{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "ClickFix lures are highly effective at bypassing MFA by stealing established browser sessions. Detecting the initial terminal execution and the resulting cookie file access is essential to stop the attack before it escalates to full BEC." }, "name": "ClickFix Shell Execution and Cookie Theft", "type": "investigation", "labels": [ "hunt", "attack.t1204.002", "attack.t1059.004", "attack.t1539", "credential access", "execution", "impact", "initial access", "persistence" ], "series": { "slug": "clickfix-to-bec-in-24-hours-tragic-quadrant-huntress", "index": 1, "title": "ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress", "total": 2 }, "related": [ { "hunt": "session-hijack-mfa-bypass", "reason": "This hunt detects the initial theft; session-hijack monitors for the subsequent misuse of those cookies.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "This is a hunt because a single rule for curl execution is too noisy for many environments; this playbook adds value by correlating execution rarity with specific unauthorized file access on macOS, requiring an analyst to weigh the temporal context.", "coverage": [ { "stage": "click-fix-terminal-execution", "steps": [ "shell-curl-patterns", "rare-shell-commands" ], "status": "covered" }, { "stage": "browser-session-cookie-theft", "steps": [ "cookie-file-access" ], "status": "covered" }, { "stage": "session-hijack-mfa-bypass", "reason": "Belongs to another part of the 'ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress' series.", "status": "out_of_scope" }, { "stage": "hidden-inbox-rule-persistence", "reason": "Belongs to another part of the 'ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress' series.", "status": "out_of_scope" }, { "stage": "bec-invoice-manipulation-impact", "reason": "Belongs to another part of the 'ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "ClickFix Social Engineering Execution", "slug": "click-fix-terminal-execution", "tactic": "execution", "techniques": [ "T1204.002", "T1059.004" ], "observables": [ "Terminal.app", "Command+Space", "curl", "Base64-encoded IP address in shell command" ] }, { "name": "Browser Session Cookie Theft", "slug": "browser-session-cookie-theft", "tactic": "credential-access", "techniques": [ "T1539" ], "observables": [ "Microsoft 365 session cookie", "Access to browser cookie storage files" ] }, { "name": "Session Hijacking and MFA Bypass", "slug": "session-hijack-mfa-bypass", "tactic": "initial-access", "techniques": [ "T1133", "T1550.004" ], "observables": [ "Two browsers active in one session", "Two different operating systems for the same login", "Traffic routed through a VPN", "Sign-in without password or MFA prompt" ] }, { "name": "Persistence via Hidden Inbox Rule", "slug": "hidden-inbox-rule-persistence", "tactic": "persistence", "techniques": [ "T1137.005" ], "observables": [ "Inbox rule named '..'", "Rule set to archive messages containing invoice numbers" ] }, { "name": "Business Email Compromise Impact", "slug": "bec-invoice-manipulation-impact", "tactic": "impact", "techniques": [ "T1565.002" ], "observables": [ "Replies to Treasury emails", "Modified routing numbers for payments", "Deletion of sent messages", "Emptying of trash/deleted items folder" ] } ], "summary": "A user seeking AI assistance was targeted by a ClickFix social engineering attack that induced them to execute a malicious shell command via Terminal. This command stole a Microsoft 365 session cookie, enabling the attacker to bypass MFA, gain unauthorized inbox access, and perform mailbox manipulation to redirect invoice payments in a Business Email Compromise (BEC) scenario." }, "severity": "medium", "rationale": "The hunt targets macOS hosts. It begins with a lead query identifying suspicious shell execution; the results of this first step should be used to populate the scope_hosts parameter for the subsequent parallel queries to reduce noise and resource consumption.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has used a social engineering lure to trick a macOS user into executing a malicious shell command in Terminal that steals browser session cookies for account takeover.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "The list of hostnames identified in the lead query; if left empty, the hunt runs across the entire estate." }, "lookback_days": { "from": { "ref": "standard-retention", "kind": "manual", "observed": "2024-10-24" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/clickfix-bec-tragic-quadrant-doris", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/clickfix-bec-tragic-quadrant-doris", "name": "Huntress \u2014 ClickFix to BEC in 24 Hours: Tragic Quadrant" } ], "blind_spots": [ { "id": "missing-process-telemetry", "risk": "Without full command-line arguments, the specific ClickFix pattern cannot be distinguished from normal shell usage.", "stage": "click-fix-terminal-execution", "question": "whether the curl command contained the base64 string", "requires": "hb_process_activity with full process_cmd_line" }, { "id": "ephemeral-file-access", "risk": "If the attacker uses a method that is not captured as a standard file read event (e.g., specific memory mapping techniques), the exfiltration may be missed.", "stage": "browser-session-cookie-theft", "question": "whether the shell process successfully read the cookie file", "requires": "hb_file_activity with high-frequency capture" } ] }, "name": "ClickFix Shell Execution and Cookie Theft", "description": "This hunt targets the initial endpoint stages of a ClickFix-style attack on macOS. It lead with a scoping query to identify hosts running shell interpreters with curl and base64 encoding. It then corroborates these leads by identifying rare command strings and unauthorized access to browser cookie databases, including Safari and Chromium-based paths, specifically on the suspect hosts. An agent weighs the combined evidence to identify successful session theft, ensuring that the file exfiltration occurred after the suspicious command execution." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "clickfix-to-bec-in-24-hours-tragic-quadrant-huntress", "index": 1, "title": "ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress", "total": 2 }, "coverage": [ { "stage": "click-fix-terminal-execution", "steps": [ "shell-curl-patterns", "rare-shell-commands" ], "status": "covered" }, { "stage": "browser-session-cookie-theft", "steps": [ "cookie-file-access" ], "status": "covered" }, { "stage": "session-hijack-mfa-bypass", "reason": "Belongs to another part of the 'ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress' series.", "status": "out_of_scope" }, { "stage": "hidden-inbox-rule-persistence", "reason": "Belongs to another part of the 'ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress' series.", "status": "out_of_scope" }, { "stage": "bec-invoice-manipulation-impact", "reason": "Belongs to another part of the 'ClickFix to BEC in 24 Hours: Tragic Quadrant | Huntress' series.", "status": "out_of_scope" } ], "rationale": "An intruder has used a social engineering lure to trick a macOS user into executing a malicious shell command in Terminal that steals browser session cookies for account takeover.", "blind_spots": [ { "id": "missing-process-telemetry", "risk": "Without full command-line arguments, the specific ClickFix pattern cannot be distinguished from normal shell usage.", "stage": "click-fix-terminal-execution", "question": "whether the curl command contained the base64 string", "requires": "hb_process_activity with full process_cmd_line" }, { "id": "ephemeral-file-access", "risk": "If the attacker uses a method that is not captured as a standard file read event (e.g., specific memory mapping techniques), the exfiltration may be missed.", "stage": "browser-session-cookie-theft", "question": "whether the shell process successfully read the cookie file", "requires": "hb_file_activity with high-frequency capture" } ], "scoping_notes": "The hunt targets macOS hosts. It begins with a lead query identifying suspicious shell execution; the results of this first step should be used to populate the scope_hosts parameter for the subsequent parallel queries to reduce noise and resource consumption.", "beyond_detection": "This is a hunt because a single rule for curl execution is too noisy for many environments; this playbook adds value by correlating execution rarity with specific unauthorized file access on macOS, requiring an analyst to weigh the temporal context." } }, { "id": "shell-curl-patterns", "type": "query", "label": "Shell interpreters running curl and base64", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%/sh' OR LOWER(process_name) LIKE '%/bash' OR LOWER(process_name) LIKE '%/zsh') AND LOWER(process_cmd_line) LIKE '%curl%' AND LOWER(process_cmd_line) LIKE '%base64%' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify hosts running the specific ClickFix pattern of shell interpreters executing curl with base64 payloads to serve as the suspect list for the hunt.", "expected_signal": "Hosts running encoded curl commands in Terminal. If zero rows are returned, no hosts are currently suspected of this ClickFix variant." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Shell interpreters running curl and base64", "reads": [ "device_hostname", "process_name", "process_cmd_line", "user_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%/sh' OR LOWER(process_name) LIKE '%/bash' OR LOWER(process_name) LIKE '%/zsh') AND LOWER(process_cmd_line) LIKE '%curl%' AND LOWER(process_cmd_line) LIKE '%base64%' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "Hosts running encoded curl commands in Terminal. If zero rows are returned, no hosts are currently suspected of this ClickFix variant.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "rare-shell-commands", "type": "query", "label": "Rare shell commands with encoding", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%/sh' OR LOWER(process_name) LIKE '%/bash' OR LOWER(process_name) LIKE '%/zsh') AND LOWER(process_cmd_line) LIKE '%base64%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY LOWER(process_cmd_line) HAVING host_count <= 3 ORDER BY host_count ASC", "surface": "hb_process_activity", "description": "Identify unique shell payloads across suspect hosts to separate targeted ClickFix attacks from standard administrative activity.", "expected_signal": "Specific payload strings seen only on one or two suspected hosts." }, "parents": [ { "id": "shell-curl-patterns" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare shell commands with encoding", "reads": [ "process_cmd_line", "device_hostname", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%/sh' OR LOWER(process_name) LIKE '%/bash' OR LOWER(process_name) LIKE '%/zsh') AND LOWER(process_cmd_line) LIKE '%base64%' AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY LOWER(process_cmd_line) HAVING host_count <= 3 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Specific payload strings seen only on one or two suspected hosts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "cmd" ], "rare_below": 3 }, "verified_at": "2026-10-15" } }, { "id": "cookie-file-access", "type": "query", "label": "Non-browser access to cookie files", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, process_name, file_path, activity_name, time FROM hb_file_activity WHERE (instr(LOWER(file_path), 'library/application support/google/chrome/') > 0 OR instr(LOWER(file_path), 'library/application support/microsoft edge/') > 0 OR instr(LOWER(file_path), 'library/cookies/') > 0 OR LOWER(file_path) LIKE '%cookies.binarycookies%') AND (LOWER(file_path) LIKE '%cookies%' OR LOWER(file_path) LIKE '%login data%' OR LOWER(file_path) LIKE '%cookies.binarycookies%') AND (LOWER(process_name) LIKE '%sh' OR LOWER(process_name) LIKE '%bash' OR LOWER(process_name) LIKE '%zsh' OR LOWER(process_name) LIKE '%curl') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "surface": "hb_file_activity", "description": "Identify when shell interpreters or curl access browser cookie storage files on suspect hosts, indicating successful theft.", "expected_signal": "A shell or curl process reading a cookie database for Chrome, Edge, or Safari." }, "parents": [ { "id": "shell-curl-patterns" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Non-browser access to cookie files", "reads": [ "device_hostname", "process_name", "file_path", "activity_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, file_path, activity_name, time FROM hb_file_activity WHERE (instr(LOWER(file_path), 'library/application support/google/chrome/') > 0 OR instr(LOWER(file_path), 'library/application support/microsoft edge/') > 0 OR instr(LOWER(file_path), 'library/cookies/') > 0 OR LOWER(file_path) LIKE '%cookies.binarycookies%') AND (LOWER(file_path) LIKE '%cookies%' OR LOWER(file_path) LIKE '%login data%' OR LOWER(file_path) LIKE '%cookies.binarycookies%') AND (LOWER(process_name) LIKE '%sh' OR LOWER(process_name) LIKE '%bash' OR LOWER(process_name) LIKE '%zsh' OR LOWER(process_name) LIKE '%curl') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)", "silence": "not_evidence_of_absence", "expected": "A shell or curl process reading a cookie database for Chrome, Edge, or Safari.", "verified": "dry-run", "verified_at": "2026-10-15" } }, { "id": "triage-endpoint-activity", "type": "analytic", "label": "Triage endpoint activity", "config": { "cite": "required", "tools": [ "endpoint" ], "context": [ "shell-curl-patterns", "rare-shell-commands", "cookie-file-access" ], "objective": "Determine if the shell execution (shell-curl-patterns) and the cookie database access (cookie-file-access) indicate a successful ClickFix session theft on any host, prioritizing rare commands and requiring that the file access occurred after the shell command ran.", "description": "Analyze the suspect shell execution and subsequent file access to confirm session theft.", "max_iterations": 4, "expected_signal": "A per-host verdict citing specific malicious commands and subsequent cookie access events.", "success_criteria": "A verdict of malicious | suspicious | benign per host, citing relevant command lines and temporal correlation with file paths." }, "parents": [ { "id": "rare-shell-commands", "kind": "merge" }, { "id": "cookie-file-access", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host", "condition": "the triage verdict is malicious for at least one host", "blind_spot": "missing-process-telemetry", "confidence": "high", "description": "Direct results toward containment or analyst review based on the triage.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-endpoint-activity" } ] }, { "id": "contain-host", "type": "action", "label": "Isolate host and revoke sessions", "config": { "target": "endpoint", "description": "Prevent the attacker from utilizing stolen session cookies for BEC.", "instructions": "Isolate the host via the EDR. Revoke all active Microsoft 365 sessions for the affected user to invalidate any stolen session cookies.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-manual-review", "type": "task", "label": "Analyst forensic review", "config": { "assignee": "analyst", "description": "Confirm the entry point and the malicious lure.", "instructions": "Examine the host browser history to find the AI platform or GPT link that delivered the lure. Document any discovered C2 IPs from the shell command analysis." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "contain-host" } ] }, { "id": "close-out-hunt", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Finalize records and submit new indicators.", "instructions": "Record confirmed hostnames and user accounts. Submit discovered indicators for internal blocklisting." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-manual-review" } ] } ] }