-
Potential ClickFix Command via Windows Run Dialog
Oct 5, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Execution Tactic: Defense Evasion Tactic: Command and Control Data Source: Elastic Defend Data Source: Sysmon Data Source: Microsoft Defender XDR Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide Threat: ClickFix Threat: Living off the Land Rule Type: ES|QL Platform: Windows ·Identifies suspicious commands written to the Windows Run dialog history (RunMRU) by explorer.exe. Adversaries socially engineer users to copy and paste malicious commands for execution, a pattern commonly seen in Fake CAPTCHA (ClickFix) campaigns. Investigate the process tree for a child of explorer.exe that matches the stored command.
Read More -
Potential FileFix Command via Windows Explorer Address Bar
Oct 5, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Execution Tactic: Defense Evasion Tactic: Initial Access Tactic: Command and Control Data Source: Elastic Defend Data Source: Sysmon Data Source: Microsoft Defender XDR Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide Threat: ClickFix Threat: Living off the Land Rule Type: ES|QL Platform: Windows ·Identifies suspicious commands written to the Windows Explorer address bar history (TypedPaths). Adversaries socially engineer users to paste a command into the address bar of File Explorer or of a browser's file upload dialog, a pattern known as FileFix; the writing process is therefore explorer.exe or the browser hosting the dialog. Stored commands that invoke PowerShell, cmd, mshta, msiexec, rundll32, or another living-off-the-land binary are unusual for this key, which normally contains file and folder paths. Investigate the process tree for a child of the writing process that matches the stored command.
Read More -
Potential Execution via FileFix Phishing Attack
Sep 28, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Execution Data Source: Windows Security Event Logs Data Source: Elastic Defend Data Source: Sysmon Data Source: SentinelOne Data Source: Microsoft Defender XDR Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: ClickFix Threat: Living off the Land Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies the execution of Windows commands or downloaded files via the browser's dialog box. Adversaries may use phishing to instruct the victim to copy and paste malicious commands for execution via crafted phishing web pages.
Read More -
Identifies PowerShell script blocks that print a fake Cloudflare verification lure. TerminalFix pages instruct the victim to paste a command into Windows Terminal or PowerShell. The script presents messages such as "Cloudflare verification", "Cloudflare ID:", or "I am not a robot" while it stages a payload. Review the full script block for download, extraction, and follow-on execution.
Read More -
Potential Fake CAPTCHA Phishing Attack
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Execution Data Source: Windows Security Event Logs Data Source: Elastic Defend Data Source: Sysmon Data Source: SentinelOne Data Source: Microsoft Defender XDR Data Source: Crowdstrike Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: ClickFix Threat: Living off the Land Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies potential fake CAPTCHA phishing attacks based on PowerShell, Cmd, or Mshta command-line values. Adversaries employ this technique via compromised websites with browser injects, posing either as fake CAPTCHAs to access the site or as a page loading error requiring a fix to display the page. The victim is instructed to copy and paste a malicious command to the Windows Run dialog box.
Read More