ACR Stealer / Amatera — ClickFix Intrusion Chains

Attacker objective: harvest browser-stored credentials, session cookies and authentication tokens, plus sensitive enterprise documents (PDFs from Desktop and Downloads, Microsoft 365 files, OneDrive/SharePoint synced folders), then exfiltrate them for resale or follow-on account takeover. This is a credential- and token-theft operation, not a destructive one — the damage lands after the endpoint event, in your identity plane.

ACR Stealer is sold as malware-as-a-service and is the lineage behind the Amatera Stealer rebrand. Microsoft Defender Experts observed elevated activity across customer environments from late April 2026 through mid-June 2026, delivered by ClickFix lures — malvertising and SEO-poisoned search results that socially engineer the user into pasting an attacker-supplied command into the Windows Run dialog.

Microsoft documented two distinct intrusion chains:

• Chain 1 — WebDAV + rundll32 + Python. rundll32.exe loads a DLL directly from an attacker WebDAV share over HTTPS (three command variants: direct, pushd-mounted, and a conhost.exe --headless obfuscated form using delayed variable expansion). A ZIP payload lands in %LocalAppData%\Temp and a bundled pythonw.exe runs a Python loader that executes shellcode in memory via VirtualAlloc and the Windows Fiber API. Persistence is a hidden scheduled task masquerading as a software update. A second Python loader uses EtherHiding — public blockchain RPC endpoints and Web3 node infrastructure as dead-drop resolvers for the next payload or C2 address.
• Chain 2 — MSHTA + PowerShell + steganography. The ClickFix prompt runs MSHTA against a remote HTA; embedded VBScript uses COM objects to decode and run encoded PowerShell; that downloader (randomized variable names, arithmetic no-ops, dead loops, custom encryption) pulls a JPEG from an image-hosting service and extracts the payload from the image pixels, decrypting, decompressing and executing it entirely in memory with dynamically resolved APIs.

Highest-value defensive angle: both chains converge on the same two chokepoints. Upstream, every infection starts with a Run-dialog paste — which Windows records in RunMRU, giving you a near-zero-FP detection and a decisive hardening control (disable the Run dialog). Downstream, both chains reach for the same Chromium credential stores and DPAPI. Hunt the ends of the chain, not the middle; the middle is where the obfuscation lives.

Defender priority: Treat any confirmed ACR Stealer execution as a token compromise, not a malware cleanup. Reimaging the host does not invalidate stolen session cookies or refresh tokens. Revoke sessions and rotate credentials in the identity plane before you close the endpoint ticket.

Hunter notes & deliberate omissions

• No file hashes exist in the public reporting. Microsoft published domains only. This pack therefore ships no SHA256 IOCs. The IOC-management CSV uses explicit REPLACE_WITH_SHA256 placeholders rather than invented values.
• No exact scheduled-task name is published. Microsoft describes the pattern only — a hidden task posing as a software update, matched in their own query by "Autoupdate" plus an 8-digit number. Q6 encodes that pattern; it does not assert a task name.
• No registry keys are published beyond the ClickFix RunMRU vector that Microsoft's own detection query pivots on. Q9 is a translation of that pivot, not an inferred key.
• The EtherHiding domain keywords in Q11 are a hunting heuristic, not sourced IOCs. Microsoft named the technique but not the specific RPC providers. Q11 is labelled accordingly and must be baselined before it is trusted.
• Microsoft's published hunting queries are Defender KQL. Every query in section 8 is a hand-translation into Falcon CQL against the CrowdStrike data model — no Defender schema names (DeviceProcessEvents, ProcessCommandLine, DeviceRegistryEvents) survive into the CQL.

Hunt hypotheses (ordered by fidelity)

Attack chain — Chain 1 (WebDAV / Python)

Attack chain — Chain 2 (MSHTA / steganography)

Convergent stage — both chains

Provenance: every atomic indicator below is reproduced from a cited published source. Microsoft's report contains no file hashes, no registry keys and no exact scheduled-task names — none are invented here. Domain infrastructure of this type is highly perishable; treat absence of hits as inconclusive and lean on the behavioral queries.

These run outside Falcon and cover the surfaces where EDR telemetry is thin — particularly the identity-plane impact, which is the part of this campaign that actually costs you something.

N1 · Windows Security / Task Scheduler — masqueraded persistence

• Event ID 4698 (task created) and 4702 (task updated). Filter task names matching Autoupdate followed by 8 digits, and any task whose action points into %LocalAppData%\Temp.
• Microsoft-Windows-TaskScheduler/Operational 106 / 200 for registration and action-start.
• On-box triage: Get-ScheduledTask | Where-Object { $_.TaskName -match 'Autoupdate\d{8}' } — and separately enumerate hidden tasks, which the Task Scheduler UI will not show by default.

N2 · Web proxy / secure web gateway — ClickFix delivery and WebDAV egress

• Hunt User-Agent strings containing Microsoft-WebDAV-MiniRedir — that is the Windows WebClient service reaching the internet, and it is almost never legitimate outbound.
• Requests with HTTP methods PROPFIND, OPTIONS or LOCK to non-corporate hosts.
• First-seen resolutions to the campaign TLDs heavily represented here: .icu, .sale, .art, .cc.
• Referrer chains landing on a page from a search-engine result immediately before a Run-dialog paste on the same host.

N3 · PowerShell operational logs

• 4104 script block logging — the single most valuable artifact for Chain 2. Search for image-file downloads, FromBase64String, and reflective-loading API names (GetProcAddress, VirtualAlloc, CreateThread).
• 4103 module logging and transcription output for the same window.
• Absence of expected 4104 events on a host that otherwise shows PowerShell execution is itself a finding — see T1070.003.

N4 · Microsoft 365 / Entra ID — the impact hunt

• Unified audit log: FileDownloaded / FileSyncDownloadedFull spikes from an affected user in the 24h either side of the endpoint event.
• Entra sign-in logs: the same session token or device ID appearing from a new ASN, country or user agent — the classic token-replay signature. Check both interactive and non-interactive sign-ins; token replay usually shows in the non-interactive log.
• Risky sign-ins / risk detections: anomalous token, unfamiliar sign-in properties, impossible travel.
• OAuth grants: any new consent granted by the affected user after the compromise window.
• Enumerate which corporate SaaS the user had live browser sessions for — every one of those is potentially compromised, not just M365.

N5 · Endpoint local artifacts (for confirmed hosts)

• HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU — the pasted command usually survives here and is your cleanest confirmation of the initial lure.
• %LocalAppData%\Temp — look for vendor-named folders containing a bundled Python runtime.
• %AppData%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt — present, truncated, or missing.
• Files whose MFT $STANDARD_INFORMATION and $FILE_NAME timestamps disagree — the timestomping tell that endpoint telemetry cannot give you.

All twelve queries are hand-translated from behavior described by Microsoft into the Falcon data model. Microsoft published their hunting logic as Defender KQL; none of that schema survives here. Run the behavioral queries (Q1–Q11) first — the atomic domain sweep (Q12) is the least durable of the set.

// HUNT: rundll32 loading a DLL from a remote WebDAV / UNC share (ACR Stealer Chain 1)
// MITRE: T1218.011, T1204, T1189
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: legacy LOB installers invoking rundll32 against an internal file server
// TUNING: add your internal file-server hostnames to the exclusion filter at the end
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^rundll32(\.exe)?$/i
| CommandLine=/\\\\[A-Za-z0-9._\-]+\\/
| ParentBaseFileName=/^(cmd|conhost|explorer|powershell|wscript|mshta)\.exe$/i
// exclude known-good internal shares (replace the sample hostnames):
| CommandLine!=/\\\\(fileserver01|deploy-share)\./i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine, SHA256HashData, aid], limit=200)

// HUNT: conhost.exe --headless used to obfuscate a WebDAV loader chain (ACR Stealer Chain 1)
// MITRE: T1027, T1036, T1059.003
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: rare; some terminal / automation tooling invokes conhost programmatically
// TUNING: if your terminal stack is noisy here, pin ParentBaseFileName to explorer.exe only
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^conhost(\.exe)?$/i
| CommandLine=/--headless/i
| CommandLine=/(pushd|rundll32|cmd\.exe|\\\\|\^|!)/i
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, FileName, CommandLine, aid], limit=200)

// HUNT: cmd.exe mounting a remote share via pushd / net use (ACR Stealer Chain 1 variant 2)
// MITRE: T1218.011, T1105, T1059.003
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: login scripts, software deployment, and admin sessions mounting internal shares
// TUNING: exclude your internal DFS namespace and file-server hostnames below; the residue is the hunt
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^cmd(\.exe)?$/i
| CommandLine=/(pushd|net\s+use)\s+.{0,8}\\\\/i
// exclude internal namespaces (replace with your own):
| CommandLine!=/\\\\(corp|dfs|fileserver01|sysvol|netlogon)/i
| ParentBaseFileName=/^(explorer|conhost|mshta|rundll32|powershell)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine, aid], limit=200)

// HUNT: mshta.exe fetching remote HTA content (ACR Stealer Chain 2 entry)
// MITRE: T1218.005, T1204, T1189
// CONF: high | FP: low | COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: legacy intranet HTA applications (internal hostnames only)
// TUNING: exclude internal intranet hosts; to match Microsoft's tighter variant, uncomment
//         the ParentBaseFileName and 7-digit path filters below
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^mshta(\.exe)?$/i
| CommandLine=/https?:\/\//i
// | ParentBaseFileName=/^explorer\.exe$/i          -- Microsoft's observed parent
// | CommandLine=/[0-9]{7}/                          -- Microsoft's 7-digit path segment
| table([@timestamp, ComputerName, UserName, GrandparentBaseFileName, ParentBaseFileName, CommandLine, aid], limit=200)

// HUNT: pythonw.exe running from a user Temp staging folder (ACR Stealer Chain 1 loader)
// MITRE: T1059.006, T1036, T1204
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: developer tooling, pip/venv activity, and installers that bundle a Python runtime
// TUNING: exclude your engineering asset group, or uncomment the ParentBaseFileName filter to
//         keep only interpreters launched by the ClickFix LOLBin chain
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^pythonw(\.exe)?$/i
| ImageFileName=/\\AppData\\Local\\Temp\\/i
// | ParentBaseFileName=/^(cmd|conhost|rundll32|mshta|powershell)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, aid], limit=200)

// HUNT: scheduled task masquerading as a software update, "Autoupdate" + 8 digits (ACR Stealer)
// MITRE: T1053.005, T1036
// CONF: high | FP: low | COST: low
// REQUIRES: ProcessRollup2; ScheduledTaskRegistered/Modified (validate in tenant)
// FALSE POSITIVES: rare; a genuine vendor updater using the same date-suffix convention
// TUNING: confirm any hit against the task's Author and Executable before escalating
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|ScheduledTaskRegistered|ScheduledTaskModified)$/
| CommandLine=/Autoupdate\d{8}/i or TaskName=/Autoupdate\d{8}/i
| table([@timestamp, ComputerName, UserName, FileName, TaskName, TaskExecutable, TaskAuthor, CommandLine, aid], limit=200)

// HUNT: PowerShell command-history clearing or suppression (ACR Stealer defense evasion)
// MITRE: T1070.003
// CONF: medium | FP: medium | COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: admin hygiene, CI/CD runners, and profile scripts that suppress history
// TUNING: treat as a supporting signal -- alert only when the same aid also hits Q1-Q6 in a 24h window
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(Clear-History|ConsoleHost_history|HistorySaveStyle\s+SaveNothing)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, aid], limit=200)

// HUNT: non-browser process referencing Chromium credential databases (ACR Stealer collection)
// MITRE: T1555.003
// CONF: medium | FP: medium | COST: medium | REQUIRES: ProcessRollup2
// FALSE POSITIVES: backup agents, profile-migration tools, DLP scanners, password-manager importers
// TUNING: add your backup / DLP / migration agents to the FileName exclusion list below
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine=/(Login\s?Data|Web\s?Data|Local\s?State)/i
| CommandLine=/AppData\\(Local|Roaming)\\/i
| !in(FileName, values=["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe", "vivaldi.exe"], ignoreCase=true)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData, aid], limit=200)

// HUNT: ClickFix Run-dialog paste recorded in RunMRU (ACR Stealer initial access)
// MITRE: T1204, T1189, T1059.003
// CONF: high | FP: low | COST: low | REQUIRES: registry telemetry (RunMRU writes)
// FALSE POSITIVES: IT staff pasting legitimate remote-admin one-liners into Run
// TUNING: exclude your admin asset group / privileged accounts. Removing the second
//         RegStringValue filter widens this to every interpreter typed into Run (noisier hunt).
#event_simpleName=/^(RegGenericValueUpdate|AsepValueUpdate|RegSystemConfigValueUpdate)$/
| RegObjectName=/RunMRU/i
| RegStringValue=/(powershell|cmd|mshta|rundll32|conhost|curl|msiexec|certutil|bitsadmin|python)/i
| RegStringValue=/(http|\\\\|-enc|-e |hidden|iex|FromBase64|--headless)/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid], limit=200)

// HUNT: PowerShell retrieving an image file as a payload carrier (ACR Stealer Chain 2 steganography)
// MITRE: T1027.003, T1059.001, T1102
// CONF: medium | FP: medium | COST: medium | REQUIRES: ProcessRollup2
// FALSE POSITIVES: wallpaper/branding deployment, reporting scripts that embed charts, monitoring agents
// TUNING: exclude your imaging/branding deployment scripts by ParentBaseFileName or CommandLine path
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName=/^powershell(\.exe)?$/i
| CommandLine=/(DownloadString|DownloadData|DownloadFile|Invoke-WebRequest|Invoke-RestMethod|Net\.WebClient|Start-BitsTransfer|curl|wget)/i
| CommandLine=/\.(jpg|jpeg|png|gif|bmp|webp|svg)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine, aid], limit=200)

// HUNT: script interpreter resolving blockchain RPC / Web3 node infrastructure (EtherHiding dead drop)
// MITRE: T1102.001, T1059.006
// CONF: low | FP: high | COST: medium | REQUIRES: DnsRequest with process context
// NOTE: the domain keyword list is an authored heuristic -- Microsoft published the technique,
//       not the providers. No indicator in this query is a sourced IOC.
// FALSE POSITIVES: high -- ordinary CDN / node / RPC hostnames match these keywords
// TUNING: baseline over 30 days, allowlist every recurring destination, then review only new ones
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| ContextBaseFileName=/^(pythonw|python|powershell|rundll32|mshta|conhost|wscript|cscript)\.exe$/i
| DomainName=/(rpc|web3|infura|blockchain|binance|ethereum)/i
| groupBy([ComputerName, ContextBaseFileName, DomainName], function=count(as=Requests))
| sort(Requests, order=desc, limit=200)

// HUNT: ACR Stealer published campaign domains (atomic IOC sweep)
// MITRE: T1102, T1071.001
// CONF: high | FP: low | COST: medium | REQUIRES: DnsRequest
// SOURCE: Microsoft Security Blog 2026-07-16 IOC table; hosts 17-18 from The Hacker News 2026-07-17
// FALSE POSITIVES: none expected -- any hit warrants immediate host triage
// NOTE: highly perishable. Absence of hits is NOT evidence of absence -- rely on Q1-Q11.
#event_simpleName=/^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName=/(looksta\.icu|quirksturdy\.icu|strainedeasily\.icu|cpppemwjewjoiwejow\.sale|wifihot\.icu|filloco\.icu|raidher\.icu|apigrokcloud\.icu|enhanceblabber\.cc|deep-harborio\.com|auramatrixa\.com|zealpraxis\.com|prism-vertex\.com|prism-matrixs\.com|proton-network\.com|creativecommunityinfo\.art|dialectosphere\.in\.net|claude-desktop\.gitlab\.io)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, DomainName, aid], limit=500)

Five queries are clean enough to promote from hunt to Custom IOA. The rest stay investigate-only — either because their FP profile needs environment tuning first (Q3, Q5, Q7, Q8, Q10), because they are an explicitly heuristic hunt (Q11), or because they belong in IOC Management rather than an IOA (Q12).

Deployment path

1. Endpoint security → Configuration → Custom IOA rule groups — create a group named for this campaign and assign it to a pilot prevention policy first.
2. Add each rule above in Monitor (detect-only) severity to start. Let it run one full business week.
3. Review every hit, add the exclusions the review produces, then raise the two Block-recommended rules to prevention. Do not skip the monitor week on Q2 and Q4 — they are clean in most estates but the exceptions are always local.
4. Q12's domains belong in IOC Management, not an IOA — import the CSV from section 10.

Investigate-only queries — pivot guidance

• Q3, Q5, Q7, Q8, Q10: run weekly as scheduled searches with results to a hunt queue, not an alert inbox. Promote individually once your environment's baseline is documented.
• Q11: run monthly as a ranked review list. It is a research aid, not a detection.
• Cross-query correlation is where the real fidelity lives. Any single host hitting two or more of Q1–Q10 within 24 hours should escalate immediately regardless of the individual FP ratings.

Read before importing: the SHA256 rows below are REPLACE_WITH_SHA256 placeholders on purpose. No file hashes have been published for this campaign by any cited source. Delete those rows or populate them from your own confirmed samples — do not ship them as-is.

type,value,action,severity,expiration,description,tags
domain,looksta.icu,detect,high,2027-01-18,ACR Stealer chain-1 infrastructure,campaign:ACRStealer
domain,quirksturdy.icu,detect,high,2027-01-18,ACR Stealer chain-1 infrastructure,campaign:ACRStealer
domain,strainedeasily.icu,detect,high,2027-01-18,ACR Stealer chain-1 infrastructure,campaign:ACRStealer
domain,cpppemwjewjoiwejow.sale,detect,high,2027-01-18,ACR Stealer chain-1 infrastructure,campaign:ACRStealer
domain,wifihot.icu,detect,high,2027-01-18,ACR Stealer chain-1 infrastructure,campaign:ACRStealer
domain,filloco.icu,detect,high,2027-01-18,ACR Stealer chain-1 infrastructure,campaign:ACRStealer
domain,raidher.icu,detect,high,2027-01-18,ACR Stealer chain-1 infrastructure,campaign:ACRStealer
domain,apigrokcloud.icu,detect,high,2027-01-18,ACR Stealer chain-1 infrastructure,campaign:ACRStealer
domain,enhanceblabber.cc,detect,high,2027-01-18,ACR Stealer chain-2 payload host,campaign:ACRStealer
domain,deep-harborio.com,detect,high,2027-01-18,ACR Stealer chain-2 infrastructure,campaign:ACRStealer
domain,auramatrixa.com,detect,high,2027-01-18,ACR Stealer chain-2 infrastructure,campaign:ACRStealer
domain,zealpraxis.com,detect,high,2027-01-18,ACR Stealer chain-2 infrastructure,campaign:ACRStealer
domain,prism-vertex.com,detect,high,2027-01-18,ACR Stealer chain-2 infrastructure,campaign:ACRStealer
domain,prism-matrixs.com,detect,high,2027-01-18,ACR Stealer chain-2 infrastructure,campaign:ACRStealer
domain,proton-network.com,detect,high,2027-01-18,ACR Stealer chain-2 infrastructure,campaign:ACRStealer
domain,creativecommunityinfo.art,detect,high,2027-01-18,ACR Stealer chain-2 payload host,campaign:ACRStealer
domain,sphere-api.dialectosphere.in.net,detect,high,2026-10-18,ACR Stealer WebDAV share host,campaign:ACRStealer
domain,claude-desktop.gitlab.io,detect,medium,2026-08-18,Fake Claude Code ClickFix lure (2025 reporting),campaign:ACRStealer
sha256,REPLACE_WITH_SHA256,prevent,critical,2027-01-18,ACR Stealer payload - NO HASH PUBLISHED,campaign:ACRStealer
sha256,REPLACE_WITH_SHA256,prevent,critical,2027-01-18,ACR Stealer loader DLL - NO HASH PUBLISHED,campaign:ACRStealer

ACR Stealer / Amatera - behavioral signatures (ClickFix chains)

CHAIN 1 - WebDAV + rundll32 + Python
  B1  rundll32.exe with a UNC path argument, parent = interactive shell
  B2  conhost.exe --headless wrapping pushd / rundll32 (delayed expansion, ^ and !)
  B3  pushd or net use mounting an EXTERNAL share, immediately followed by execution
  B4  pythonw.exe executing from %LocalAppData%\Temp (console suppressed)
  B5  Temp staging folder named after vendor software (observed: LogiOptionsPlus)
  B6  DLL delivered with a non-PE extension to blend in (observed: .google)
  B7  scheduled task named "Autoupdate" + 8 digits, hidden, trigger = user sign-in
  B8  file timestamps copied from notepad.exe (timestomp)
  B9  PowerShell history cleared or HistorySaveStyle set to SaveNothing
  B10 script interpreter resolving blockchain RPC / Web3 nodes (EtherHiding)

CHAIN 2 - MSHTA + PowerShell + steganography
  B11 mshta.exe fetching a remote HTA over HTTPS, parent = explorer.exe
  B12 URL path containing a 7-digit segment
  B13 VBScript using COM objects to decode and run encoded PowerShell
  B14 PowerShell with randomized variable names, arithmetic no-ops, dead loops
  B15 PowerShell downloading a JPEG from an image-hosting service
  B16 runtime API resolution: LoadLibrary, GetProcAddress, VirtualAlloc,
      CreateThread, WaitForSingleObject

CONVERGENT - both chains
  B17 non-browser process reading Chromium Login Data / Web Data / Local State
  B18 DPAPI decryption of browser-stored passwords, cookies, auth tokens
  B19 staging of PDFs from Desktop/Downloads, M365 docs, OneDrive-synced folders

CORRELATION RULE
  Any single aid matching 2+ behaviors above within 24h = escalate immediately,
  regardless of the individual FP rating of each contributing signal.

FAMILY NAMES / ALIASES
  ACR Stealer          primary name
  AcridRain            alias
  Amatera Stealer      rebrand lineage (Proofpoint)

DISTRIBUTION MODEL
  Malware-as-a-Service (MaaS)

DELIVERY
  ClickFix             fake verification / "fix it" prompt driving a Run-dialog paste
  Malvertising         paid placement serving the ClickFix page
  SEO poisoning        manipulated organic search results

TECHNIQUES BY NAME
  EtherHiding          public blockchain / Web3 nodes as a dead-drop resolver
  Fiber API execution  ConvertThreadToFiber / CreateFiber / SwitchToFiber
  Steganography        payload carried in JPEG pixel data
  Timestomping         timestamps sourced from notepad.exe

LOLBINS ABUSED
  cmd.exe  rundll32.exe  mshta.exe  powershell.exe  pythonw.exe  conhost.exe

OBSERVATION WINDOW
  late April 2026 - mid June 2026 (Microsoft Defender Experts)

# ACR Stealer / ClickFix - exposure audit (run per host or via RMM)

# 1. WebClient service - the WebDAV prerequisite for Chain 1
Get-Service WebClient | Select-Object Name, Status, StartType

# 2. Run dialog available? (RunMRU is the ClickFix vector)
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer' -Name NoRun -EA SilentlyContinue

# 3. What has already been pasted into Run on this host?
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -EA SilentlyContinue

# 4. ASR rules currently applied (GUIDs verified against Microsoft Learn 2026-07-18)
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions
#   5beb7efe-fd9a-4556-801d-275e5ffc04cc  Block execution of potentially obfuscated scripts
#   d3e037e1-3eb8-44c8-a917-57927947596d  Block JS/VBScript launching downloaded executable content
#   c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb  Block use of copied or impersonated system tools
#   01443614-cd74-433a-b99e-2ecdc07bfc25  Block executables failing prevalence/age/trust criteria
#   9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2  Block credential stealing from LSASS

# 5. PowerShell logging posture
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -EA SilentlyContinue
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging'     -EA SilentlyContinue
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription'     -EA SilentlyContinue

# 6. Browser password-manager policy (reduces what there is to steal)
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Google\Chrome'    -Name PasswordManagerEnabled -EA SilentlyContinue
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'   -Name PasswordManagerEnabled -EA SilentlyContinue

# 7. Suspicious scheduled tasks matching the observed masquerade pattern
Get-ScheduledTask | Where-Object { $_.TaskName -match 'Autoupdate\d{8}' } |
  Select-Object TaskName, State, Author

# 8. Tamper protection + cloud-delivered protection
Get-MpComputerStatus | Select-Object IsTamperProtected, AMServiceEnabled, RealTimeProtectionEnabled
Get-MpPreference | Select-Object MAPSReporting, SubmitSamplesConsent, DisableScriptScanning

Work these in order. A query that has not cleared gate 2 has no business being an alert.

Do not deploy Q11 as an alert under any circumstances. Its keyword list is an authored heuristic, not published infrastructure. It is a monthly review list and nothing more.

Controls are ordered by leverage against this threat, not by generic best practice. The first two immediate controls each break an entire intrusion chain outright.

Test every playbook on a pilot ring before fleet deployment. P2 in particular changes visible user-facing behavior.

P1 · Disable the WebClient service (WebDAV) — breaks Chain 1

#requires -RunAsAdministrator
# P1 - Disable WebDAV client. Highest-leverage single control against ACR Stealer Chain 1.
# CHECK FIRST: SharePoint "Open in Explorer" and some legacy DMS clients depend on WebClient.

# 1. Record current state so the change is reversible
$before = Get-Service -Name WebClient | Select-Object Name, Status, StartType
$before | Format-List

# 2. Stop and disable
Stop-Service  -Name WebClient -Force -ErrorAction SilentlyContinue
Set-Service   -Name WebClient -StartupType Disabled

# 3. Verify
Get-Service -Name WebClient | Select-Object Name, Status, StartType

# --- Fleet-wide via GPO ---
# Computer Configuration -> Policies -> Windows Settings -> Security Settings
#   -> System Services -> WebClient -> Define this policy -> Disabled
#
# --- Rollback ---
# Set-Service -Name WebClient -StartupType Manual; Start-Service -Name WebClient

P2 · Disable the Run dialog — removes the ClickFix landing surface

# P2 - Remove the Run dialog. RunMRU is the ClickFix delivery vector for BOTH chains.
# USER-VISIBLE CHANGE. Pilot on a ring. Exempt IT/developer groups by GPO security filtering.

# --- Preferred: GPO ---
# User Configuration -> Policies -> Administrative Templates -> Start Menu and Taskbar
#   -> "Remove Run menu from Start Menu"  ->  Enabled
# (also disables Win+R and the Run entry in the WinX menu)

# --- Equivalent registry value (per-user) ---
$key = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer'
if (-not (Test-Path $key)) { New-Item -Path $key -Force | Out-Null }
New-ItemProperty -Path $key -Name 'NoRun' -Value 1 -PropertyType DWord -Force | Out-Null

# Verify
Get-ItemProperty -Path $key -Name 'NoRun'

# --- Forensic value: capture what was already pasted into Run before you clear it ---
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -ErrorAction SilentlyContinue

# --- Rollback ---
# Remove-ItemProperty -Path $key -Name 'NoRun' -ErrorAction SilentlyContinue

P3 · Enable the intersecting ASR rules (audit mode first)

#requires -RunAsAdministrator
# P3 - ASR rules intersecting the ACR Stealer chains.
# GUIDs verified against Microsoft Learn ASR rules reference, retrieved 2026-07-18.
# Action codes: 0 = Disabled, 1 = Block, 2 = Audit, 6 = Warn

$rules = @(
  '5beb7efe-fd9a-4556-801d-275e5ffc04cc',  # Block execution of potentially obfuscated scripts
  'd3e037e1-3eb8-44c8-a917-57927947596d',  # Block JS/VBScript launching downloaded executable content
  'c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb',  # Block use of copied or impersonated system tools
  '01443614-cd74-433a-b99e-2ecdc07bfc25'   # Block executables failing prevalence/age/trust criteria
)

# STEP 1 - deploy in AUDIT for one to two weeks and review the generated events
foreach ($r in $rules) {
  Add-MpPreference -AttackSurfaceReductionRules_Ids $r -AttackSurfaceReductionRules_Actions Audit
}

# STEP 2 - after review, switch to Block (re-run with Enabled instead of Audit)
# foreach ($r in $rules) {
#   Add-MpPreference -AttackSurfaceReductionRules_Ids $r -AttackSurfaceReductionRules_Actions Enabled
# }

# Cloud-delivered protection is a DEPENDENCY for two of these rules - without it they no-op
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendSafeSamples

# Verify
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

P4 · Enable PowerShell logging — the only surface for Chain 2

#requires -RunAsAdministrator
# P4 - Script block logging, module logging and transcription.
# Chain 2 runs entirely in memory; 4104 events are the only practical visibility.

$base = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell'

# Script block logging (Event ID 4104)
$sb = "$base\ScriptBlockLogging"
if (-not (Test-Path $sb)) { New-Item -Path $sb -Force | Out-Null }
New-ItemProperty -Path $sb -Name 'EnableScriptBlockLogging' -Value 1 -PropertyType DWord -Force | Out-Null

# Module logging (Event ID 4103)
$ml = "$base\ModuleLogging"
if (-not (Test-Path $ml)) { New-Item -Path $ml -Force | Out-Null }
New-ItemProperty -Path $ml -Name 'EnableModuleLogging' -Value 1 -PropertyType DWord -Force | Out-Null
$mn = "$ml\ModuleNames"
if (-not (Test-Path $mn)) { New-Item -Path $mn -Force | Out-Null }
New-ItemProperty -Path $mn -Name '*' -Value '*' -PropertyType String -Force | Out-Null

# Transcription - point OutputDirectory at a write-only central share
$tr = "$base\Transcription"
if (-not (Test-Path $tr)) { New-Item -Path $tr -Force | Out-Null }
New-ItemProperty -Path $tr -Name 'EnableTranscripting'    -Value 1 -PropertyType DWord  -Force | Out-Null
New-ItemProperty -Path $tr -Name 'EnableInvocationHeader' -Value 1 -PropertyType DWord  -Force | Out-Null
New-ItemProperty -Path $tr -Name 'OutputDirectory' -Value 'C:\ProgramData\PSTranscripts' -PropertyType String -Force | Out-Null

# Verify
Get-ItemProperty $sb, $ml, $tr | Format-List

# IMPORTANT: forward these logs centrally. Local-only logs are the first thing an operator clears.

P5 · Reduce what there is to steal — browser credential policy

#requires -RunAsAdministrator
# P5 - Disable browser password managers.
# ACR Stealer's credential stage targets Chromium Login Data / Web Data.
# SEQUENCE: deploy an enterprise password manager FIRST, or users will write passwords down.

# Chrome
$chrome = 'HKLM:\SOFTWARE\Policies\Google\Chrome'
if (-not (Test-Path $chrome)) { New-Item -Path $chrome -Force | Out-Null }
New-ItemProperty -Path $chrome -Name 'PasswordManagerEnabled' -Value 0 -PropertyType DWord -Force | Out-Null

# Edge
$edge = 'HKLM:\SOFTWARE\Policies\Microsoft\Edge'
if (-not (Test-Path $edge)) { New-Item -Path $edge -Force | Out-Null }
New-ItemProperty -Path $edge -Name 'PasswordManagerEnabled' -Value 0 -PropertyType DWord -Force | Out-Null

# Verify
Get-ItemProperty $chrome -Name PasswordManagerEnabled -ErrorAction SilentlyContinue
Get-ItemProperty $edge   -Name PasswordManagerEnabled -ErrorAction SilentlyContinue

# NOTE: this stops NEW credentials being saved. Already-stored credentials remain until
# cleared - instruct users to clear saved passwords after migrating to the enterprise vault.

P6 · Identity-plane response — the step teams forget

# P6 - Token and credential revocation for a confirmed ACR Stealer host.
# Reimaging the endpoint does NOT invalidate stolen session cookies or refresh tokens.
# Run this BEFORE closing the endpoint ticket.

# Requires: Microsoft.Graph PowerShell SDK
Connect-MgGraph -Scopes 'User.ReadWrite.All','Directory.AccessAsUser.All','AuditLog.Read.All'

$upn = 'AFFECTED_USER@example.com'   # replace
$user = Get-MgUser -UserId $upn

# 1. Revoke all refresh tokens and sign the user out everywhere
Revoke-MgUserSignInSession -UserId $user.Id

# 2. Force password change at next sign-in (do this AFTER the revoke)
#    Then reset the password out-of-band through your normal process.

# 3. Review sign-ins for token replay - a stolen cookie shows up in the
#    NON-interactive log, from a new ASN / country / user agent
Get-MgAuditLogSignIn -Filter "userPrincipalName eq '$upn'" -Top 200 |
  Select-Object createdDateTime, ipAddress, appDisplayName, clientAppUsed,
                isInteractive, @{n='Location';e={$_.location.countryOrRegion}} |
  Sort-Object createdDateTime -Descending | Format-Table -AutoSize

# 4. Review OAuth consents granted by this user during the compromise window
Get-MgUserOauth2PermissionGrant -UserId $user.Id | Format-Table

# 5. Enumerate every OTHER SaaS the user had a live browser session for.
#    M365 is not the only thing in the cookie jar - rotate those too.

Sequencing rule for this threat: the endpoint is the crime scene, the identity plane is the loss. Isolate the host early, but do not let the endpoint work delay token revocation — stolen cookies are being used while you image the disk.

Gap summary

• Four hard gaps. Two are structural and accepted (in-memory execution T1620/T1055; timestomping T1070.006) — no EDR gives you these, so the pack compensates by detecting the stages immediately before and after. One is an intel gap (EtherHiding T1102.001 — the technique is named, the infrastructure is not). One is a tooling boundary (collection T1005/T1074 lives in M365 audit, not endpoint telemetry).
• The most consequential partial is Q8. Falcon has no generic file-read event, and ACR Stealer reads browser databases in-process after reflective loading. A clean Q8 result is not evidence that credentials are safe. Treat the identity-plane hunts (section 7, N4) as the real detection for the credential-access stage.
• Compensating strength: both chains converge on Run-dialog delivery upstream and browser/token theft downstream. Q9 covers the upstream chokepoint at high fidelity for both chains simultaneously, which is why it is the highest-value query in the pack despite the flashier middle stages.

Validation: gates G1–G6 in section 11 govern promotion. No query proceeds to alert before clearing G2 (benign baseline) and no query proceeds to block before clearing G5 (one monitor week). Q11 is permanently barred from alerting — it is a heuristic review list, not a detection.

Provenance statement. Every atomic indicator in this pack — all 16 campaign domains, both additional host indicators, the GUID path fragment, the disguised filename and the Temp staging folder name — is reproduced from one of the cited sources above. Where a source published nothing (file hashes, exact scheduled-task names, registry keys beyond RunMRU, EtherHiding RPC providers), this pack says so explicitly and ships a placeholder or a labelled heuristic rather than an invented value.