Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation. Logsource: windows / process_creation. Rule: title: Suspicious ClickFix/FileFix Execution Pattern id: d487ed4a-fd24-436d-a0b2-f4e95f7b2635 related: - id: f5fe36cf-f1ec-4c23-903d-09a3110f6bbb type: similar status: experimental description: 'Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems. ' references: - https://github.com/JohnHammond/recaptcha-phish - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/ - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2 - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-19 tags: - attack.execution - attack.t1204.001 - attack.t1204.004 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \explorer.exe CommandLine|contains: '#' selection_cli_captcha: CommandLine|contains: - account - anti-bot - botcheck - captcha - challenge - confirmation - fraud - human - identification - identificator - identity - robot - validation - verification - verify condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.. Logsource: windows / process_creation. Rule: title: Dumping of Sensitive Hives Via Reg.EXE id: fd877b94-9bb5-4191-bb25-d79cbd93c167 related: - id: 038cd51c-3ad8-41c5-ba8f-5d1c92f3cc1e type: obsolete - id: 4d6c9da1-318b-4edf-bcea-b6c93fa98fd0 type: obsolete status: test description: Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives. references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://eqllib.readthedocs.io/en/latest/analytics/aed95fc6-5e3f-49dc-8b35-06508613f979.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113 date: 2019-10-22 modified: 2023-12-13 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - car.2013-07-001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli_flag: CommandLine|contains: - ' save ' - ' export ' - ' ˢave ' - ' eˣport ' selection_cli_hklm: CommandLine|contains: - hklm - hk˪m - hkey_local_machine - hkey_˪ocal_machine - hkey_loca˪_machine - hkey_˪oca˪_machine selection_cli_hive: CommandLine|contains: - \system - \sam - \security - \ˢystem - \syˢtem - \ˢyˢtem - \ˢam - \ˢecurity condition: all of selection_* falsepositives: - Dumping hives for legitimate purpouse i.e. backup or forensic investigation level: high