Threat video1:00
StrikeStub ClickFix RAT Loader: Detection & IOCs
StrikeStub drops through a fake ClickFix verification lure and adds hidden VNC and keylogging. 9 detection rules, 14 IOCs and a free Splunk SPL rule.
Read the full threat intel for StrikeStub ClickFix RAT Loader: Detection & IOCs →
Chapters
- 0:00The hookA fake check.
- 0:04The storyAkamai documented it on a compromised site.
- 0:10Attack pathHidden PowerShell downloads a loader.
- 0:24AttributionNo threat actor is attributed.
- 0:28Indicators of compromise12 indicators to hunt: 2 domains, 2 URLs and 1 SHA-256 hash, and more.
- 0:37MITRE ATT&CK techniques17 ATT&CK techniques, from execution to command and control.
- 0:42Remediation4 steps now: Block squidscript[.]com and spiraldirect[.]ch at DNS, proxy and web gateway.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00A fake check. 17 mapped techniques.
0:05Akamai documented it on a compromised site.
0:11Hidden PowerShell downloads a loader.
0:13It poses as a Windows component.
0:15It logs keystrokes, opens VNC, captures screens.
0:19Then it steals browser credentials.
0:24No threat actor is attributed. Confidence: low.
0:2912 indicators to hunt: 2 domains, 2 URLs and 1 SHA-256 hash, and more.
0:3717 ATT&CK techniques, from execution to command and control.
0:424 steps now: Block squidscript[.]com and spiraldirect[.]ch at DNS, proxy and web gateway.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.