Clickfix Mshta Hex Encoded IP Address
Detects the execution of mshta.exe with a URL containing a hex-encoded second octet in an IP address. This is a specific pattern observed in the initial access stage of the ClickFix malware campaign.
YARA-L
Detects the execution of mshta.exe with a URL containing a hex-encoded second octet in an IP address. This is a specific pattern observed in the initial access stage of the ClickFix malware campaign.
Already have an account?