Potential ClickFix Command via Windows Run Dialog

[metadata]
creation_date = "2026/09/24"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
maturity = "production"
updated_date = "2026/09/24"

[rule]
author = ["Elastic"]
description = """
Identifies suspicious commands written to the Windows Run dialog history (RunMRU) by explorer.exe. Adversaries socially
engineer users to copy and paste malicious commands for execution, a pattern commonly seen in Fake CAPTCHA (ClickFix)
campaigns. Investigate the process tree for a child of explorer.exe that matches the stored command.
"""
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Potential ClickFix Command via Windows Run Dialog"
note = """## Triage and analysis

### Investigating Potential ClickFix Command via Windows Run Dialog

#### Possible investigation steps

- What command was stored in the Run dialog history?
  - Why: RunMRU records the command submitted through the Windows Run dialog. ClickFix and Fake CAPTCHA pages instruct the victim to paste that command.
  - Focus:`registry.data.strings`.
  - Implication: escalate when the string downloads content, decodes a payload, hides the window, or hands execution to PowerShell, cmd, mshta, msiexec, rundll32, certutil, curl, wget, or bitsadmin. Lower suspicion only when the same string is a bounded support or install command from a recognized workflow.

- Did explorer.exe launch a child that matches the stored command?
  - Why: the alerting process is explorer.exe writing Run dialog history. The pasted command runs as a child of that explorer instance.
  - Focus: child process starts where `process.parent.entity_id` equals the alert `process.entity_id`. Compare child `process.name`, `process.executable`, and `process.command_line` with `registry.data.strings`. 
  - Implication: escalate when a child shell, script host, or living-off-the-land binary matches the RunMRU string. No matching child leaves execution unproven.

- What did that child do next?
  - Focus: descendants of the recovered child `process.entity_id`, plus file and network events scoped to that child. Review `process.command_line`, `file.path`, `dns.question.name`, and `destination.ip`.
  - Hint: if the child entity id is absent, fall back to `host.id` plus the child `process.pid` in a tight window. Missing file or network telemetry leaves those questions unresolved.
  - Implication: escalate when the child retrieves a payload, writes a script or executable under a user-writable path, spawns further shells, or contacts an unusual destination.

- Does the user and host context fit a planned paste-and-run action?
  - Focus: `user.id`, `user.name`, `host.id`, and `host.name`, plus browser, chat, or mail activity just before the RunMRU write.
  - Implication: escalate when an end-user host has no change window for the command. A lab or awareness exercise is lower suspicion only when the command, user, and host all match that exercise.

- Escalate when the RunMRU command shows download, decode, hidden execution, or living-off-the-land staging and the process tree, artifacts, destinations, or related alerts support execution. Close only when the stored command, launched child, user, and host bind to one authorized simulation or lab workflow with no contradiction. If evidence is mixed or visibility is incomplete, preserve evidence and escalate.

### False positive analysis

- Security-awareness, phishing-simulation, red-team, and malware-analysis labs can paste these commands into the Run dialog. Confirm one workflow: the `registry.data.strings` value, the expected child `process.executable` and `process.command_line`, and a bounded `user.id` / `host.id`, with recovered children and destinations inside the exercise.
- Administrators sometimes launch a signed installer or diagnostic through the Run dialog. Close only when the stored command and child process are that exact tool, with no download cradle, encoded command, or second-stage child.
- Before an exception, require the same `registry.data.strings` fragment, `user.id`, and `host.id` across prior alerts from this rule. Avoid exceptions on `explorer.exe`, the RunMRU path, or `user.name` alone.

### Response and remediation

- If confirmed benign, reverse temporary containment and record the command, child identity, `user.id`, and `host.id` that proved the workflow. Create an exception only when that exact workflow recurs.
- If suspicious but unconfirmed, export the registry event, `registry.data.strings`, the explorer `process.entity_id`, and the child process tree, command lines, file paths, and destinations before cleanup. Apply reversible controls first, such as temporary destination blocks, a browser-session reset, or heightened monitoring. Isolate the host when retrieval or second-stage execution makes continued connectivity risky.
- If confirmed malicious, isolate the host, then terminate the child process and suspicious descendants after recording identifiers. Remove staged scripts, archives, and payloads, and block confirmed domains, IPs, hashes, or URLs. Reset credentials only when the investigation shows account misuse.
- Post-incident hardening: retain registry and process telemetry for Run dialog triage, review browser and paste-execution controls, and record the lure wording and paste-run chain in the case notes.
"""
references = [
  "https://www.elastic.co/security-labs/threat-command/telepuz-maas-malware-clickfix",  
  "https://www.elastic.co/security-labs/threat-command/mimicrat-custom-rat-mimics-c2-frameworks"
]
risk_score = 73
rule_id = "856a31f9-7869-4a5f-aca8-275a77629f19"
setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
"""
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Use Case: Threat Detection",
    "Tactic: Execution",
    "Tactic: Defense Evasion",
    "Tactic: Command and Control",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Microsoft Defender XDR",
    "Data Source: SentinelOne",
    "Data Source: Crowdstrike",
    "Resources: Investigation Guide",
    "Threat: ClickFix",
    "Threat: Living off the Land",
    "Rule Type: ES|QL",
    "Platform: Windows",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-endpoint.events.registry-*, logs-windows.sysmon_operational-*, winlogbeat-*,
  logs-windows.forwarded-*, logs-m365_defender.event-*, logs-sentinel_one_cloud_funnel.*,
  logs-crowdstrike.fdr* metadata _id, _version, _index
| where KQL(""" host.os.type : "windows" AND event.category:"registry" AND process.name:explorer.exe AND event.type : ("creation" or "change") """)
  and registry.data.strings is not null
  and (
    to_lower(registry.path) like """hkey_users\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """\\registry\\user\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """hku\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """hkcu\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """hkey_current_user\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
  )
  and not to_lower(registry.path) like """*\\runmru\\mrulist"""
| eval registry_data = to_lower(mv_concat(registry.data.strings, " "))
| where
  // PowerShell / PowerShell 7 with suspicious arguments or content
  (
    (registry_data like "*powershell*" or registry_data like "*pwsh*") and
    (
      registry_data like "* -e *" or
      registry_data like "* -ec *" or
      registry_data like "* -en*" or
      registry_data like "*irm *" or
      registry_data like "*iwr *" or
      registry_data like "*iex *" or
      registry_data like "*iex(*" or
      registry_data like "*invoke-restmethod*" or
      registry_data like "*invoke-webrequest*" or
      registry_data like "*invoke-expression*" or
      registry_data like "*invoke-command*" or
      registry_data like "*$executioncontext.invokecommand*" or
      registry_data like "*webclient*" or
      registry_data like "*downloadstring*" or
      registry_data like "*downloadfile*" or
      registry_data like "*http*" or
      registry_data like "*bypass*" or
      registry_data like "* -w* h*" or
      registry_data like "* -w* mi*" or
      registry_data like "*start-process*" or
      registry_data like "*frombase64string*" or
      registry_data like "*substring*" or
      registry_data like "*+*+*+*"
    )
  )
  or
  // Remote content and script execution through other utilities
  (
    registry_data like "*msiexec*http*" or
    registry_data like """*msiexec*\\\\*""" or
    registry_data like "*mshta*http*" or
    registry_data like "*mshta*javascript:*" or
    registry_data like "*mshta*vbscript:*" or
    registry_data like """*mshta*\\\\*""" or
    registry_data like "*rundll32*http*" or
    registry_data like "*rundll32*javascript:*" or
    registry_data like """*rundll32*\\\\*""" or
    registry_data like "*rundll32*mshtml*" or
    registry_data like "*cmd*http*" or
    registry_data like "*cmd*set*&set*" or
    registry_data like "*conhost*--headless*" or
    registry_data like "*forfiles* /c *" or
    registry_data like "*certutil* -urlcache*" or
    registry_data like "*certutil* -decode*" or
    registry_data like "*curl*http*" or
    registry_data like "*wget*http*" or
    registry_data like "*bitsadmin*/transfer*" or
    registry_data like "*|powershell*" or
    registry_data like "*|pwsh*" or
    registry_data like "*iex*irm *" or
    registry_data like "*iex*iwr *"
  )
| keep _id, _version, _index, data_stream.namespace, @timestamp, event.dataset, user.id, user.name, user.domain, host.id, host.name, agent.id, process.name, process.entity_id, process.executable, process.pid, registry.data.strings, registry.path
'''


[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[rule.threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"

[[rule.threat.technique.subtechnique]]
id = "T1059.003"
name = "Windows Command Shell"
reference = "https://attack.mitre.org/techniques/T1059/003/"


[[rule.threat.technique]]
id = "T1204"
name = "User Execution"
reference = "https://attack.mitre.org/techniques/T1204/"
[[rule.threat.technique.subtechnique]]
id = "T1204.004"
name = "Malicious Copy and Paste"
reference = "https://attack.mitre.org/techniques/T1204/004/"



[rule.threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"
[[rule.threat.technique.subtechnique]]
id = "T1218.005"
name = "Mshta"
reference = "https://attack.mitre.org/techniques/T1218/005/"

[[rule.threat.technique.subtechnique]]
id = "T1218.007"
name = "Msiexec"
reference = "https://attack.mitre.org/techniques/T1218/007/"

[[rule.threat.technique.subtechnique]]
id = "T1218.011"
name = "Rundll32"
reference = "https://attack.mitre.org/techniques/T1218/011/"



[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1105"
name = "Ingress Tool Transfer"
reference = "https://attack.mitre.org/techniques/T1105/"


[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.name",
    "host.id",
    "user.name",
    "user.id",
    "process.entity_id",
    "process.pid",
    "process.name",
    "process.executable",
    "registry.path",
    "registry.data.strings",
]