kevmap

Techniques › T1204 › T1204.004

T1204.004 Malicious Copy and Paste

execution — Linux, macOS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
3
analytics
6
Sigma rules tagged attack.t1204.004
0
KEV CVEs mapped here
<p>An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code.</p><p>Malicious websites, such as those used in Drive-by Compromise, may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able to establish a foothold on the victim's machine.</p><p>Adversaries may also leverage phishing emails for this purpose. When a user attempts to open an attachment, they may be presented with a fake error and offered a malicious command to paste as a solution, consistent with the "ClickFix" strategy.</p><p>Tricking a user into executing a command themselves may help to bypass email filtering, browser sandboxing, or other mitigations designed to protect users against malicious downloaded files.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1204.004

Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-04 (modified 2025-11-26) · logsource: product=windows category=process_creation · 3ae9974a-eb09-4044-8e70-8980a50c12c8
Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection. ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar. The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.
Techniques: T1204.004T1027.010
FileFix - Command Evidence in TypedPaths highexperimental
Author: Alfie Champion (delivr.to), Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-07-05 (modified 2025-11-19) · logsource: product=windows category=registry_set · 4fee3d51-8069-4a4c-a0f7-924fcaff2c70
Detects commonly-used chained commands and strings in the most recent 'url' value of the 'TypedPaths' key, which could be indicative of a user being targeted by the FileFix technique.
Techniques: T1204.004
Suspicious Space Characters in RunMRU Registry Path - ClickFix highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-04 · logsource: product=windows category=registry_set · 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e
Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.
Techniques: T1204.004T1027.010
Suspicious Space Characters in TypedPaths Registry Path - FileFix highexperimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-04 · logsource: product=windows category=registry_set · 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e
Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.
Techniques: T1204.004T1027.010
Suspicious FileFix Execution Pattern highexperimental
Author: 0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-24 · logsource: product=windows category=process_creation · b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2
Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation. This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms, which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content. The clipboard content usually contains commands that download and execute malware, such as information stealing tools.
Techniques: T1204.004
Suspicious ClickFix/FileFix Execution Pattern highexperimental
Author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems) · 2025-11-19 · logsource: product=windows category=process_creation · d487ed4a-fd24-436d-a0b2-f4e95f7b2635
Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix). Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.
Techniques: T1204.001T1204.004

Rules tagged at the parent level (attack.t1204) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Potentially Suspicious WebDAV LNK Execution mediumtest
Author: Micah Babinski · 2023-08-21 · logsource: product=windows category=process_creation · 1412aa78-a24c-4abd-83df-767dfb2c5bbe
Detects possible execution via LNK file accessed on a WebDAV server.
Techniques: T1059.001T1204
Payload Decoded and Decrypted via Built-in Utilities mediumtest
Author: Tim Rauch (rule), Elastic (idea) · 2022-10-17 · logsource: product=macos category=process_creation · 234dc5df-40b5-49d1-bf53-0d44ce778eca
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Techniques: T1059T1204T1140
Arbitrary Shell Command Execution Via Settingcontent-Ms mediumtest
Author: Sreeman · 2020-03-13 (modified 2022-04-14) · logsource: product=windows category=process_creation · 24de4f3b-804c-4165-b442-5a06a2302c7e
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
Techniques: T1204T1566.001
Potential Snatch Ransomware Activity highstable
Author: Florian Roth (Nextron Systems) · 2020-08-26 (modified 2025-10-19) · logsource: product=windows category=process_creation · 5325945e-f1f0-406e-97b8-65104d393fff
Detects specific process characteristics of Snatch ransomware word document droppers
Techniques: T1204
Suspicious Deno File Written from Remote Source lowexperimental
Author: Josh Nickels, Michael Taggart · 2025-05-22 · logsource: product=windows category=file_event · 6c0ce3b6-85e2-49d4-9c3f-6e008ce9796e
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
Techniques: T1204T1059.007T1105
Suspicious Execution via macOS Script Editor mediumtest
Author: Tim Rauch (rule), Elastic (idea) · 2022-10-21 (modified 2022-12-28) · logsource: product=macos category=process_creation · 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4
Detects when the macOS Script Editor utility spawns an unusual child process.
Techniques: T1566T1566.002T1059T1059.002T1204T1204.001T1553
DarkSide Ransomware Pattern criticaltest
Author: Florian Roth (Nextron Systems) · 2021-05-14 · logsource: product=windows category=process_creation · 965fff6c-1d7e-4e25-91fd-cdccd75f7d2c
Detects DarkSide Ransomware and helpers
Techniques: T1204
Suspicious Binaries and Scripts in Public Folder highexperimental
Author: The DFIR Report · 2025-01-23 · logsource: product=windows category=file_event · b447f7de-1e53-4cbf-bfb4-f1f6d0b04e4e
Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.
Techniques: T1204
PrinterNightmare Mimikatz Driver Name criticaltest
Author: Markus Neis, @markus_neis, Florian Roth · 2021-07-04 (modified 2023-06-12) · logsource: product=windows category=registry_event · ba6b9e43-1d45-4d3c-a504-1043a64c8469
Detects static QMS 810 and mimikatz driver name used by Mimikatz as exploited in CVE-2021-1675 and CVE-2021-34527
Techniques: T1204
CVE tags: CVE-2021-1675CVE-2021-34527
Antivirus - Hacktool Signature highstable
Author: Florian Roth (Nextron Systems), Arnim Rupp · 2021-08-16 (modified 2026-06-15) · logsource: category=antivirus · fa0c05b6-8ad3-468d-8231-c1cbccb64fba
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Techniques: T1204