Techniques › T1204.004 › AN0962
AN0962 Analytic 0962
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>A user is socially engineered (web page, email, document) to open Run/PowerShell/CMD and paste an obfuscated one-liner. The chain is: (1) user context active in a browser/email/office app → (2) process creation of a command interpreter with suspicious arguments (base64/Invoke-Expression/web download/pipeline to shell) → (3) optional file drop in %TEMP% or %APPDATA% → (4) outbound network connection to an external domain. Events are correlated within a short window and with consistent user/session.</p>
- Detects
- T1204.004 Malicious Copy and Paste
- Part of
- DET0340 User Execution – Malicious Copy & Paste (browser/email → shell with obfuscated one-liner) – T1204.004
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
| NSM:Flow | HTTP(S) requests with User-Agents typical of PowerShell or curl from desktop; or URIs matching paste-inspired payload hosts | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation horizon from parent app (browser/email/office) to interpreter spawn (e.g., 15 minutes). |
ParentProcessAllowList | Legitimate automation that spawns PowerShell/CMD from Office/Email/Browser. |
SuspiciousArgPatterns | List of command-line substrings indicating pasted one-liners (e.g., '-enc', 'FromBase64String', 'IEX(', 'DownloadString', 'Invoke-WebRequest', 'curl|wget.*\|\s*(sh|bash|powershell)'). |
WritePaths | Directories treated as risky for first-stage drops (%TEMP%, %APPDATA%, %PUBLIC%). |
OutboundCIDRBlockList | Internet ranges/domains to alert on for first-run egress. |