bigint ttp https://ludovic-coulon.com/blog/malware-analysis-clickfix-ton-node-rat/

Author: LasCC

s1_powerquery_hunting.json

@@ -7,7 +7,7 @@
     {
         "category": "Execution & TTPs",
         "name": "Clickfix TTP detected",
-        "query": "((src.process.name contains:anycase (\"powershell.exe\", \"cmd.exe\") and tgt.process.cmdline contains:anycase (\"mshta\",\"-w 1\",\"-w h\",\"/c curl \",\"iex \",\"iwr \",\"msiexec \") and tgt.process.cmdline contains:anycase \"http\") OR (src.process.parent.name = \"explorer.exe\" and src.process.cmdline contains:anycase (\"mshta\",\"-w 1\",\"-w h\",\"/c curl \",\"iex \",\"iwr \",\"msiexec \",\"irm \") and src.process.cmdline contains:anycase \"http\") OR src.process.cmdline contains:anycase (\"iex(irm\", \"iex(iwr\",\"|iex\", \"| iex\", \").Content\", \"[ScriptBlock]::Create\", \"gal i?x\", \"gal i*x\", \"gcm i?x\", \"gcm i*x\") OR (src.process.cmdline contains:anycase \"UTF8.GetString\" AND src.process.cmdline contains:anycase (\"New-Object byte[\", \"[byte]('0x\"))) NOT (tgt.process.cmdline contains (\"chocolatey.org\",\"astral.sh/uv/install.ps1 \") OR src.process.cmdline contains (\"chocolatey.org\",\"astral.sh/uv/install.ps1 \"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.dns.request\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllTgtCmdlines, event.dns.request, Count\n| sort -Count\n| limit 100000"
+        "query": "((src.process.name contains:anycase (\"powershell.exe\", \"cmd.exe\") and tgt.process.cmdline contains:anycase (\"mshta\",\"-w 1\",\"-w h\",\"/c curl \",\"iex \",\"iwr \",\"msiexec \") and tgt.process.cmdline contains:anycase \"http\") OR (src.process.parent.name = \"explorer.exe\" and src.process.cmdline contains:anycase (\"mshta\",\"-w 1\",\"-w h\",\"/c curl \",\"iex \",\"iwr \",\"msiexec \",\"irm \") and src.process.cmdline contains:anycase \"http\") OR src.process.cmdline contains:anycase (\"iex(irm\", \"iex(iwr\",\"|iex\", \"| iex\", \").Content\", \"[ScriptBlock]::Create\", \"gal i?x\", \"gal i*x\", \"gcm i?x\", \"gcm i*x\",\"[bigint]\") OR (src.process.cmdline contains:anycase \"UTF8.GetString\" AND src.process.cmdline contains:anycase (\"New-Object byte[\", \"[byte]('0x\"))) NOT (tgt.process.cmdline contains (\"chocolatey.org\",\"astral.sh/uv/install.ps1 \") OR src.process.cmdline contains (\"chocolatey.org\",\"astral.sh/uv/install.ps1 \"))\n| group _FirstSeenMs=min(event.time), _LastSeenMs=max(event.time), Count=count(), UniqueSrcCmdlines=array_agg_distinct(src.process.cmdline), UniqueTgtCmdlines=array_agg_distinct(tgt.process.cmdline) by endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, event.dns.request\n| let _firstSeenNs = _FirstSeenMs * 1000000\n| let _lastSeenNs = _LastSeenMs * 1000000\n| let AllSrcCmdlines = UniqueSrcCmdlines.to_string(', '), AllTgtCmdlines = UniqueTgtCmdlines.to_string(', ')\n| columns  \"first.timestamp\" = _firstSeenNs, \"last.timestamp\" = _lastSeenNs, endpoint.name, src.process.user, src.process.parent.name, src.process.name, src.process.verified, AllSrcCmdlines, AllTgtCmdlines, event.dns.request, Count\n| sort -Count\n| limit 100000"
     },
     {
         "category": "Execution & TTPs",