Cross-source coverage

T1204.004 / ATT&CK

User Execution: Malicious Copy and Paste

11 rules across 4 sources.

From MITRE ATT&CK 19.2

An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code.

Malicious websites, such as those used in Drive-by Compromise, may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine.

Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the "ClickFix" strategy.

Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.

Tactics: Execution
Platforms: Linux · macOS · Windows
Telemetry: WinEventLog:SecurityWinEventLog:PowerShellWinEventLog:SysmonNSM:Flowauditd:SYSCALLmacos:unifiedlogmacos:osquery

How MITRE says to detect it DET0340

User Execution – Malicious Copy & Paste (browser/email → shell with obfuscated one-liner) – T1204.004

Windows Analytic 0962

A user is socially engineered (web page, email, document) to open Run/PowerShell/CMD and paste an obfuscated one-liner. The chain is: (1) user context active in a browser/email/office app → (2) process creation of a command interpreter with suspicious arguments (base64/Invoke-Expression/web download/pipeline to shell) → (3) optional file drop in %TEMP% or %APPDATA% → (4) outbound network connection to an external domain. Events are correlated within a short window and with consistent user/session.

WinEventLog:Security EventCode=4688
WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
WinEventLog:Sysmon EventCode=11
WinEventLog:Sysmon EventCode=3, 22
NSM:Flow HTTP(S) requests with User-Agents typical of PowerShell or curl from desktop; or URIs matching paste-inspired payload hosts

Linux Analytic 0963

User pastes a multi-line or one-liner into a terminal (bash/zsh) that downloads/decodes and executes content. Chain: terminal exec of curl/wget/bash/sh with pipe to interpreter or base64-decode → transient file under /tmp|~/.cache → immediate outbound egress.

auditd:SYSCALL execve: exe in (/usr/bin/bash,/usr/bin/sh,/usr/bin/zsh,/usr/bin/python*) AND cmdline matches '(curl|wget).*(\||\|\s*sh|bash)|base64\s*-d|python\s*-c'
auditd:SYSCALL open: File creation under /tmp, /var/tmp, ~/.cache with executable bit or shell shebang
NSM:Flow New egress to Internet by the same UID/host shortly after terminal exec

macOS Analytic 0964

User pastes an obfuscated command into Terminal.app/iTerm2 that decodes or downloads code and executes. Detects Terminal/iTerm2 spawning bash/zsh/python with suspicious pipeline/base64 patterns followed by file writes in ~/Library or /tmp and outbound network connections.

macos:unifiedlog exec: ParentImage in (Terminal, iTerm2) AND Image in (/bin/zsh,/bin/bash,/usr/bin/python*) AND CommandLine matches '(curl|wget).*(\||\|\s*sh|bash)|base64 -D|python -c'
macos:osquery Interpreter exec with suspicious arguments as above
macos:unifiedlog create: New files in /tmp or ~/Library/Application Support/* with executable or script extensions
NSM:Flow Egress to non-approved networks from host after terminal exec

View on attack.mitre.org ↗

SigmaHQ/sigma

6 rules

Detection	Severity	Format
FileFix - Command Evidence in TypedPaths	High	Sigma
Suspicious ClickFix/FileFix Execution Pattern	High	Sigma
Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix	High	Sigma
Suspicious FileFix Execution Pattern	High	Sigma
Suspicious Space Characters in RunMRU Registry Path - ClickFix	High	Sigma
Suspicious Space Characters in TypedPaths Registry Path - FileFix	High	Sigma

elastic/detection-rules

3 rules

Detection	Severity	Format
Potential Execution via FileFix Phishing Attack	High	Elastic TOML
Potential Fake CAPTCHA Phishing Attack	High	Elastic TOML
XDG-Open Command Execution	Medium	Elastic TOML

Azure/Azure-Sentinel

1 rule

Detection	Severity	Format
RunMRU with non-ASCII characters	Undefined	KQL

elastic/protections-artifacts

1 rule

Detection	Severity	Format
Suspicious xdg-open Command Execution	Undefined	Elastic TOML