Potential ClickFix Command via Windows Run Dialog

  1[metadata]
  2creation_date = "2026/09/24"
  3integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
  4maturity = "production"
  5updated_date = "2026/09/24"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies suspicious commands written to the Windows Run dialog history (RunMRU) by explorer.exe. Adversaries socially
 11engineer users to copy and paste malicious commands for execution, a pattern commonly seen in Fake CAPTCHA (ClickFix)
 12campaigns. Investigate the process tree for a child of explorer.exe that matches the stored command.
 13"""
 14from = "now-9m"
 15language = "esql"
 16license = "Elastic License v2"
 17name = "Potential ClickFix Command via Windows Run Dialog"
 18note = """## Triage and analysis
 19
 20### Investigating Potential ClickFix Command via Windows Run Dialog
 21
 22#### Possible investigation steps
 23
 24- What command was stored in the Run dialog history?
 25  - Why: RunMRU records the command submitted through the Windows Run dialog. ClickFix and Fake CAPTCHA pages instruct the victim to paste that command.
 26  - Focus:`registry.data.strings`.
 27  - Implication: escalate when the string downloads content, decodes a payload, hides the window, or hands execution to PowerShell, cmd, mshta, msiexec, rundll32, certutil, curl, wget, or bitsadmin. Lower suspicion only when the same string is a bounded support or install command from a recognized workflow.
 28
 29- Did explorer.exe launch a child that matches the stored command?
 30  - Why: the alerting process is explorer.exe writing Run dialog history. The pasted command runs as a child of that explorer instance.
 31  - Focus: child process starts where `process.parent.entity_id` equals the alert `process.entity_id`. Compare child `process.name`, `process.executable`, and `process.command_line` with `registry.data.strings`. 
 32  - Implication: escalate when a child shell, script host, or living-off-the-land binary matches the RunMRU string. No matching child leaves execution unproven.
 33
 34- What did that child do next?
 35  - Focus: descendants of the recovered child `process.entity_id`, plus file and network events scoped to that child. Review `process.command_line`, `file.path`, `dns.question.name`, and `destination.ip`.
 36  - Hint: if the child entity id is absent, fall back to `host.id` plus the child `process.pid` in a tight window. Missing file or network telemetry leaves those questions unresolved.
 37  - Implication: escalate when the child retrieves a payload, writes a script or executable under a user-writable path, spawns further shells, or contacts an unusual destination.
 38
 39- Does the user and host context fit a planned paste-and-run action?
 40  - Focus: `user.id`, `user.name`, `host.id`, and `host.name`, plus browser, chat, or mail activity just before the RunMRU write.
 41  - Implication: escalate when an end-user host has no change window for the command. A lab or awareness exercise is lower suspicion only when the command, user, and host all match that exercise.
 42
 43- Escalate when the RunMRU command shows download, decode, hidden execution, or living-off-the-land staging and the process tree, artifacts, destinations, or related alerts support execution. Close only when the stored command, launched child, user, and host bind to one authorized simulation or lab workflow with no contradiction. If evidence is mixed or visibility is incomplete, preserve evidence and escalate.
 44
 45### False positive analysis
 46
 47- Security-awareness, phishing-simulation, red-team, and malware-analysis labs can paste these commands into the Run dialog. Confirm one workflow: the `registry.data.strings` value, the expected child `process.executable` and `process.command_line`, and a bounded `user.id` / `host.id`, with recovered children and destinations inside the exercise.
 48- Administrators sometimes launch a signed installer or diagnostic through the Run dialog. Close only when the stored command and child process are that exact tool, with no download cradle, encoded command, or second-stage child.
 49- Before an exception, require the same `registry.data.strings` fragment, `user.id`, and `host.id` across prior alerts from this rule. Avoid exceptions on `explorer.exe`, the RunMRU path, or `user.name` alone.
 50
 51### Response and remediation
 52
 53- If confirmed benign, reverse temporary containment and record the command, child identity, `user.id`, and `host.id` that proved the workflow. Create an exception only when that exact workflow recurs.
 54- If suspicious but unconfirmed, export the registry event, `registry.data.strings`, the explorer `process.entity_id`, and the child process tree, command lines, file paths, and destinations before cleanup. Apply reversible controls first, such as temporary destination blocks, a browser-session reset, or heightened monitoring. Isolate the host when retrieval or second-stage execution makes continued connectivity risky.
 55- If confirmed malicious, isolate the host, then terminate the child process and suspicious descendants after recording identifiers. Remove staged scripts, archives, and payloads, and block confirmed domains, IPs, hashes, or URLs. Reset credentials only when the investigation shows account misuse.
 56- Post-incident hardening: retain registry and process telemetry for Run dialog triage, review browser and paste-execution controls, and record the lure wording and paste-run chain in the case notes.
 57"""
 58references = [
 59  "https://www.elastic.co/security-labs/threat-command/telepuz-maas-malware-clickfix",  
 60  "https://www.elastic.co/security-labs/threat-command/mimicrat-custom-rat-mimics-c2-frameworks"
 61]
 62risk_score = 73
 63rule_id = "856a31f9-7869-4a5f-aca8-275a77629f19"
 64setup = """## Setup
 65
 66This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
 67
 68Setup instructions: https://ela.st/install-elastic-defend
 69
 70### Additional data sources
 71
 72This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
 73
 74- [CrowdStrike](https://ela.st/crowdstrike-integration)
 75- [Microsoft Defender XDR](https://ela.st/m365-defender)
 76- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
 77- [Sysmon Registry Events](https://ela.st/sysmon-event-reg-setup)
 78"""
 79severity = "high"
 80tags = [
 81    "Domain: Endpoint",
 82    "OS: Windows",
 83    "Use Case: Threat Detection",
 84    "Tactic: Execution",
 85    "Tactic: Defense Evasion",
 86    "Tactic: Command and Control",
 87    "Data Source: Elastic Defend",
 88    "Data Source: Sysmon",
 89    "Data Source: Microsoft Defender XDR",
 90    "Data Source: SentinelOne",
 91    "Data Source: Crowdstrike",
 92    "Resources: Investigation Guide",
 93    "Threat: ClickFix",
 94    "Threat: Living off the Land",
 95    "Rule Type: ES|QL",
 96    "Platform: Windows",
 97]
 98timestamp_override = "event.ingested"
 99type = "esql"
100
101query = '''
102from logs-endpoint.events.registry-*, logs-windows.sysmon_operational-*, winlogbeat-*,
103  logs-windows.forwarded-*, logs-m365_defender.event-*, logs-sentinel_one_cloud_funnel.*,
104  logs-crowdstrike.fdr* metadata _id, _version, _index
105| where KQL(""" host.os.type : "windows" AND event.category:"registry" AND process.name:explorer.exe AND event.type : ("creation" or "change") """)
106  and registry.data.strings is not null
107  and (
108    to_lower(registry.path) like """hkey_users\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
109    or to_lower(registry.path) like """\\registry\\user\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
110    or to_lower(registry.path) like """hku\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
111    or to_lower(registry.path) like """hkcu\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
112    or to_lower(registry.path) like """hkey_current_user\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
113  )
114  and not to_lower(registry.path) like """*\\runmru\\mrulist"""
115| eval registry_data = to_lower(mv_concat(registry.data.strings, " "))
116| where
117  // PowerShell / PowerShell 7 with suspicious arguments or content
118  (
119    (registry_data like "*powershell*" or registry_data like "*pwsh*") and
120    (
121      registry_data like "* -e *" or
122      registry_data like "* -ec *" or
123      registry_data like "* -en*" or
124      registry_data like "*irm *" or
125      registry_data like "*iwr *" or
126      registry_data like "*iex *" or
127      registry_data like "*iex(*" or
128      registry_data like "*invoke-restmethod*" or
129      registry_data like "*invoke-webrequest*" or
130      registry_data like "*invoke-expression*" or
131      registry_data like "*invoke-command*" or
132      registry_data like "*$executioncontext.invokecommand*" or
133      registry_data like "*webclient*" or
134      registry_data like "*downloadstring*" or
135      registry_data like "*downloadfile*" or
136      registry_data like "*http*" or
137      registry_data like "*bypass*" or
138      registry_data like "* -w* h*" or
139      registry_data like "* -w* mi*" or
140      registry_data like "*start-process*" or
141      registry_data like "*frombase64string*" or
142      registry_data like "*substring*" or
143      registry_data like "*+*+*+*"
144    )
145  )
146  or
147  // Remote content and script execution through other utilities
148  (
149    registry_data like "*msiexec*http*" or
150    registry_data like """*msiexec*\\\\*""" or
151    registry_data like "*mshta*http*" or
152    registry_data like "*mshta*javascript:*" or
153    registry_data like "*mshta*vbscript:*" or
154    registry_data like """*mshta*\\\\*""" or
155    registry_data like "*rundll32*http*" or
156    registry_data like "*rundll32*javascript:*" or
157    registry_data like """*rundll32*\\\\*""" or
158    registry_data like "*rundll32*mshtml*" or
159    registry_data like "*cmd*http*" or
160    registry_data like "*cmd*set*&set*" or
161    registry_data like "*conhost*--headless*" or
162    registry_data like "*forfiles* /c *" or
163    registry_data like "*certutil* -urlcache*" or
164    registry_data like "*certutil* -decode*" or
165    registry_data like "*curl*http*" or
166    registry_data like "*wget*http*" or
167    registry_data like "*bitsadmin*/transfer*" or
168    registry_data like "*|powershell*" or
169    registry_data like "*|pwsh*" or
170    registry_data like "*iex*irm *" or
171    registry_data like "*iex*iwr *"
172  )
173| keep _id, _version, _index, data_stream.namespace, @timestamp, event.dataset, user.id, user.name, user.domain, host.id, host.name, agent.id, process.name, process.entity_id, process.executable, process.pid, registry.data.strings, registry.path
174'''
175
176
177[[rule.threat]]
178framework = "MITRE ATT&CK"
179[[rule.threat.technique]]
180id = "T1059"
181name = "Command and Scripting Interpreter"
182reference = "https://attack.mitre.org/techniques/T1059/"
183[[rule.threat.technique.subtechnique]]
184id = "T1059.001"
185name = "PowerShell"
186reference = "https://attack.mitre.org/techniques/T1059/001/"
187
188[[rule.threat.technique.subtechnique]]
189id = "T1059.003"
190name = "Windows Command Shell"
191reference = "https://attack.mitre.org/techniques/T1059/003/"
192
193
194[[rule.threat.technique]]
195id = "T1204"
196name = "User Execution"
197reference = "https://attack.mitre.org/techniques/T1204/"
198[[rule.threat.technique.subtechnique]]
199id = "T1204.004"
200name = "Malicious Copy and Paste"
201reference = "https://attack.mitre.org/techniques/T1204/004/"
202
203
204
205[rule.threat.tactic]
206id = "TA0002"
207name = "Execution"
208reference = "https://attack.mitre.org/tactics/TA0002/"
209[[rule.threat]]
210framework = "MITRE ATT&CK"
211[[rule.threat.technique]]
212id = "T1218"
213name = "System Binary Proxy Execution"
214reference = "https://attack.mitre.org/techniques/T1218/"
215[[rule.threat.technique.subtechnique]]
216id = "T1218.005"
217name = "Mshta"
218reference = "https://attack.mitre.org/techniques/T1218/005/"
219
220[[rule.threat.technique.subtechnique]]
221id = "T1218.007"
222name = "Msiexec"
223reference = "https://attack.mitre.org/techniques/T1218/007/"
224
225[[rule.threat.technique.subtechnique]]
226id = "T1218.011"
227name = "Rundll32"
228reference = "https://attack.mitre.org/techniques/T1218/011/"
229
230
231
232[rule.threat.tactic]
233id = "TA0005"
234name = "Defense Evasion"
235reference = "https://attack.mitre.org/tactics/TA0005/"
236[[rule.threat]]
237framework = "MITRE ATT&CK"
238[[rule.threat.technique]]
239id = "T1105"
240name = "Ingress Tool Transfer"
241reference = "https://attack.mitre.org/techniques/T1105/"
242
243
244[rule.threat.tactic]
245id = "TA0011"
246name = "Command and Control"
247reference = "https://attack.mitre.org/tactics/TA0011/"
248
249[rule.investigation_fields]
250field_names = [
251    "@timestamp",
252    "host.name",
253    "host.id",
254    "user.name",
255    "user.id",
256    "process.entity_id",
257    "process.pid",
258    "process.name",
259    "process.executable",
260    "registry.path",
261    "registry.data.strings",
262]