Outbound Network Connection from ClickFix Payload Chain (PowerShell/MSI/PuTTY) o

Ibrahim Saud@tektrix

•updated Sep 22, 2026•0•0•2

This rule detects suspicious outbound network connections originating from processes frequently abused in the Exvicy/ErrTraffic ClickFix malware delivery chain, specifically powershell.exe, msiexec.exe, and putty.exe. It also monitors for direct communication to known C2 IP addresses associated with the Exvicy threat actor, providing coverage for both the initial payload delivery and post-compromise C2 phases.