--- analysis: While a rule might flag on_disk=0, this hunt correlates a script-driven staging phase with a rare binary sideload and follow-on injection across four telemetry surfaces. This phased context allows an analyst to confirm a coordinated campaign rather than a single administrative anomaly. blind_spots: - id: transient-hollowing-state owner: Detection Engineering question: whether a hollowed process ran and terminated between collection intervals remediation: Enable Sysmon Event ID 1 (Process Create) and Event ID 10 (Process Access) to monitor for CREATE_SUSPENDED patterns in real-time. requires: Event-based process monitoring for NtUnmapViewOfSection risk: A snapshot-based process check will miss hollowing if the process terminates before the next collection cycle; an ephemeral infostealer could steal credentials and exit unnoticed. stage: process-hollowing-servicemodelreg - id: no-script-block-logging owner: IT Operations question: the full de-obfuscated content of the ClickFix staging script remediation: Enable PowerShell Script Block Logging via GPO for all Windows endpoints. requires: PowerShell Script Block Logging (Event ID 4104) risk: If obfuscation is high and script block logging is disabled, the script-activity query will fail to find the hex flags even if the script executes successfully. stage: clickfix-powershell-staging coverage: - stage: clickfix-powershell-staging status: covered steps: - detect-staging-scripts - stage: mscoree-dll-sideloading status: covered steps: - detect-sideload-events - stage: edr-disablement-byovd status: covered steps: - detect-byovd-files - stage: process-hollowing-servicemodelreg status: covered steps: - detect-hollowed-infostealer - reason: The infostealer execution is identified by the hollowing detection on the target process. stage: remus-infostealer-collection status: covered steps: - detect-hollowed-infostealer guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: The ClickFix campaign abuses signed Microsoft binaries and native OS functionality to bypass traditional application controls; a negative result across the estate confirms that this specific sequence of sideloading and injection is not established. methodology: model-assisted trigger: intel-report hypothesis: An adversary has deployed a ClickFix script to sideload a malicious library into a signed Microsoft binary, followed by hollowing a system process to run an infostealer and using a BYOVD driver to blind endpoint security. labels: - hunt - attack.t1055.012 - attack.t1059.001 - attack.t1555 - attack.t1574.002 name: ClickFix DLL Sideloading and Infostealer Injection parameters: creation_flags: default: '0x8000004' description: Hexadecimal flags for suspended process creation (CREATE_SUSPENDED | CREATE_NO_WINDOW). from: kind: article observed: '2026-08-28' ref: elastic-security-labs type: string hollowing_target: default: - servicemodelreg.exe description: Process names targeted for hollowing. from: kind: article observed: '2026-08-28' ref: elastic-security-labs type: list[string] lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2024-01-01' ref: standard-hunt-policy type: number scope_hosts: default: [] description: Specific hostnames to narrow the hunt. from: kind: manual observed: '2024-01-01' ref: analyst-scoping type: list[host] target_dlls: default: - mscoree.dll description: Commonly hijacked library names. from: kind: article observed: '2026-08-28' ref: elastic-security-labs type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.elastic.co/security-labs/threat-command/dll-search-order-hijacking-elastic-defend gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: Focus on Windows endpoints containing .NET 7.0 runtimes or Microsoft keyword upgrade tools. The lookback period should capture the progression from the initial ClickFix lure to full infostealer deployment. references: - name: "Elastic Security Labs \u2014 From 88 lines to 1: Detecting DLL hijacking\ \ with Elastic Defend" url: https://www.elastic.co/security-labs/threat-command/dll-search-order-hijacking-elastic-defend related: - hunt: credential-theft-browser-database-access reason: This hunt focuses on the execution chain; monitoring file access to browser profile paths for credential theft is a separate behavioral signal. relation: out-of-scope-alternative scenario: stages: - name: ClickFix PowerShell Staging observables: - powershell.exe - -enc - EncodedCommand slug: clickfix-powershell-staging tactic: execution techniques: - T1059.001 - name: DLL Sideloading of mscoree.dll observables: - vb7to8.exe - mscoree.dll - 'dll.Ext.defense_evasions: "DLL Hijack: Masquerading"' slug: mscoree-dll-sideloading tactic: defense-evasion techniques: - T1574.002 - name: EDR Disablement via BYOVD observables: - vulnerable driver - Elastic Endpoint slug: edr-disablement-byovd tactic: defense-evasion - name: Process Hollowing of ServiceModelReg.exe observables: - ServiceModelReg.exe - '0x8000004' - CREATE_SUSPENDED - CREATE_NO_WINDOW - ZwUnmapViewOfSection - NtUnmapViewOfSection slug: process-hollowing-servicemodelreg tactic: defense-evasion techniques: - T1055.012 - name: Remus Infostealer Execution observables: - Remus slug: remus-infostealer-collection tactic: credential-access techniques: - T1555 summary: The ClickFix campaign utilizes PowerShell to deploy a legitimate Microsoft utility (vb7to8.exe) along with a malicious sideloaded DLL (mscoree.dll) to achieve initial execution. Once active, the loader employs a vulnerable driver to disable EDR defenses and performs process hollowing on ServiceModelReg.exe to deploy the Remus infostealer. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # ClickFix DLL Sideloading and Infostealer Injection This hunt identifies a multi-stage infection chain starting with PowerShell script staging and mscoree.dll search-order hijacking. It then pivots to monitor for the subsequent execution of the Remus infostealer inside a hollowed ServiceModelReg.exe process and the deployment of malicious drivers designed to disable EDR products. The hunt follows the phased flow: first establishing the initial access and persistence leads via module loads and script block telemetry, then correlating these with evidence of active in-memory injection and defense evasion. This approach distinguishes targeted binary abuse from legitimate system administration by verifying the presence of the entire attack sequence. ## scope-targeted-software Identify hosts that have software often targeted for sideloading to focus the search. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hosts containing Microsoft utilities like vb7to8.exe. Silence indicates the tool is not managed by standard package managers but does not prove its absence as a standalone binary. reads: - device_hostname - package_name - vendor_name silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, package_name, vendor_name, package_version FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%visual basic%' OR LOWER(package_name) LIKE '%upgrade tool%') AND LOWER(vendor_name) LIKE '%microsoft%' ``` ## parallel-early-phase parallel: - → detect-sideload-events - → detect-staging-scripts join: → agent-early-triage ## detect-sideload-events Find search-order hijacking where mscoree.dll is loaded from a path that is not Windows\System32. ```sqlite target=endpoint role=baseline params=(target_dlls=target_dlls, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A module load for a system library name from an unusual directory. Rare paths seen on few hosts are high-confidence indicators. prevalence: by: device_hostname key: - module_path rare_below: 3 reads: - device_hostname - process_name - module_name - module_path - time silence: not_evidence_of_absence source: hb_module_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, process_name, module_name, module_path, COUNT(DISTINCT device_hostname) as host_count, MIN(time) as first_seen FROM hb_module_activity WHERE instr(',' || '{{target_dlls}}' || ',', ',' || LOWER(module_name) || ',') > 0 AND LOWER(module_path) NOT LIKE 'c:\windows\system32\%' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, module_name, module_path HAVING host_count <= 3 ``` ## detect-staging-scripts Identify PowerShell execution that stages binaries and prepares for process hollowing using specific API flags. ```sqlite target=endpoint role=enrichment params=(creation_flags=creation_flags, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Script blocks containing the 0x8000004 flag. Silence suggests the staging used different obfuscation or occurred outside the lookback. reads: - device_hostname - script_content - script_path - time silence: not_evidence_of_absence source: hb_script_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, script_path, script_content, time FROM hb_script_activity WHERE instr(LOWER(script_content), LOWER('{{creation_flags}}')) > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## agent-early-triage ```agent target=hunter cite: required context: - detect-sideload-events - detect-staging-scripts max_iterations: 3 objective: Determine if mscoree.dll sideloading and suspended process flags in PowerShell indicate a coordinated ClickFix staging event on any host. success_criteria: A verdict of malicious | suspicious | benign for every host found in the early queries. tools: - endpoint ``` ## parallel-follow-on-phase parallel: - → detect-hollowed-infostealer - → detect-byovd-files join: → agent-follow-on-triage ## detect-hollowed-infostealer Identify the infostealer running inside a hollowed ServiceModelReg.exe process by checking for missing disk images. ```sqlite target=endpoint role=detection-candidate params=(hollowing_target=hollowing_target, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Rows where ServiceModelReg.exe is running but the binary is missing from disk, a definitive sign of in-memory injection. reads: - device_hostname - process_name - process_cmd_line - on_disk - time silence: evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, process_name, process_cmd_line, on_disk, time FROM hb_process_activity WHERE instr(',' || '{{hollowing_target}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND on_disk = 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## detect-byovd-files Identify the driver dropped to disable endpoint security, typically placed in user-writable paths. ```sqlite target=endpoint role=enrichment params=(scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Creation of driver files in non-system paths. This is unusual behavior for legitimate software installers. reads: - device_hostname - file_name - file_path - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, file_name, file_path, time FROM hb_file_activity WHERE LOWER(file_name) LIKE '%.sys' AND (LOWER(file_path) LIKE '%\temp\%' OR LOWER(file_path) LIKE '%\users\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## agent-follow-on-triage ```agent target=hunter cite: required context: - agent-early-triage - detect-hollowed-infostealer - detect-byovd-files max_iterations: 5 objective: Review the early staging verdict alongside process hollowing and driver deployment to confirm a successful infostealer infection. success_criteria: A final verdict of malicious | suspicious | benign per host, citing the full chain of evidence. tools: - endpoint ``` ## route-on-verdict if~: "The follow-on agent verdict is malicious for at least one host, indicating a confirmed injection sequence following a sideloading lead." (confidence: high, judge=hunter) then: → isolate-endpoint indeterminate: → forensic-investigation unavailable: → forensic-investigation (blind_spot: transient-hollowing-state) else: → remediation-cleanup ## isolate-endpoint ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host from the network. Collect a memory dump of ServiceModelReg.exe before terminating the process. ``` → forensic-investigation ## forensic-investigation ```manual target=analyst Extract the malicious mscoree.dll from the execution directory and dump the memory of the ServiceModelReg.exe process. Verify if EDR services were effectively blinded on the host. ``` → remediation-cleanup ## remediation-cleanup ```manual target=analyst Re-image confirmed compromised hosts. Promote the detection of ServiceModelReg.exe running with on_disk=0 to a permanent detection rule. ``` → end