ClickFix - Matanbuchus Full Kill-Chain Sequence

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•2

This rule detects a specific kill chain involving PowerShell executing ClickFix, followed by rundll32 loading Matanbuchus, and finally, an AstarionRAT executable running from the AppData folder. The detection logic links these events by device ID and within specific timeframes (5 minutes between ClickFix and Matanbuchus, and 10 minutes between Matanbuchus and AstarionRAT).