attack.t1204.001

Suspicious Execution via macOS Script Editor

Apr 28, 2026 · attack.defense-impairment attack.t1566 attack.t1566.002 attack.initial-access attack.t1059 attack.t1059.002 attack.t1204 attack.t1204.001 attack.execution attack.persistence attack.t1553 ·

Share on:

Detects when the macOS Script Editor utility spawns an unusual child process.

Potential ClickFix Execution Pattern - Registry

Nov 27, 2025 · attack.execution attack.t1204.001 ·

Share on:

Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links. ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages. Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content, such as one-liners that execute remotely hosted malicious files or scripts.

Suspicious ClickFix/FileFix Execution Pattern

Nov 21, 2025 · attack.execution attack.t1204.001 attack.t1204.004 ·

Share on:

Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.

Symlink Etc Passwd

Aug 12, 2024 · attack.t1204.001 attack.execution ·

Share on:

Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd