« Potential Chroot Container Escape via Mount Potential Code Execution via Postgresql »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

Potential ClickFix Command via Windows Run Dialog

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Potential ClickFix Command via Windows Run Dialog

edit

Identifies suspicious commands written to the Windows Run dialog history (RunMRU) by explorer.exe. Adversaries socially engineer users to copy and paste malicious commands for execution, a pattern commonly seen in Fake CAPTCHA (ClickFix) campaigns. Investigate the process tree for a child of explorer.exe that matches the stored command.

Rule type: esql

Rule indices: None

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • OS: Windows
  • Use Case: Threat Detection
  • Tactic: Execution
  • Tactic: Defense Evasion
  • Tactic: Command and Control
  • Data Source: Elastic Defend
  • Data Source: Sysmon
  • Data Source: Microsoft Defender XDR
  • Data Source: SentinelOne
  • Data Source: Crowdstrike
  • Resources: Investigation Guide
  • Threat: ClickFix
  • Threat: Living off the Land
  • Rule Type: ES|QL
  • Platform: Windows

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Potential ClickFix Command via Windows Run Dialog

Possible investigation steps

  • What command was stored in the Run dialog history?
  • Why: RunMRU records the command submitted through the Windows Run dialog. ClickFix and Fake CAPTCHA pages instruct the victim to paste that command.
  • Focus:registry.data.strings.
  • Implication: escalate when the string downloads content, decodes a payload, hides the window, or hands execution to PowerShell, cmd, mshta, msiexec, rundll32, certutil, curl, wget, or bitsadmin. Lower suspicion only when the same string is a bounded support or install command from a recognized workflow.
  • Did explorer.exe launch a child that matches the stored command?
  • Why: the alerting process is explorer.exe writing Run dialog history. The pasted command runs as a child of that explorer instance.
  • Focus: child process starts where process.parent.entity_id equals the alert process.entity_id. Compare child process.name, process.executable, and process.command_line with registry.data.strings.
  • Implication: escalate when a child shell, script host, or living-off-the-land binary matches the RunMRU string. No matching child leaves execution unproven.
  • What did that child do next?
  • Focus: descendants of the recovered child process.entity_id, plus file and network events scoped to that child. Review process.command_line, file.path, dns.question.name, and destination.ip.
  • Hint: if the child entity id is absent, fall back to host.id plus the child process.pid in a tight window. Missing file or network telemetry leaves those questions unresolved.
  • Implication: escalate when the child retrieves a payload, writes a script or executable under a user-writable path, spawns further shells, or contacts an unusual destination.
  • Does the user and host context fit a planned paste-and-run action?
  • Focus: user.id, user.name, host.id, and host.name, plus browser, chat, or mail activity just before the RunMRU write.
  • Implication: escalate when an end-user host has no change window for the command. A lab or awareness exercise is lower suspicion only when the command, user, and host all match that exercise.
  • Escalate when the RunMRU command shows download, decode, hidden execution, or living-off-the-land staging and the process tree, artifacts, destinations, or related alerts support execution. Close only when the stored command, launched child, user, and host bind to one authorized simulation or lab workflow with no contradiction. If evidence is mixed or visibility is incomplete, preserve evidence and escalate.

False positive analysis

  • Security-awareness, phishing-simulation, red-team, and malware-analysis labs can paste these commands into the Run dialog. Confirm one workflow: the registry.data.strings value, the expected child process.executable and process.command_line, and a bounded user.id / host.id, with recovered children and destinations inside the exercise.
  • Administrators sometimes launch a signed installer or diagnostic through the Run dialog. Close only when the stored command and child process are that exact tool, with no download cradle, encoded command, or second-stage child.
  • Before an exception, require the same registry.data.strings fragment, user.id, and host.id across prior alerts from this rule. Avoid exceptions on explorer.exe, the RunMRU path, or user.name alone.

Response and remediation

  • If confirmed benign, reverse temporary containment and record the command, child identity, user.id, and host.id that proved the workflow. Create an exception only when that exact workflow recurs.
  • If suspicious but unconfirmed, export the registry event, registry.data.strings, the explorer process.entity_id, and the child process tree, command lines, file paths, and destinations before cleanup. Apply reversible controls first, such as temporary destination blocks, a browser-session reset, or heightened monitoring. Isolate the host when retrieval or second-stage execution makes continued connectivity risky.
  • If confirmed malicious, isolate the host, then terminate the child process and suspicious descendants after recording identifiers. Remove staged scripts, archives, and payloads, and block confirmed domains, IPs, hashes, or URLs. Reset credentials only when the investigation shows account misuse.
  • Post-incident hardening: retain registry and process telemetry for Run dialog triage, review browser and paste-execution controls, and record the lure wording and paste-run chain in the case notes.

Setup

edit

Setup

This rule is designed for data generated by Elastic Defend, which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

Rule query

edit
from logs-endpoint.events.registry-*, logs-windows.sysmon_operational-*, winlogbeat-*,
  logs-windows.forwarded-*, logs-m365_defender.event-*, logs-sentinel_one_cloud_funnel.*,
  logs-crowdstrike.fdr* metadata _id, _version, _index
| where KQL(""" host.os.type : "windows" AND event.category:"registry" AND process.name:explorer.exe AND event.type : ("creation" or "change") """)
  and registry.data.strings is not null
  and (
    to_lower(registry.path) like """hkey_users\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """\\registry\\user\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """hku\\*\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """hkcu\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
    or to_lower(registry.path) like """hkey_current_user\\software\\microsoft\\windows\\currentversion\\explorer\\runmru\\*"""
  )
  and not to_lower(registry.path) like """*\\runmru\\mrulist"""
| eval registry_data = to_lower(mv_concat(registry.data.strings, " "))
| where
  // PowerShell / PowerShell 7 with suspicious arguments or content
  (
    (registry_data like "*powershell*" or registry_data like "*pwsh*") and
    (
      registry_data like "*-nop *" or
      registry_data like "* -e *" or
      registry_data like "* -ec *" or
      registry_data like "* -en*" or
      registry_data like "*irm *" or
      registry_data like "*iwr *" or
      registry_data like "*iex *" or
      registry_data like "*iex(*" or
      registry_data like "*invoke-restmethod*" or
      registry_data like "*invoke-webrequest*" or
      registry_data like "*invoke-expression*" or
      registry_data like "*invoke-command*" or
      registry_data like "*$executioncontext.invokecommand*" or
      registry_data like "*webclient*" or
      registry_data like "*downloadstring*" or
      registry_data like "*downloadfile*" or
      registry_data like "*http*" or
      registry_data like "*bypass*" or
      registry_data like "* -w* h*" or
      registry_data like "* -w* mi*" or
      registry_data like "* -w *" or
      registry_data like "*start-process*" or
      registry_data like "*frombase64string*" or
      registry_data like "*substring*" or
      registry_data like "*psitem.definition*" or
      registry_data like "*+*+*+*"
    )
  )
  or
  // Remote content and script execution through other utilities
  (
    registry_data like "*msiexec*" or
    registry_data like "*mshta*" or
    registry_data like "*msbuild*" or
    registry_data like "*pcalua*" or
    registry_data like "*regsvr32*" or
    registry_data like "*rundll32*" or
    registry_data like "*cmstp.exe*" or
    registry_data like "*cmd*http*" or
    registry_data like "*cmd*set*&set*" or
    registry_data like "*conhost*" or
    registry_data like "*forfiles*" or
    registry_data like "*certutil*" or
    registry_data like "*curl*http*" or
    registry_data like "*wget*http*" or
    registry_data like "*bitsadmin*" or
    registry_data like "*wmic*/f*" or
    registry_data like "*odbcconf*" or
    registry_data like "*script*davwwwroot*" or
    registry_data like "*script*@ssl*" or
    registry_data like "*cmd*davwwwroot*" or
    registry_data like "*cmd*@ssl*" or
    registry_data like "*cmd*pushd*" or
    registry_data like "*-appvscript*" or
    registry_data like "*|*powershell*" or
    registry_data like "*|*pwsh*" or
    registry_data like "*iex*irm *" or
    registry_data like "*iex*iwr *"
  )
| keep _id, _version, _index, data_stream.namespace, @timestamp, event.dataset, user.id, user.name, user.domain, host.id, host.name, agent.id, process.name, process.entity_id, process.executable, process.pid, registry.data.strings, registry.path

Framework: MITRE ATT&CKTM

« Potential Chroot Container Escape via Mount Potential Code Execution via Postgresql »