Query: rule covering Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation
Matching passage: Sigma rule: Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation. Logsource: windows / process_creation. Rule: title: Suspicious ClickFix/FileFix Execution Pattern id: d487ed4a-fd24-436d-a0b2-f4e95f7b2635 related: - id: f5fe36cf-f1ec-4c23-903d-09a3110f6bbb type: similar status: experimental description: 'Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems. ' references: - https://github.com/JohnHammond/recaptcha-phish - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/ - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2 - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-19 tags: - attack.execution - attack.t1204.001 - attack.t1204.004 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \explorer.exe CommandLine|contains: '#' selection_cli_captcha: CommandLine|contains: - account - anti-bot - botcheck - captcha - challenge - confirmation - fraud - human - identification - identificator - identity - robot - validation - verification - verify condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware. Logsource: windows / process_creation. Rule: title: Windows Backup Deleted Via Wbadmin.EXE id: 89f75308-5b1b-4390-b2d8-d6b2340efaf8 related: - id: 639c9081-f482-47d3-a0bd-ddee3d4ecd76 type: derived status: test description: 'Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md - https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/ - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-13 modified: 2024-05-10 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection_cli: CommandLine|contains|all: - 'delete ' - backup filter_main_keep_versions: CommandLine|contains: keepVersions:0 condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate backup activity from administration scripts and software. level: medium