Threat video1:00
PureBasic RAT in Fake Microsoft ClickFix: Detection & IOCs
A lookalike Microsoft login page tricks victims into pasting a command into the Run dialog. 9 detection rules, 26 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for PureBasic RAT in Fake Microsoft ClickFix: Detection & IOCs →
Chapters
- 0:00The hookClickFix targets Czech company
- 0:04The storyFake verify page tricks clipboard
- 0:10Attack pathVictim pastes command into Run
- 0:23AttributionNo threat actor is attributed.
- 0:27Indicators of compromise21 indicators to hunt: 2 IPs, 3 domains and 4 URLs, and more.
- 0:34MITRE ATT&CK techniques14 ATT&CK techniques, from execution to command and control.
- 0:39Remediation5 steps now: Block DNS and web access to microsoftofice[.]cz, login[.]microsoftofice[.]cz and kupujto[.]unas[.]cz.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00ClickFix targets Czech company
0:05Fake verify page tricks clipboard
0:07Downloads unnamed PureBasic RAT
0:11Victim pastes command into Run
0:13Downloads archive, hides persistence in Startup
0:16Beacons back to C2, executes commands
0:23No threat actor is attributed. Confidence: low.
0:2721 indicators to hunt: 2 IPs, 3 domains and 4 URLs, and more.
0:3414 ATT&CK techniques, from execution to command and control.
0:395 steps now: Block DNS and web access to microsoftofice[.]cz, login[.]microsoftofice[.]cz and kupujto[.]unas[.]cz.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.