{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "ClickFix is a high-confidence indicator of active social engineering that circumvents traditional perimeter security. A negative result across the estate confirms that no managed hosts have successfully executed these lures." }, "name": "ClickFix Redirection and Script Execution", "type": "investigation", "labels": [ "hunt", "attack.t1566.002", "attack.t1059.001", "attack.t1115", "attack.t1105", "command and control", "defense evasion", "execution", "initial access", "persistence" ], "series": { "slug": "beyond-the-clipboard-the-evolving-tradecraft-of-clickfix", "index": 1, "title": "Beyond the clipboard: The evolving tradecraft of ClickFix", "total": 2 }, "related": [ { "hunt": "persistence-staging-scripts", "reason": "This hunt focuses on the initial redirection and PowerShell execution; the follow-on batch scripts and scheduled tasks for persistence are handled in a separate hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single rule on Get-Clipboard is too broad for production. This hunt uses a prevalence-based baseline to isolate rare commands and corroborates them with DNS resolutions to malvertising domains and specific file drops, providing the necessary context for an analyst to act.", "coverage": [ { "stage": "initial-access-clickfix-lure", "steps": [ "lure-domain-activity" ], "status": "covered" }, { "stage": "execution-clipboard-powershell", "steps": [ "rare-clipboard-powershell", "clickfix-file-drops" ], "status": "covered" }, { "stage": "persistence-staging-scripts", "reason": "Belongs to another part of the 'Beyond the clipboard: The evolving tradecraft of ClickFix' series.", "status": "out_of_scope" }, { "stage": "evasion-dll-sideloading", "reason": "Belongs to another part of the 'Beyond the clipboard: The evolving tradecraft of ClickFix' series.", "status": "out_of_scope" }, { "stage": "c2-reverse-tunneling", "reason": "Belongs to another part of the 'Beyond the clipboard: The evolving tradecraft of ClickFix' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "ClickFix Web Redirection", "slug": "initial-access-clickfix-lure", "tactic": "initial-access", "techniques": [ "T1566.002" ], "observables": [ "vvestalw.ghost.io", "westlaw-signon.com", "apirequestaccess.com", "moziw.com", "http://apirequestaccess.com/cfirm.php?token=" ] }, { "name": "Clipboard-based PowerShell Execution", "slug": "execution-clipboard-powershell", "tactic": "execution", "techniques": [ "T1059.001", "T1115" ], "observables": [ "powershell.exe", "Get-Clipboard", "6341434163416441.txt", "cf_verify.zip" ] }, { "name": "Persistence via Tasks and Run Keys", "slug": "persistence-staging-scripts", "tactic": "persistence", "techniques": [ "T1053.005", "T1547.001" ], "observables": [ "1.bat", "C:\\ProgramData\\f8f33b09aed97a47\\", "C:\\ProgramData\\7168f7f870a45fbb\\", "CertEnrollCtrl_Y0db6oZq9", "LockScreenContentServer_qQrRrJiHX", "DuskDesk", "SysyService" ] }, { "name": "DLL Sideloading", "slug": "evasion-dll-sideloading", "tactic": "defence-evasion", "techniques": [ "T1574.002" ], "observables": [ "CertEnrollCtrl.exe", "CertEnroll.dll", "LockScreenContentServer.exe", "dui70.dll" ] }, { "name": "Reverse Tunnel and C2", "slug": "c2-reverse-tunneling", "tactic": "command-and-control", "techniques": [ "T1572" ], "observables": [ "C:\\ProgramData\\ShService\\r.ps1", "23.227.199.41", "167.148.201.104", "node.exe", "LimeMint.js", "launch.js" ] } ], "summary": "Threat actors use SEO poisoning and malvertising to lure users to fake verification pages (ClickFix) that trick them into executing malicious PowerShell commands from their clipboard. These commands download multi-stage payloads that establish persistence through scheduled tasks and Run keys, eventually deploying DLL sideloading chains for reverse SSH tunnels or Node.js-based RATs." }, "severity": "high", "rationale": "The hunt begins by identifying the most likely targets\u2014hosts with web browsers or Node.js\u2014using software inventory, then searches for DNS and execution telemetry specifically on those hosts.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has lured users to a malicious site that tricks them into pasting a PowerShell command from the clipboard, which then executes and stages a malicious payload.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optionally narrow the hunt to specific hosts; leave empty to use the results of the scoping step." }, "lure_domains": { "from": { "ref": "https://www.huntress.com/blog/the-evolving-tradecraft-of-clickfix", "kind": "article", "observed": "2026-11-10" }, "type": "list[domain]", "default": [ "vvestalw.ghost.io", "westlaw-signon.com", "apirequestaccess.com", "moziw.com" ], "description": "ClickFix lure and redirection domains identified in the research." }, "lookback_days": { "from": { "ref": "standard-lookback", "kind": "manual", "observed": "2026-11-10" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/the-evolving-tradecraft-of-clickfix", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/the-evolving-tradecraft-of-clickfix", "name": "Huntress \u2014 The evolving tradecraft of ClickFix" } ], "blind_spots": [ { "id": "endpoint-visibility-gap", "risk": "Attackers targeting users via personal devices or unmanaged hosts will not be seen by hb_dns_activity or hb_process_activity.", "stage": "initial-access-clickfix-lure", "question": "whether social engineering occurred on unmanaged or BYOD devices", "requires": "Complete endpoint agent coverage across all workstations" }, { "id": "dns-over-https", "risk": "Modern browsers using DoH bypass traditional system-level DNS logging, making lure domain resolutions invisible to hb_dns_activity.", "stage": "initial-access-clickfix-lure", "question": "whether lure domains were resolved via DNS-over-HTTPS (DoH)", "requires": "Browser extension or proxy-level logging of HTTPS traffic" }, { "id": "clipboard-memory-only", "risk": "Telemetry shows the command that *reads* the clipboard, but if the user has already cleared or replaced the clipboard, the malicious data is lost for forensic analysis.", "stage": "execution-clipboard-powershell", "question": "the original contents of the clipboard before it was used by PowerShell", "requires": "Real-time clipboard monitoring" } ] }, "name": "ClickFix Redirection and Script Execution", "description": "ClickFix represents a refined social engineering attack where malicious sites mimic legitimate verification checks or document tools. This hunt identifies the initial access vector by finding DNS requests to known lure domains and corroborates these with rare PowerShell executions involving clipboard operations and file staging evidence. An agent evaluates the chain of redirection and execution to identify successful social engineering completions." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "beyond-the-clipboard-the-evolving-tradecraft-of-clickfix", "index": 1, "title": "Beyond the clipboard: The evolving tradecraft of ClickFix", "total": 2 }, "coverage": [ { "stage": "initial-access-clickfix-lure", "steps": [ "lure-domain-activity" ], "status": "covered" }, { "stage": "execution-clipboard-powershell", "steps": [ "rare-clipboard-powershell", "clickfix-file-drops" ], "status": "covered" }, { "stage": "persistence-staging-scripts", "reason": "Belongs to another part of the 'Beyond the clipboard: The evolving tradecraft of ClickFix' series.", "status": "out_of_scope" }, { "stage": "evasion-dll-sideloading", "reason": "Belongs to another part of the 'Beyond the clipboard: The evolving tradecraft of ClickFix' series.", "status": "out_of_scope" }, { "stage": "c2-reverse-tunneling", "reason": "Belongs to another part of the 'Beyond the clipboard: The evolving tradecraft of ClickFix' series.", "status": "out_of_scope" } ], "rationale": "An adversary has lured users to a malicious site that tricks them into pasting a PowerShell command from the clipboard, which then executes and stages a malicious payload.", "blind_spots": [ { "id": "endpoint-visibility-gap", "risk": "Attackers targeting users via personal devices or unmanaged hosts will not be seen by hb_dns_activity or hb_process_activity.", "stage": "initial-access-clickfix-lure", "question": "whether social engineering occurred on unmanaged or BYOD devices", "requires": "Complete endpoint agent coverage across all workstations" }, { "id": "dns-over-https", "risk": "Modern browsers using DoH bypass traditional system-level DNS logging, making lure domain resolutions invisible to hb_dns_activity.", "stage": "initial-access-clickfix-lure", "question": "whether lure domains were resolved via DNS-over-HTTPS (DoH)", "requires": "Browser extension or proxy-level logging of HTTPS traffic" }, { "id": "clipboard-memory-only", "risk": "Telemetry shows the command that *reads* the clipboard, but if the user has already cleared or replaced the clipboard, the malicious data is lost for forensic analysis.", "stage": "execution-clipboard-powershell", "question": "the original contents of the clipboard before it was used by PowerShell", "requires": "Real-time clipboard monitoring" } ], "scoping_notes": "The hunt begins by identifying the most likely targets\u2014hosts with web browsers or Node.js\u2014using software inventory, then searches for DNS and execution telemetry specifically on those hosts.", "beyond_detection": "A single rule on Get-Clipboard is too broad for production. This hunt uses a prevalence-based baseline to isolate rare commands and corroborates them with DNS resolutions to malvertising domains and specific file drops, providing the necessary context for an analyst to act." } }, { "id": "scope-vulnerable-workstations", "type": "query", "label": "Scope to hosts with web browsers or Node.js", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%chrome%' OR LOWER(package_name) LIKE '%edge%' OR LOWER(package_name) LIKE '%firefox%' OR LOWER(package_name) LIKE '%safari%' OR LOWER(package_name) LIKE '%node.js%')", "surface": "hb_software_inventory", "description": "Identify hosts that possess the primary attack surface (web browsers) or specific runtimes (Node.js) mentioned in the ClickFix campaigns.", "expected_signal": "A list of hosts currently running software that facilitates the ClickFix lure or payload execution." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope to hosts with web browsers or Node.js", "reads": [ "device_hostname", "package_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%chrome%' OR LOWER(package_name) LIKE '%edge%' OR LOWER(package_name) LIKE '%firefox%' OR LOWER(package_name) LIKE '%safari%' OR LOWER(package_name) LIKE '%node.js%')", "silence": "not_evidence_of_absence", "expected": "A list of hosts currently running software that facilitates the ClickFix lure or payload execution.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "lure-domain-activity", "type": "query", "label": "DNS lookups to lure domains", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{lure_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_dns_activity", "description": "Identify hosts that visited the malicious redirection domains.", "expected_signal": "Hosts resolving known malvertising or typosquatted domains associated with the ClickFix campaign." }, "parents": [ { "id": "scope-vulnerable-workstations" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "DNS lookups to lure domains", "reads": [ "device_hostname", "query_hostname", "process_name", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{lure_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Hosts resolving known malvertising or typosquatted domains associated with the ClickFix campaign.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "rare-clipboard-powershell", "type": "query", "label": "Rare PowerShell clipboard operations", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS executions, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%\\\\powershell.exe' OR LOWER(process_name) LIKE '%\\\\pwsh.exe') AND (LOWER(process_cmd_line) LIKE '%get-clipboard%' OR LOWER(process_cmd_line) LIKE '%6341434163416441%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cmd HAVING hosts <= 3 ORDER BY hosts ASC", "surface": "hb_process_activity", "description": "Detect PowerShell commands that interact with the clipboard or use specific hex strings found in ClickFix payloads, stack-counting to isolate rare behaviors.", "expected_signal": "Highly specific PowerShell commands used to retrieve and execute code from the user's clipboard. Typical administrator use of Get-Clipboard is expected to be more common than attacker scripts." }, "parents": [ { "id": "scope-vulnerable-workstations" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Rare PowerShell clipboard operations", "reads": [ "process_cmd_line", "device_hostname", "process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, COUNT(*) AS executions, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%\\\\powershell.exe' OR LOWER(process_name) LIKE '%\\\\pwsh.exe') AND (LOWER(process_cmd_line) LIKE '%get-clipboard%' OR LOWER(process_cmd_line) LIKE '%6341434163416441%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cmd HAVING hosts <= 3 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Highly specific PowerShell commands used to retrieve and execute code from the user's clipboard. Typical administrator use of Get-Clipboard is expected to be more common than attacker scripts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "cmd" ], "rare_below": 3 }, "verified_at": "2026-11-12" } }, { "id": "clickfix-file-drops", "type": "query", "label": "Creation of staged payloads", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%\\\\cf_verify.zip' OR LOWER(file_path) LIKE '%\\\\6341434163416441.txt') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Search for specific files created by ClickFix PowerShell stagers in temporary directories.", "expected_signal": "Creation of a ZIP archive or a temporary text file containing encoded PowerShell in directories like ProgramData or Temp." }, "parents": [ { "id": "scope-vulnerable-workstations" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Creation of staged payloads", "reads": [ "device_hostname", "file_path", "process_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_path, process_name, time FROM hb_file_activity WHERE (LOWER(file_path) LIKE '%\\\\cf_verify.zip' OR LOWER(file_path) LIKE '%\\\\6341434163416441.txt') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Creation of a ZIP archive or a temporary text file containing encoded PowerShell in directories like ProgramData or Temp.", "verified": "dry-run", "verified_at": "2026-11-12" } }, { "id": "triage-compromise", "type": "analytic", "label": "Assess ClickFix chain", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "lure-domain-activity", "rare-clipboard-powershell", "clickfix-file-drops" ], "objective": "Determine if any host resolved a lure domain and shortly after executed a PowerShell command retrieving data from the clipboard, specifically looking for those that also created the mentioned staging files.", "description": "Correlate lure site visits with subsequent clipboard execution and file staging to confirm a successful social engineering compromise.", "max_iterations": 5, "expected_signal": "A high-confidence verdict for hosts showing the full redirection-to-execution chain.", "success_criteria": "A per-host verdict of malicious, suspicious, or benign, citing specific DNS, process, and file rows." }, "parents": [ { "id": "lure-domain-activity", "kind": "merge" }, { "id": "rare-clipboard-powershell", "kind": "merge" }, { "id": "clickfix-file-drops", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-compromise verdict is malicious for at least one host", "condition": "the triage-compromise verdict is malicious for at least one host", "blind_spot": "endpoint-visibility-gap", "confidence": "high", "description": "Determine the next action based on the agent's assessment.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-compromise" } ] }, { "id": "isolate-compromised-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Halt the attack chain before the adversary establishes persistent C2 or moves laterally.", "instructions": "Isolate the host from the network immediately to prevent further payload execution or lateral movement.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-manual-review", "type": "task", "label": "Analyst manual review", "config": { "assignee": "analyst", "description": "Confirm the agent's findings and identify any follow-on activity such as DLL sideloading or persistence.", "instructions": "1. Review the rows cited by the triage agent. 2. Verify the browser history or DNS logs on the affected host for visits to the lure domains. 3. Check for the existence of the C:\\ProgramData\\ staging directories mentioned in the report. 4. If confirmed, pivot to investigating DLL sideloading (CertEnroll.dll) or reverse SSH tunnels (r.ps1)." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-compromised-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Finalize the hunt results and record lessons learned.", "instructions": "Document the investigation outcome. If the PowerShell prevalence query successfully identified an intrusion, consider promoting it to a permanent detection rule with tuning for legitimate administrative use." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-manual-review" } ] } ] }