ClickFix - PowerShell executed through the run application

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
ATT&CK Tactic	Execution (TA0002), Initial Access (TA0001)
ATT&CK Technique	User Execution (T1204), Phishing (T1566)
Severity	Low

Description

An attacker may be trying to trick a user to execute PowerShell through the run application.

Attacker's Goals

• An attacker may be trying to trick a user to execute PowerShell through the run application.

Investigative actions

• Check if the command line is known in the organization or malicious.
• And ask the user what is the source of it.

Variations

ClickFix - PowerShell command executed through the run application and using Invoke-Expression cmdlet

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Initial Access (TA0001)
ATT&CK Technique	User Execution (T1204), Phishing (T1566)
Severity	High

Description

An attacker may be trying to trick a user to execute PowerShell through the run application.

Attacker's Goals

• An attacker may be trying to trick a user to execute PowerShell through the run application.

Investigative actions

• Check if the command line is known in the organization or malicious.
• And ask the user what is the source of it.

ClickFix - Long PowerShell command executed through the run application with URL in the command

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Initial Access (TA0001)
ATT&CK Technique	User Execution (T1204), Phishing (T1566)
Severity	High

Description

An attacker may be trying to trick a user to execute PowerShell through the run application.

Attacker's Goals

• An attacker may be trying to trick a user to execute PowerShell through the run application.

Investigative actions

• Check if the command line is known in the organization or malicious.
• And ask the user what is the source of it.

ClickFix - Long encoded PowerShell command executed through the run application

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Initial Access (TA0001)
ATT&CK Technique	User Execution (T1204), Phishing (T1566)
Severity	High

Description

An attacker may be trying to trick a user to execute PowerShell through the run application.

Attacker's Goals

• An attacker may be trying to trick a user to execute PowerShell through the run application.

Investigative actions

• Check if the command line is known in the organization or malicious.
• And ask the user what is the source of it.

ClickFix - Schedule task PowerShell command executed through the run application

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002), Initial Access (TA0001)
ATT&CK Technique	User Execution (T1204), Phishing (T1566)
Severity	High

Description

An attacker may be trying to trick a user to execute PowerShell through the run application.

Attacker's Goals

• An attacker may be trying to trick a user to execute PowerShell through the run application.

Investigative actions

• Check if the command line is known in the organization or malicious.
• And ask the user what is the source of it.