SOCLIFE
SOCLIFE

Evidence-led security analysis

Published knowledge

Search SOC//LIFE

HuntsHUNT-002

Hypothesis-led threat hunting

Hunt for ClickFix Exposure Across Endpoints

Expands from patient-zero web activity and known infrastructure into execution, persistence, and wider-compromise behavior.

Question

Hunt goal

Determine whether other users or devices were exposed to the same ClickFix entry path, incident infrastructure, or post-compromise behavior.

Why this hunt

Patient zero shows how the attack entered one system. The next question is whether other people reached the same infrastructure, executed the same pattern, or already show persistence and follow-on activity.

Data sources

Where to look

  • NetworkWeb, proxy, and endpoint network activity with device, user, URL, referrer when available, remote address, process, action, and timestamp.
  • DNSDNS activity used to recover source-reported domains or local arrival infrastructure where web telemetry is incomplete.
  • RegistryRunMRU, startup persistence, and Defender configuration changes with device, user, key, value, data, process, and timestamp.
  • ProcessProcess execution covering the ClickFix chain, native retrieval, security-control changes, tunnels, and remote administration.
  • FileFile creation and execution context for HTA, MSI, executable, script, DLL, and hash pivots.

Search path

Hunt steps

Each search broadens the view from patient zero to related users, devices, infrastructure, and follow-on activity.
  1. Step 1First search

    Recover patient-zero web activity before Run execution

    Finding

    Huntress did not publish the compromised landing website. This first search derives the patient-zero execution time from RunMRU and attempts to recover preceding URL or referrer context from local web or proxy telemetry.

    The arrival URL is a high-value environment pivot when retained, but it must remain unknown rather than invented when telemetry is absent.

    View query
    Q-01First search

    Recover patient-zero web activity before Run execution

    What this checks

    Recover the URL, domain, or referrer visible immediately before suspicious RunMRU activity on NVV-EX-2123 without inventing the unpublished compromised website.

    KQL
    let patient_zero = "NVV-EX-2123";
    let run_events =
        DeviceRegistryEvents
        | where DeviceName =~ patient_zero
        | where RegistryKey endswith @"\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
        | where RegistryValueData has_any (
            "pcalua", "mshta", "powershell", "pwsh", "rundll32",
            "regsvr32", "wscript", "cscript", "curl", "certutil",
            "msiexec", "http://", "https://"
        )
        | project RunTime = Timestamp, DeviceId, DeviceName, RunCommand = RegistryValueData;
    DeviceNetworkEvents
    | join kind=inner run_events on DeviceId
    | where Timestamp between (RunTime - 15m .. RunTime)
    | project
        RunTime,
        Timestamp,
        DeviceName,
        RunCommand,
        InitiatingProcessFileName,
        InitiatingProcessCommandLine,
        RemoteUrl,
        RemoteIP,
        RemotePort
    | order by RunTime asc, Timestamp asc
    SPL
    | multisearch
        [ | tstats count
            from datamodel=Endpoint.Registry
            where Registry.dest="NVV-EX-2123"
              Registry.registry_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*"
            by _time Registry.dest Registry.user Registry.registry_value_data
          | rename Registry.dest as dest Registry.user as user Registry.registry_value_data as run_command
          | where match(lower(run_command),
              "(pcalua|mshta|powershell|pwsh|rundll32|regsvr32|wscript|cscript|curl|certutil|msiexec|https?://)")
          | eval stage="run"
        ]
        [ | tstats count values(Web.url) as urls values(Web.http_referrer) as referrers
            from datamodel=Web.Web
            where Web.src="NVV-EX-2123"
            by _time Web.src Web.user Web.url_domain Web.action
          | rename Web.src as dest Web.user as user Web.url_domain as url_domain Web.action as action
          | eval stage="web"
        ]
    | sort 0 dest - _time
    | streamstats current=f
        last(eval(if(stage="run", _time, null()))) as run_time
        last(eval(if(stage="run", run_command, null()))) as run_command
        by dest
    | where stage="web" AND isnotnull(run_time) AND _time<=run_time AND _time>=run_time-900
    | table run_time _time dest user run_command url_domain urls referrers action count
    | sort run_time _time
    What to look for

    A recoverable source URL, referrer, redirect, or domain that can be searched across all users and devices, with first seen, last seen, action, and execution context preserved.

    Technical details
    Tested signal

    Browser or web activity on patient zero during the fifteen minutes before a suspicious RunMRU event.

    Assumptions
    • RunMRU and endpoint network events share a stable device identifier and comparable timestamps.
    • A fifteen-minute lookback is a bounded investigative window that must be adapted locally.
    • Full source URL or referrer recovery may require proxy or web telemetry beyond endpoint network events.
    Data requirements and relevant fields
    registry

    Patient-zero RunMRU events used to derive the execution time from observed telemetry.

    • Timestamp
    • DeviceId
    • DeviceName
    • RegistryKey
    • RegistryValueData
    • InitiatingProcessAccountUpn
    network

    Preceding endpoint network or mapped proxy activity with destination, process, user, and timestamp context.

    • Timestamp
    • DeviceId
    • DeviceName
    • RemoteUrl
    • RemoteIP
    • RemotePort
    • InitiatingProcessFileName
    • InitiatingProcessCommandLine
    KQL schema

    DeviceNetworkEvents can recover preceding destinations but may not retain browser URL or referrer. Substitute mapped web or proxy telemetry where those fields are available.

    SPL schema

    Requires Registry and Web telemetry mapped to Splunk CIM. Web.http_referrer and full URL retention vary by source and must be confirmed locally.

    Limitations
    • DeviceNetworkEvents may show destinations without the full browser URL or referrer.
    • Absence of retained web telemetry does not weaken the documented ClickFix execution chain.
    • Nearby web activity must still be correlated with the user action and cannot be assumed causal.

    The KQL variant derives the lookback from RunMRU and endpoint network telemetry. The SPL variant uses CIM Registry and Web events; referrer and full URL fields require local mapping.

  2. Step 2Pivot

    Search source-reported incident infrastructure

    Finding

    The source intrusion reported four domains and two IP addresses that can be searched across web, DNS, proxy, and endpoint network telemetry.

    Each match identifies a user or device requiring endpoint correlation; no single IOC should be required across every host.

    View query
    Q-02Pivot

    Search source-reported incident infrastructure

    What this checks

    Find devices or users that contacted infrastructure publicly reported in the May 2026 Huntress intrusion.

    KQL
    let incident_domains = dynamic([
        "cl.distritovagas.com",
        "sonra.eutialyson.com",
        "anus-staylard.xyz",
        "resumeacceptable.com"
    ]);
    let incident_ips = dynamic([
        "77.110.122.58",
        "213.165.41.26"
    ]);
    DeviceNetworkEvents
    | where RemoteUrl has_any (incident_domains)
        or RemoteIP in (incident_ips)
    | project
        Timestamp,
        DeviceName,
        DeviceId,
        InitiatingProcessAccountUpn,
        InitiatingProcessFileName,
        InitiatingProcessCommandLine,
        RemoteUrl,
        RemoteIP,
        RemotePort
    | order by Timestamp asc
    SPL
    | multisearch
        [ | tstats count min(_time) as first_seen max(_time) as last_seen
            values(Web.url) as urls
            from datamodel=Web.Web
            where
                Web.url_domain="cl.distritovagas.com"
                OR Web.url_domain="sonra.eutialyson.com"
                OR Web.url_domain="anus-staylard.xyz"
                OR Web.url_domain="resumeacceptable.com"
            by Web.src Web.user Web.url_domain
          | rename
              Web.src as src
              Web.user as user
              Web.url_domain as indicator
          | eval indicator_type="domain"
        ]
        [ | tstats count min(_time) as first_seen max(_time) as last_seen
            from datamodel=Network_Traffic.All_Traffic
            where
                Network_Traffic.All_Traffic.dest_ip="77.110.122.58"
                OR Network_Traffic.All_Traffic.dest_ip="213.165.41.26"
            by Network_Traffic.All_Traffic.src
               Network_Traffic.All_Traffic.user
               Network_Traffic.All_Traffic.dest_ip
          | rename
              Network_Traffic.All_Traffic.src as src
              Network_Traffic.All_Traffic.user as user
              Network_Traffic.All_Traffic.dest_ip as indicator
          | eval indicator_type="ip"
        ]
    | table first_seen last_seen src user indicator_type indicator urls count
    | sort first_seen
    What to look for

    One or more devices or users contacting source-reported infrastructure, with first seen, last seen, process, URL, and destination context available for endpoint correlation.

    Technical details
    Tested signal

    Network or web activity matching one of the source-reported domains or IP addresses.

    Assumptions
    • Domain and IP fields are normalized without defanging in the underlying telemetry.
    • The values remain scoped to the cited Huntress intrusion and are not treated as universal ClickFix infrastructure.
    Data requirements and relevant fields
    network

    Endpoint network or mapped web activity with device, user, process, URL, IP, port, and timestamp.

    • Timestamp
    • DeviceName
    • DeviceId
    • User
    • RemoteUrl
    • RemoteIP
    • RemotePort
    • InitiatingProcessFileName
    • InitiatingProcessCommandLine
    KQL schema

    Uses Microsoft Defender XDR DeviceNetworkEvents. Map domains into RemoteUrl, DNS, proxy, or product-specific fields as required.

    SPL schema

    Requires Web and Network Traffic telemetry mapped to Splunk CIM. Domain, URL, user, and destination fields vary by source.

    Limitations
    • Web and network products map domains into different URL, domain, destination, DNS, or proxy fields.
    • An IOC match is incident context, not proof that every process or host followed the same chain.

    Both variants search the same incident-scoped values. Local web, DNS, proxy, and network fields require adaptation.

  3. Step 3Pivot

    Find similar user-driven Run execution

    Finding

    The behavior search broadens beyond the known infrastructure to users and devices with suspicious RunMRU commands involving interpreters, native tools, URLs, or retrieval commands.

    Behavior-based candidates preserve coverage when the lure, payload, or infrastructure rotates.

    View query
    Q-03Pivot

    Find similar user-driven Run execution

    What this checks

    Find devices that show the same user-driven execution pattern even when the domains or malware changed.

    KQL
    DeviceRegistryEvents
    | where RegistryKey endswith @"\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
    | where RegistryValueData has_any (
        "pcalua", "mshta", "powershell", "pwsh", "rundll32",
        "regsvr32", "wscript", "cscript", "curl", "certutil",
        "msiexec", "http://", "https://"
    )
    | project
        Timestamp,
        DeviceName,
        DeviceId,
        User = InitiatingProcessAccountUpn,
        RunCommand = RegistryValueData,
        InitiatingProcessFileName
    | order by Timestamp desc
    SPL
    | tstats count
        from datamodel=Endpoint.Registry
        where Registry.registry_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU*"
        by _time Registry.dest Registry.user Registry.registry_value_data
    | rename
        Registry.dest as dest
        Registry.user as user
        Registry.registry_value_data as run_command
    | where match(lower(run_command),
        "(pcalua|mshta|powershell|pwsh|rundll32|regsvr32|wscript|cscript|curl|certutil|msiexec|https?://)")
    | table _time dest user run_command count
    | sort - _time
    What to look for

    A review set of users and devices with suspicious Run commands that can be correlated with process, file, and network activity.

    Technical details
    Tested signal

    RunMRU values containing relevant interpreters, native tools, remote URLs, or download commands.

    Assumptions
    • RunMRU registry data is retained across the scoped endpoints.
    • Candidate commands will be correlated with process and network activity before assessment.
    Data requirements and relevant fields
    registry

    RunMRU events with device, user, command, initiating process, and timestamp.

    • Timestamp
    • DeviceName
    • DeviceId
    • User
    • RegistryKey
    • RegistryValueData
    • InitiatingProcessAccountUpn
    • InitiatingProcessFileName
    KQL schema

    Uses Microsoft Defender XDR DeviceRegistryEvents. Equivalent registry telemetry can preserve the same analytical question.

    SPL schema

    Requires Registry telemetry mapped to the Splunk CIM Endpoint data model.

    Limitations
    • RunMRU can be unavailable, cleared, or incomplete.
    • Native tools and URLs can appear in legitimate troubleshooting or administration.

    Both variants search RunMRU value data. Registry path and initiating-user normalization require local validation.

  4. Step 4Pivot

    Search persistence and post-compromise spread

    Finding

    The source intrusion later included RunSearch, WindowsHost and EdgeUpdate persistence patterns, Defender tampering, Chisel or cloudflared tunneling, remote execution, and connections to later-stage infrastructure.

    These pivots determine whether another candidate has progressed from exposure into persistence, defense impairment, remote access, or lateral movement.

    View query
    Q-04Pivot

    Search persistence and post-compromise spread

    What this checks

    Search for persistence, Defender tampering, tunneling, remote administration, and later-stage infrastructure reported in the source intrusion.

    KQL
    union
    (
        DeviceRegistryEvents
        | where
            (RegistryKey has @"\Software\Microsoft\Windows\CurrentVersion\Run"
             and (
                RegistryValueName in~ ("RunSearch", "WindowsHost", "EdgeUpdate")
                or RegistryValueData has_any ("RunSearch.exe", "conhost --headless", "node.exe")
             ))
            or RegistryValueData has_any (
                "DisableRealtimeMonitoring",
                "DisableIOAVProtection",
                "DisableBehaviorMonitoring"
            )
        | project
            Timestamp,
            DeviceName,
            Source="Registry",
            Detail=strcat(RegistryKey, " | ", RegistryValueName, " | ", RegistryValueData)
    ),
    (
        DeviceProcessEvents
        | where
            ProcessCommandLine has_any (
                "Stop-Service WinDefend",
                "sc.exe config WinDefend",
                "Add-MpPreference -ExclusionPath",
                "conhost --headless",
                "cloudflared",
                "chisel",
                "psexec",
                "wmic",
                "winrs"
            )
            or FileName in~ ("psexec.exe", "cloudflared.exe")
        | project
            Timestamp,
            DeviceName,
            Source="Process",
            Detail=ProcessCommandLine
    ),
    (
        DeviceNetworkEvents
        | where RemoteIP in ("77.110.122.58", "213.165.41.26")
        | project
            Timestamp,
            DeviceName,
            Source="Network",
            Detail=strcat(RemoteIP, ":", tostring(RemotePort), " | ", RemoteUrl)
    )
    | order by Timestamp asc
    SPL
    | multisearch
        [ | tstats count
            from datamodel=Endpoint.Registry
            where Registry.registry_path="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run*"
            by _time Registry.dest Registry.registry_value_name Registry.registry_value_data
          | rename
              Registry.dest as dest
              Registry.registry_value_name as value_name
              Registry.registry_value_data as detail
          | where value_name IN ("RunSearch","WindowsHost","EdgeUpdate")
              OR match(lower(detail), "(runsearch\.exe|conhost --headless|node\.exe)")
          | eval source_type="registry"
        ]
        [ | tstats count
            from datamodel=Endpoint.Processes
            by _time Processes.dest Processes.process_name Processes.process
          | rename
              Processes.dest as dest
              Processes.process_name as process_name
              Processes.process as detail
          | where match(lower(detail),
              "(stop-service\s+windefend|sc\.exe\s+config\s+windefend|add-mppreference\s+-exclusionpath|conhost\s+--headless|cloudflared|chisel|psexec|wmic|winrs)")
          | eval source_type="process"
        ]
        [ | tstats count
            from datamodel=Network_Traffic.All_Traffic
            where
                Network_Traffic.All_Traffic.dest_ip="77.110.122.58"
                OR Network_Traffic.All_Traffic.dest_ip="213.165.41.26"
            by _time Network_Traffic.All_Traffic.src Network_Traffic.All_Traffic.dest_ip Network_Traffic.All_Traffic.dest_port
          | rename
              Network_Traffic.All_Traffic.src as dest
              Network_Traffic.All_Traffic.dest_ip as remote_ip
              Network_Traffic.All_Traffic.dest_port as remote_port
          | eval detail=remote_ip.":".remote_port, source_type="network"
        ]
    | table _time dest source_type process_name value_name detail count
    | sort _time
    What to look for

    A device showing incident-scoped infrastructure, matching persistence, security-control tampering, tunneling, or remote-execution behavior that can be correlated with the initial hunt pivots.

    Technical details
    Tested signal

    Run-key patterns, security-control changes, tunnel or remote-execution commands, and source-reported later-stage IP addresses.

    Assumptions
    • Registry, process, and network events can be normalized to a common device and timestamp context.
    • WMIExec and SMBExec are hunted by behavior rather than literal executable names.
    Data requirements and relevant fields
    registry

    Startup persistence and Defender configuration changes with device, key, value, data, and timestamp.

    • Timestamp
    • DeviceName
    • RegistryKey
    • RegistryValueName
    • RegistryValueData
    process

    Defender changes, tunnels, and remote-execution process activity with device, image, command, and timestamp.

    • Timestamp
    • DeviceName
    • FileName
    • ProcessCommandLine
    network

    Connections to source-reported later-stage addresses with device, IP, port, URL, and timestamp.

    • Timestamp
    • DeviceName
    • RemoteIP
    • RemotePort
    • RemoteUrl
    KQL schema

    Uses Microsoft Defender XDR registry, process, and network tables. WMIExec and SMBExec require local remote-service and administrative-share behavior mapping.

    SPL schema

    Requires Endpoint Registry, Endpoint Processes, and Network Traffic data models. WMIExec and SMBExec should be mapped to remote-service, batch-file, administrative-share, and authentication behavior.

    Limitations
    • Literal tool names are not required for WMIExec or SMBExec behavior.
    • Registry-value and process-command coverage varies by endpoint product and policy.
    • Not every host in the source intrusion showed every artifact.

    Both variants preserve registry, process, and network pivots. Local schemas may require separate searches before correlation by device and time.

Blast radius

Wider-compromise pivots

  • Known malicious domain → identify every user and device that accessed it
  • Known malicious IP → identify every endpoint that connected
  • RunMRU pattern → identify users who ran similar commands
  • MSI or hash → identify where the file was written or executed
  • Run key → identify hosts with RunSearch, WindowsHost, or EdgeUpdate
  • Defender tampering → identify systems with exclusions or disabled services
  • Remote execution → identify systems receiving WMI, SMB, PsExec, or WinRM activity
  • Patient zero → identify internal systems it authenticated or connected to

Evidence threshold

What would increase confidence

  • A known incident IOC appears with matching execution.
  • Suspicious RunMRU is followed by pcalua, mshta, or remote retrieval.
  • Silent MSI execution is followed by new Run-key persistence.
  • The same device contacts later-stage C2.
  • Defender tampering appears after the initial foothold.
  • Remote execution or tunnel creation follows the candidate activity.
  • The same persistence pattern appears on additional hosts.

Conclusion

Result and next action

The source intrusion did not remain isolated to patient zero. It ultimately spanned 11 hosts, but the original landing website remains unpublished and not every host showed every artifact. Combine recovered arrival context, source-scoped infrastructure, execution, persistence, and remote-access behavior.

  • Isolate additional affected systems.
  • Revoke credentials and sessions exposed during browser credential theft.
  • Remove persistence host by host.
  • Restore security controls and tamper protection.
  • Block source-scoped malicious infrastructure.
  • Review lateral-movement credentials and remote-administration paths.
  • Continue hunting until no new related activity appears within the declared scope and retained telemetry.

The source intrusion did not remain isolated to patient zero. Follow-on activity ultimately spanned 11 hosts and included EtherRAT persistence, Defender tampering, tunneling, and WMIExec or SMBExec lateral movement. Not every host showed every artifact, so the hunt combines infrastructure, persistence, execution, and remote-access behavior rather than requiring one universal IOC.

This is a reviewed, source-backed hunt plan. SOC//LIFE did not execute it against a live customer environment.

Context

ATT&CK and limits

Behavior mapping

MITRE ATT&CK

This mapping describes the valid-account behavior examined by the Hunt. It does not prove token theft, attribution, or technique-wide coverage.

Review boundary

Sources and limits

The conclusion stays bounded to the stated scope and available logs.