public/*.exe','C:/Users/Public/*.hta'])
WHERE Mtime > now() - 604800   -- last 7 days

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'STAGED_FILE' AS Name, FullPath AS Exe, FullPath AS CommandLine, NULL AS Username, Mtime AS CreateTime FROM staged

# ============================================================
# Security Arsenal - ClickFix / Loader Hardening & Audit Script
# Run as Administrator. Audit first, then apply.
# ============================================================

# --- 1. AUDIT: Check ASR rule state for known loader-abused rules ---
# ASR rule GUIDs relevant to this threat:
#   d1e49aac-8f56-4280-b9ba-993a6d77406c = Block process creations from PSExec/WMI (context)
#   5beb7efe-fd9a-4556-801d-275e5ffc04cc = Block execution of potentially obfuscated scripts
#   92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b = Block Win32 API calls from Office macros (context)
#   d4f940ab-401b-4efc-aadc-ad5f3c50688a = Block Office apps creating child processes (context)
#   26190899-1602-49e8-8b27-eb1d0a1ce869 = Block Office communication apps creating child processes
$asrRules = @{
  'Obfuscated scripts'      = '5beb7efe-fd9a-4556-801d-275e5ffc04cc'
  'PSExec/WMI child procs'  = 'd1e49aac-8f56-4280-b9ba-993a6d77406c'
}
Write-Host "=== ASR Rule Status ===" -ForegroundColor Cyan
foreach ($name in $asrRules.Keys) {
  $guid = $asrRules[$name]
  $val  = (Get-MpPreference).AttackSurfaceReductionRules_Ids -contains $guid
  $idx  = (Get-MpPreference).AttackSurfaceReductionRules_Ids.IndexOf($guid)
  if ($val) {
    $action = (Get-MpPreference).AttackSurfaceReductionRules_Actions[$idx]
    Write-Host "[$(if($action -eq 1){'BLOCK'}elseif($action -eq 2){'AUDIT'}else{'OTHER'})] $name"
  } else {
    Write-Host "[NOT SET ] $name" -ForegroundColor Yellow
  }
}

# --- 2. HARDEN: Enable ASR rule against obfuscated scripts (set to Audit first, then Block) ---
# Start with 2 (Audit) for 7-14 days, review Defender event 1121/1122, then flip to 1 (Block)
Add-MpPreference -AttackSurfaceReductionRules_Ids 5beb7efe-fd9a-4556-801d-275e5ffc04cc `n  -AttackSurfaceReductionRules_Actions 1

# --- 3. HARDEN: Restrict mshta.exe via Software Restriction-style AppLocker rule check ---
$applocker = Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue
if (-not $applocker) {
  Write-Host "[!] No AppLocker policy detected. Deploy an AppLocker/WDAC rule to DENY mshta.exe for standard users." -ForegroundColor Yellow
} else {
  Write-Host "[+] AppLocker policy present. Verify mshta.exe is denied for non-admin users."
}

# --- 4. DETECTION: Ensure PowerShell Script Block Logging + Module Logging are enabled ---
$sbPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
if (-not (Test-Path $sbPath)) { New-Item -Path $sbPath -Force | Out-Null }
Set-ItemProperty -Path $sbPath -Name 'EnableScriptBlockLogging' -Value 1
$modPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging'
if (-not (Test-Path $modPath)) { New-Item -Path $modPath -Force | Out-Null }
Set-ItemProperty -Path $modPath -Name 'EnableModuleLogging' -Value 1
Write-Host "[+] PowerShell Script Block and Module logging enabled."

# --- 5. DETECTION: Verify process creation command-line auditing (Event 4688) ---
$cmdLine = (Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' `n  -Name 'ProcessCreationIncludeCmdLine_Enabled' -ErrorAction SilentlyContinue).ProcessCreationIncludeCmdLine_Enabled
if ($cmdLine -ne 1) {
  Set-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' `n    -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1
  Write-Host "[+] Enabled command-line capture for Event 4688."
} else {
  Write-Host "[+] Event 4688 command-line capture already enabled."
}

# --- 6. VERIFY: Defender real-time protection + cloud protection ---
$mp = Get-MpComputerStatus
Write-Host "=== Defender Status ===" -ForegroundColor Cyan
Write-Host "RealTimeProtection: $($mp.RealTimeProtectionEnabled) | CloudProtection: $($mp.IsCloudProtectionEnabled) | SignatureAge(days): $($mp.AntivirusSignatureAge)"
if ($mp.AntivirusSignatureAge -gt 2) { Write-Host "[!] Signatures stale - force update now." -ForegroundColor Red }

Write-Host "`nDone. Review ASR audit events (Defender EventIDs 1121/1122) before enforcing Block mode." -ForegroundColor Green