Threat Detection Lead Details ClickFix Investigation and SOC Hunting Practices

Oct 23, 2025 · Original article ↗

Summary

Joseph Harrison discusses threat hunting and SOC operations, including an investigation that traced a blocked PowerShell download cradle to a ClickFix phishing page and led to new indicators being blocked.

Key points

An EDR alert showed a blocked PowerShell download cradle; the process chain through explorer.exe and CMD suggested manual execution consistent with ClickFix.
Network analysis uncovered a suspicious URL that sandbox analysis identified as a phishing page impersonating a known brand.
The investigation linked the activity to a reported RAT deployment campaign and found related phishing domains and URLs.
Searching the environment for the new indicators found no additional threats; the client blocked the domain and hosting IP.
Harrison says threat hunting combines intelligence-led searches, automated IOC processing, manual review, and continuously refined detection signatures.
He highlights the difficulty of detecting living-off-the-land activity and balancing detailed logging with collection costs.
He recommends human review before high-impact automated actions such as blocking domains.

Article Details

Defense Focus: Threat hunting, detection development, and incident response, including identifying phishing and ClickFix activity, malicious infrastructure, and suspicious use of legitimate tools.
Detection Methods: Review EDR alerts and process trees to identify suspicious execution chains, including explorer.exe launching CMD and then PowerShell.
Analyze network traffic from affected systems for suspicious domains and URLs; investigate suspected phishing sites in a sandbox.
Hunt for IOCs across the environment and correlate related domains, URLs, hosting IP addresses, and JA4 signatures.
Use threat intelligence and contextual analysis to distinguish anomalous or malicious activity from legitimate administrative and system activity.
Develop and refine detection signatures, validate and tune them using client feedback, and monitor known malicious signatures.
Use automation to process IOC sets, followed by manual review of findings; apply human review before high-impact automated blocking.
Data Sources: EDR alerts and process-tree telemetry
Network traffic from affected systems
JA4 signatures and encrypted-traffic patterns
System and application logs, including PowerShell logging
Threat intelligence from internal, open-source, and client-provided sources
Sandbox analysis results
IOC searches across the client environment
Rule Types: Detection signatures
Monitoring rules for known malicious signatures
PowerShell detections
IOC-based monitoring and blocking
Platforms: Hunt.io
Splunk UEBA
EDR solutions
Defensive Actions: Prioritize and ingest high-value, low-volume logs; address missing telemetry with supplementary collection methods.
Scope incidents by collecting logs that reveal attacker actions and movement while avoiding actions that could alert the adversary.
Investigate suspicious process chains and network indicators to establish root cause and extent of compromise.
Enrich and pivot from confirmed indicators to related domains, URLs, IP addresses, and malware artifacts, then search across the environment.
Communicate findings to clients and block newly identified malicious indicators after investigation.
Use analyst approval before automating high-impact actions such as IOC blocking; retain human checkpoints for potentially disruptive blocks.
Test detection and logging changes in a lab before deploying them to client environments.