%% Generated by tools/shroudcloud_archive.py from article frontmatter. Edits here are overwritten on the next run. %% Intrusion write-ups, newest first. Each one walks the intrusion stage by stage, with the command lines the operator ran and the detection logic next to the behavior it catches. > [!sc-card] [[ClickFix to IronPython]] > ![[image_bank/cards/clickfix_ironpython_execchain_card.png]] > > `2026-08-14` > > A caret-obfuscated finger command that pulls its batch script over TCP/79, renames curl to a .com file, downloads IronPython from GitHub as a fake PDF, and ends in a keylogger injected into explorer. > [!sc-card] [[ClickFix to NetSupport RAT]] > ![[image_bank/cards/clickfix_netsupport_execchain_card.png]] > > `2026-08-13` > > A fixconfig[.]app one-liner into a self-unpacking PowerShell loader that beacons the victim to Telegram, pulls NetSupport RAT out of a PNG, and persists from a hijacked Startup shortcut. > [!sc-card] [[ClickFix to EtherHiding]] > ![[image_bank/cards/clickfix_etherhiding_execchain_card.png]] > > `2026-07-21` > > A single pasted command that ran all the way to a Python RAT reading its C2 off the Ethereum blockchain. Decoding a ClickFix → EtherHiding → Python-loader chain. > [!sc-card] [[Operator Playbook Part 1 - The Lateral Movement Chokepoint]] > > `2026-04-17` `· updated 2026-09-08` > > Cross-RaaS analysis of lateral movement on Windows, organized by OS primitive rather than tool. Six primitives (WMI, Task Scheduler, SCM, WinRM, RDP, SMB) cover nearly all observed ransomware lateral movement. Native clients first, tool wrappers second, detection opportunities for each. > [!sc-card] [[Two PlayCrypt Intrusions Compared]] > > `2026-04-15` > > A comparative analysis of two distinct Play ransomware intrusions. Same closed operation, different environments, same playbook signature. Detection opportunities inline. > [!sc-card] [[Three Akira Intrusions Compared]] > > `2026-04-14` > > A comparative analysis of three distinct Akira ransomware intrusions. Same RaaS, different affiliates, different playbooks. Detection opportunities inline. > [!sc-card] [[Detection Lens - Targeting ClickFix]] > ![[image_bank/cards/fakecaptcha_canvas_card.png]] > > `2025-06-01` `· updated 2025-06-11` > > Diving into detection strategies for ClickFix (FakeCaptcha) > [!sc-card] [[Crafting Detections on Threat Actor Movement]] > ![[image_bank/cards/lateral_canvas_card.png]] > > `2025-02-27` > > Reviewing a late-stage FakeUpdates infection for detection opportunities (Part 2) > [!sc-card] [[Crafting Detections on IAB Behavior]] > ![[image_bank/cards/fakeupdates_site_to_detonation_card.png]] > > `2025-01-19` > > Reviewing a late-stage FakeUpdates infection for detection opportunities