ClickFix Multi-Loader Campaign — BabaDeda · Lorem Ipsum · Potemkin

Looks for: powershell.exe/pwsh.exe running a download-and-execute one-liner (iwr / Invoke-WebRequest / iex / DownloadString / curl), parented by a browser or explorer.exe (the Run-dialog paste). Accomplishes: catches the shared ClickFix entry point for all three loaders.

// HUNT: ClickFix entry - PowerShell download+execute parented by browser/explorer
// MITRE: T1204.004, T1059.001 | CONF: high  FP: low  COST: low
// FP NOTES: legit admin one-liners exist; the browser/explorer parent + download verb is the discriminator
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(powershell|pwsh)\.exe$/i
| CommandLine=/(iwr|invoke-webrequest|iex|invoke-expression|downloadstring|downloadfile|curl|wget)/i
| ParentBaseFileName=/^(explorer|chrome|msedge|firefox|brave|opera)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: hidden / encoded PowerShell (-w hidden, -windowstyle hidden, -enc), optionally side-loading a DLL via rundll32/regsvr32 from a user-writable path. Accomplishes: catches BabaDeda's hidden-PowerShell + in-memory/side-load fingerprint.

// HUNT: BabaDeda - hidden/encoded PowerShell + DLL side-loading from user-writable path
// MITRE: T1564.003, T1027.010, T1574.002 | CONF: high  FP: low  COST: low
// TUNING: allow-list known software updaters that legitimately run hidden PS
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/-w(indowstyle)?\s+hidden|-enc(odedcommand)?\s/i
| (FileName=/^(powershell|pwsh)\.exe$/i or FileName=/^(rundll32|regsvr32)\.exe$/i)
| CommandLine=/\\(Users|AppData|ProgramData|Temp)\\/i
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

Looks for: node.exe running a .js from a user-writable path (\Temp\, \AppData\, \Downloads\), parented by a browser or script host — the outdated bundled Node runtime that Lorem Ipsum ships. FP: legit dev/Electron tooling — exclude developer hosts and known app install dirs.

// HUNT: Lorem Ipsum - node.exe runs a .js from user-writable path (fake Edge update)
// MITRE: T1059.007, T1574.002 | CONF: medium  FP: medium  COST: low
// TUNING: exclude developer endpoints + legit Electron/app install dirs (\Program Files\, signed updaters)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^node\.exe$/i
| CommandLine=/\.js("|\s|$)/i
| CommandLine=/\\(Temp|AppData\\Local\\Temp|AppData\\Roaming|Downloads)\\/i
| ParentBaseFileName=/^(explorer|chrome|msedge|firefox|wscript|cscript|mshta)\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: mshta.exe running an HTA/URL, or msiexec installing a package from a user-temp or remote (http/UNC) path. Accomplishes: catches Potemkin's HTA→MSI install chain. FP: some legit installers run from temp — the remote/temp source + mshta lineage is the discriminator.

// HUNT: Potemkin - HTA->MSI install chain (mshta launch or msiexec from temp/remote)
// MITRE: T1218.005, T1218.007 | CONF: high  FP: low-med  COST: low
// TUNING: allow-list sanctioned software-deployment paths and signed enterprise MSIs
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ((FileName=/^mshta\.exe$/i and CommandLine=/(http|\.hta|javascript:|vbscript:)/i) or (FileName=/^msiexec\.exe$/i and CommandLine=/(http|\\\\|\\(Temp|AppData|ProgramData)\\)/i))
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)

Looks for: command lines adding Defender exclusions or disabling protection (Add-MpPreference -ExclusionPath, Set-MpPreference -Disable*). Accomplishes: a hands-on-keyboard signal observed in Potemkin intrusions — treat as a live operator.

// HUNT: Defender exclusion / protection tampering (hands-on-keyboard)
// MITRE: T1562.001 | CONF: high  FP: low  COST: low
// FP NOTES: sanctioned EDR/AV management may set exclusions - allow-list your tooling/SCCM accounts
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(add-mppreference|set-mppreference).*(exclusionpath|exclusionprocess|exclusionextension|disablerealtimemonitoring|disablescriptscanning|disablebehaviormonitoring)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: RMM tooling (RMMProject / ScreenConnect / AnyDesk / Atera / Splashtop) or a reflective-injection host parented by an LOLBin/script host — the EtherRAT/RMMProject follow-on. FP: sanctioned RMM exists — scope to hosts with a recent Q1/Q2/Q4 hit and an anomalous parent. Pair with DNS hunting for DGA-style (high-entropy, rare-domain) lookups.

// HUNT: Potemkin follow-on - RMM/reflective loader from an unusual (LOLBin) parent
// MITRE: T1219, T1055.001, T1568.002 | CONF: medium  FP: medium  COST: low
// TUNING: allow-list sanctioned RMM; scope to hosts with a recent Q1/Q2/Q4 hit; pair with DGA DNS hunt
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (FileName=/(screenconnect|anydesk|atera|splashtop|tightvnc|rmmproject|remoteutilities)/i or CommandLine=/(screenconnect|anydesk|atera|splashtop|rmmproject)/i)
| ParentBaseFileName=/^(mshta|msiexec|rundll32|regsvr32|powershell|pwsh|wscript|cscript)\.exe$/i
| table([@timestamp, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine], limit=200)