Interlock Ransomware — CORNFLAKE / FLUTECLICK Web-Compromise Chain

Looks for: a hidden-window PowerShell child of explorer/a browser that pulls and executes remote code from a :8080 host — the ClickFix paste-execution pattern.

// HUNT: ClickFix PowerShell one-liner spawned from Run dialog / browser
// MITRE: T1204.004, T1059.001
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: rare admin one-liners using irm/iex interactively
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/\\powershell(\.exe)?$/i
| ParentBaseFileName=/^(explorer|mshta|msedge|chrome|firefox|brave)\.exe$/i
| CommandLine=/(irm|Invoke-RestMethod|iex|Invoke-Expression)/i
| CommandLine=/:8080|TotalSeconds|-band|-w\s+h|windowstyle\s+hidden/i
| table([ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, aid], limit=200)

Looks for: the portable node.exe dropped under AppData\Roaming\node-v22.11.0-win-x64 running an inline -e script or the init1234 beacon path — the CORNFLAKE in-memory backdoor. This is the single highest-value hunt in the pack.

// HUNT: Node.js runtime executing inline script from AppData (CORNFLAKE.V3)
// MITRE: T1059.007, T1105
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: legitimate node.exe normally runs from Program Files, not AppData\Roaming
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/\\node\.exe$/i
| ImageFileName=/\\AppData\\Roaming\\node-v22\.11\.0-win-x64\\/i
| CommandLine=/\s-e\s|init1234/i
| table([ComputerName, UserName, ImageFileName, CommandLine, SHA256HashData, aid], limit=200)

Looks for: a CurrentVersion\Run value named ChromeUpdater or TimeSync. FP: genuine Google updates use GoogleUpdate/GoogleChromeAutoLaunch, not ChromeUpdater; still baseline before alerting.

// HUNT: CORNFLAKE persistence via HKCU Run key (ChromeUpdater / TimeSync)
// MITRE: T1547.001
// CONF: high  FP: medium  COST: low | REQUIRES: AsepValueUpdate
// FALSE POSITIVES: legitimate updater Run values on some OEM images
// TUNING: alert only when RegStringValue points at AppData\Roaming and ends in .log/.js or node.exe; exclude signed GoogleUpdate paths under Program Files
#event_simpleName=/AsepValueUpdate|RegGenericValueUpdate/
| RegObjectName=/\\CurrentVersion\\Run$/i
| RegValueName=/ChromeUpdater|TimeSync/i
| table([ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid], limit=200)

Looks for: scheduled tasks named to blend with time-sync / defrag maintenance. FP: the built-in ScheduledDefrags task exists on many builds — discriminate on the task action.

// HUNT: Masquerading scheduled task (TimeSync / Defrag) for RAT persistence
// MITRE: T1053.005
// CONF: medium  FP: medium  COST: low | REQUIRES: ScheduledTaskRegistered
// FALSE POSITIVES: genuine Windows ScheduledDefrags maintenance task
// TUNING: exclude TaskExecutable=%SystemRoot%\System32\defrag.exe and w32tm.exe; alert when the action runs node.exe/rundll32/powershell from AppData
#event_simpleName=ScheduledTaskRegistered
| TaskName=/TimeSync|TimeSyncro|TimeSyncDrive|TempDefrag|ScheduledDefrags/i
| table([ComputerName, UserName, TaskName, TaskExecutable, aid], limit=200)

Looks for: a *.trycloudflare.com lookup made by node/rundll32/conhost — free Quick-Tunnel C2. FP: developers legitimately use Cloudflare Quick Tunnels.

// HUNT: node.exe/rundll32 resolving a trycloudflare.com tunnel (masked C2)
// MITRE: T1071.001, T1572
// CONF: medium  FP: medium  COST: medium | REQUIRES: DnsRequest
// FALSE POSITIVES: developer / IT use of Cloudflare Quick Tunnels
// TUNING: restrict to requestors under AppData and exclude known developer hosts/allowlisted tunnel names
#event_simpleName=DnsRequest
| DomainName=/\.trycloudflare\.com$/i
| ContextBaseFileName=/^(node|rundll32|conhost|cloudflared)\.exe$/i
| table([ComputerName, DomainName, ContextBaseFileName, aid], limit=200)

Looks for: the CORNFLAKE recon combo — SPN sweep, domain-trust listing, privilege check. FP: admins run these interactively; the discriminator is a node.exe/powershell-from-AppData parent.

// HUNT: SPN sweep + domain-trust enumeration (CORNFLAKE recon)
// MITRE: T1558.003, T1482, T1087.002
// CONF: medium  FP: medium  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: administrators running setspn/nltest interactively
// TUNING: exclude tier-0 admin jump hosts; prioritize when ParentBaseFileName is node.exe or powershell launched from AppData
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/setspn\s+-t|nltest\s+\/(dclist|domain_trusts)|whoami\s+\/all/i
| table([ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, aid], limit=200)

Looks for: disk-snapshot / virtual-disk-clone tooling used to read ntds.dit at the volume level, evading EDR that only watches live ntdsutil on the DC. Rare and high-signal.

// HUNT: Offline NTDS.dit extraction via disk snapshot / VHD clone (EDR evasion)
// MITRE: T1003.003, T1006
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: backup/imaging software using VSS on schedule (baseline your backup account)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/diskshadow|Mount-VHD|Mount-DiskImage|ntdsutil.*ifm|ntdsutil.*create\s+full|vssadmin\s+create\s+shadow/i
| table([ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, aid], limit=200)

Looks for: PsExec launching a bypass PowerShell that runs a remote .ps1 off a UNC \out\ share — the estate-wide encryptor deployment.

// HUNT: Ransomware push via PsExec running a remote .ps1 from an \out\ share
// MITRE: T1021.002, T1570, T1486
// CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: legit software deployment via PsExec (baseline your deployment accounts)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/\\PsExec(64)?\.exe$/i
| CommandLine=/-accepteula/i
| CommandLine=/powershell.*-ExecutionPolicy\s+Bypass.*-file\s+\\\\/i
| table([ComputerName, UserName, ImageFileName, CommandLine, aid], limit=200)

Looks for: files renamed with the Interlock extension family — encryption in progress. Pair with a per-host count threshold in a scheduled search.

// HUNT: Mass file writes with Interlock encryption extension
// MITRE: T1486
// CONF: high  FP: low  COST: medium | REQUIRES: FileCreateInfo
// FALSE POSITIVES: none expected; extension is attacker-specific
#event_simpleName=/FileCreateInfo|FileRename|RansomwareOpenFile/
| TargetFileName=/\.(interlock|1nt3r10ck|1nt3rlock)$/i
| table([ComputerName, UserName, TargetFileName, aid], limit=200)