Potential ClickFix Execution Pattern - Registry

Severity: high
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Source: upstream

Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links. ClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages. Through the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content, such as one-liners that execute remotely hosted malicious files or scripts.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204.001` User Execution: Malicious Link

Event coverage

Provider	Event ID	Title
Sysmon	13	RegistryEvent (Value Set)

Stages and Predicates

Stage 1: `all of selection_registry`

TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\'

Stage 2: `all of selection_details`

or:
Details|contains: 'http://'
Details|contains: 'https://'

Stage 3: `all of selection_susp_pattern`

or:
Details|contains: '%comspec%'
Details|contains: account
Details|contains: anti-bot
Details|contains: bitsadmin
Details|contains: botcheck
Details|contains: captcha
Details|contains: certutil
Details|contains: challenge
Details|contains: cmd
Details|contains: confirmation
Details|contains: cscript
Details|contains: curl
Details|contains: finger
Details|contains: fraud
Details|contains: human
Details|contains: identification
Details|contains: identificator
Details|contains: identity
Details|contains: mshta
Details|contains: powershell
Details|contains: pwsh
Details|contains: regsvr32
Details|contains: robot
Details|contains: rundll32
Details|contains: schtasks
Details|contains: validation
Details|contains: verification
Details|contains: verify
Details|contains: wget
Details|contains: wscript

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`Details`	match	`%comspec%` corpus 2 (sigma 2) `account` corpus 2 (sigma 2) `anti-bot` corpus 2 (sigma 2) `bitsadmin` corpus 2 (sigma 2) `botcheck` corpus 2 (sigma 2) `captcha` corpus 2 (sigma 2) `certutil` corpus 2 (sigma 2) `challenge` corpus 2 (sigma 2) `cmd` corpus 3 (sigma 3) `confirmation` corpus 2 (sigma 2) `cscript` corpus 4 (sigma 4) `curl` corpus 2 (sigma 2) `finger` corpus 2 (sigma 2) `fraud` corpus 2 (sigma 2) `http://` `https://` `human` corpus 2 (sigma 2) `identification` corpus 2 (sigma 2) `identificator` corpus 2 (sigma 2) `identity` corpus 2 (sigma 2) `mshta` corpus 4 (sigma 4) `powershell` corpus 8 (sigma 8) `pwsh` corpus 4 (sigma 4) `regsvr32` corpus 3 (sigma 3) `robot` corpus 2 (sigma 2) `rundll32` corpus 4 (sigma 4) `schtasks` corpus 2 (sigma 2) `validation` corpus 2 (sigma 2) `verification` corpus 2 (sigma 2) `verify` corpus 2 (sigma 2) `wget` corpus 2 (sigma 2) `wscript` corpus 4 (sigma 4)
`TargetObject`	match	`\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\`