Multiple Detections Against Recent ClickFix Campaigns

[onurmerdogan]

Details

New Windows detections that are based on Process logs. They are targeting behaviors that are recently exhibited on various ClickFix campaigns.

Detections

• Windows Node.exe Executing JS Script In Immediate Folder: The following analytic identifies node.exe directly executing a single .js script located in the same directory it was launched from, where that directory is an unusual location such as a user profile, PerfLogs, ProgramData, or Temp folder. Legitimate Node.js application, module, and package manager directories are excluded. This pattern is commonly associated with malware loaders and second-stage payloads that leverage the Node.js runtime to execute JavaScript outside of a typical development or application context.
• Windows For Loop Usage Within Cmd.exe To Execute Commands: The following analytic identifies the use of a for /f loop with the delims= option within cmd.exe, a technique commonly used to parse and extract data from the output of other commands. Adversaries and malicious scripts leverage this pattern to programmatically process command output for discovery, data extraction, or execution purposes while evading simpler detection logic.
• Windows Finger.exe Connecting Remote Host: The following analytic identifies cmd.exe spawning finger.exe with a command line containing an @ character, indicating a remote host/server was specified. The Finger protocol utility is largely obsolete in modern environments and has been abused by adversaries as a living-off-the-land binary (LOLBIN) to retrieve encoded payloads or establish covert command-and-control communication with an attacker-controlled finger server. This behavior is uncommon in legitimate enterprise usage and warrants investigation.
• Windows Process Accessing IronLanguages Repository On GitHub: The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines. Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads. This activity is uncommon in typical enterprise environments outside of software development contexts.