Threat video1:00
DuskDesk RAT in ClickFix Chains: Detection & IOCs
Fake CAPTCHA pages make users paste PowerShell that hides payloads in PNG pixels. 9 detection rules, 41 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for DuskDesk RAT in ClickFix Chains: Detection & IOCs →
Chapters
- 0:00The hookSome pasted commands reached domain controllers.
- 0:04The storyEarly September, a paste reached a domain controller.
- 0:11Attack pathFake pages trick victims into pasting commands.
- 0:26AttributionNo threat actor is attributed.
- 0:31Indicators of compromise32 indicators to hunt: 5 IPs, 6 domains and 2 URLs, and more.
- 0:38MITRE ATT&CK techniques25 ATT&CK techniques, from resource development to lateral movement.
- 0:43Remediation4 steps now: Block the listed domains and IPs.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Some pasted commands reached domain controllers.
0:05Early September, a paste reached a domain controller.
0:08Huntress documented it.
0:11Fake pages trick victims into pasting commands.
0:14Executables hide in image pixels.
0:17Scheduled tasks keep them alive.
0:19Operators reach a domain controller.
0:22Malware spreads across admin shares.
0:27No threat actor is attributed. Confidence: low.
0:3132 indicators to hunt: 5 IPs, 6 domains and 2 URLs, and more.
0:3825 ATT&CK techniques, from resource development to lateral movement.
0:444 steps now: Block the listed domains and IPs.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.