-
Potential ClickFix Command via Windows Run Dialog
Sep 25, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Execution Tactic: Defense Evasion Tactic: Command and Control Data Source: Elastic Defend Data Source: Sysmon Data Source: Microsoft Defender XDR Data Source: SentinelOne Data Source: Crowdstrike Resources: Investigation Guide Threat: ClickFix Threat: Living off the Land Rule Type: ES|QL Platform: Windows ·Identifies suspicious commands written to the Windows Run dialog history (RunMRU) by explorer.exe. Adversaries socially engineer users to copy and paste malicious commands for execution, a pattern commonly seen in Fake CAPTCHA (ClickFix) campaigns. Investigate the process tree for a child of explorer.exe that matches the stored command.
Read More -
Potential Execution via FileFix Phishing Attack
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Execution Data Source: Windows Security Event Logs Data Source: Elastic Defend Data Source: Sysmon Data Source: SentinelOne Data Source: Microsoft Defender XDR Resources: Investigation Guide Noise: Medium Performance: Normal Profile: Recommended Threat: ClickFix Threat: Living off the Land Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies the execution of Windows commands or downloaded files via the browser's dialog box. Adversaries may use phishing to instruct the victim to copy and paste malicious commands for execution via crafted phishing web pages.
Read More -
Potential Fake CAPTCHA Phishing Attack
Sep 19, 2026 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Execution Data Source: Windows Security Event Logs Data Source: Elastic Defend Data Source: Sysmon Data Source: SentinelOne Data Source: Microsoft Defender XDR Data Source: Crowdstrike Resources: Investigation Guide Noise: Low Performance: Normal Profile: Recommended Threat: ClickFix Threat: Living off the Land Rule Type: Event Correlation (EQL) Platform: Windows ·Identifies potential fake CAPTCHA phishing attacks based on PowerShell, Cmd, or Mshta command-line values. Adversaries employ this technique via compromised websites with browser injects, posing either as fake CAPTCHAs to access the site or as a page loading error requiring a fix to display the page. The victim is instructed to copy and paste a malicious command to the Windows Run dialog box.
Read More