Scarlet Goldfinch — Fake-Update / ClickFix → NetSupport & Remcos

Looks for: wscript/cscript running a .js from Downloads/Temp (esp. updateinstall*). Accomplishes: catches the legacy fake-update delivery path.

// HUNT: Scarlet Goldfinch fake-update JS loader
// MITRE: T1189, T1059.007 | CONF: high  FP: low  COST: low
// FP NOTES: legit .js automation rarely runs from Downloads/Temp via wscript
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(wscript|cscript)\.exe$/i
| CommandLine=/\.js("|\s|$)/i
| CommandLine=/\\(Downloads|Temp)\\|updateinstall/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Looks for: mshta/PowerShell parented by a browser/Explorer with iex+http. Accomplishes: catches the 2025+ ClickFix delivery pivot.

// HUNT: Scarlet Goldfinch ClickFix paste-and-run
// MITRE: T1204.004, T1059.001, T1218.005 | CONF: high  FP: low  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(explorer|chrome|msedge|firefox|brave|opera)\.exe$/i
| FileName=/^(mshta|powershell|pwsh|cmd)\.exe$/i
| CommandLine=/(iex|invoke-expression|mshta\s+http|DownloadString|FromBase64String|-enc(odedcommand)?\b).*?(http|\.zip)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: NetSupport client32.exe (or its files) executing from %ProgramData%/%AppData% rather than Program Files. Accomplishes: the decisive RAT-install signal. FP: sanctioned NetSupport in its managed path (allow-list).

// HUNT: NetSupport Manager RAT install path anomaly (Scarlet Goldfinch payload)
// MITRE: T1219 | CONF: high  FP: low  COST: low
// TUNING: if NetSupport is sanctioned, allow-list its managed \Program Files\ install path
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| (FileName=/^(client32|pcicapi|nskbfltr|remcmdstub)\.exe$/i or CommandLine=/client32\.ini|NetSupport/i)
| ImageFileName=/\\(ProgramData|Users\\[^\\]+\\AppData|Temp)\\/i
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData], limit=200)

Looks for: auto-start entries or Startup LNKs pointing at a binary in %ProgramData%/%AppData%. FP: some apps persist there — correlate with Q3 on the same host.

// HUNT: Scarlet Goldfinch RAT persistence
// MITRE: T1547.001, T1053.005 | CONF: medium  FP: medium  COST: low
// TUNING: correlate to Q3 on same aid; allow-list sanctioned auto-start apps
#event_simpleName=/AsepValueUpdate|ScheduledTaskRegistered|PeFileWritten/
| (RegStringValue=/\\(ProgramData|AppData)\\.+\.(exe|scr)/i or TargetFileName=/\\Start Menu\\Programs\\Startup\\/i or CommandLine=/\\(ProgramData|AppData)\\.+\.(exe)/i)
| table([@timestamp, ComputerName, UserName, RegObjectName, RegStringValue, TargetFileName, CommandLine], limit=200)

Looks for: Remcos artifacts (mutex/registry keys, install paths, common config strings). Accomplishes: catches the late-2025 alternate payload. FP: low — verify any hit.

// HUNT: Remcos RAT (Scarlet Goldfinch alt payload)
// MITRE: T1219, T1055 | CONF: med-high  FP: low-med  COST: low
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|AsepValueUpdate/
| (CommandLine=/remcos|\\Remcos\\|-no-restart.*-install/i or RegObjectName=/\\Software\\Remcos|\\Rmc-/i or ImageFileName=/\\(ProgramData|AppData)\\(remcos|rmc)/i)
| table([@timestamp, ComputerName, UserName, ImageFileName, CommandLine, RegObjectName], limit=200)

Looks for: outbound connections initiated by a binary in %ProgramData%/%AppData% (the RAT). FP: some apps run from there — correlate with Q3/Q5.

// HUNT: RAT C2 beacon from a user-writable path
// MITRE: T1219, T1071.001 | CONF: medium  FP: medium  COST: medium
// TUNING: correlate to Q3/Q5; exclude sanctioned apps that run from ProgramData
#event_simpleName=NetworkConnectIP4
| ContextImageFileName=/\\(ProgramData|Users\\[^\\]+\\AppData)\\.+\.exe$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/
| table([@timestamp, ComputerName, ContextImageFileName, RemoteAddressIP4, RemotePort], limit=200)