{"id":"T1204.001","name":"Malicious Link","url":"https://attack.mitre.org/techniques/T1204/001","tactics":["execution"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0066","stix_id":"x-mitre-detection-strategy--b977bf63-8fe2-4538-b4f2-0098fe26d67b","name":"User Execution – Malicious Link (click → suspicious egress → download/write → follow-on activity)","url":"https://attack.mitre.org/detectionstrategies/DET0066","analytics":[{"id":"AN0178","stix_id":"x-mitre-analytic--12849ba4-39da-48c9-bf3d-c51a6cc3f85b","name":"Analytic 0178","description":"Behavioral chain: (1) a user-facing app (browser/Office/email client) launches a URL or handles a link, then (2) the same process lineage makes an outbound connection to an untrusted domain/IP, (3) a file is downloaded or unpacked to a user-writable location shortly after the click. Optional enrichment: subsequent child execution by LOLBINs.","url":"https://attack.mitre.org/detectionstrategies/DET0066#AN0178","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"NSM:Flow","channel":"Suspicious URL patterns, uncommon TLDs, short-lived domains, URL shorteners; HTTP method GET/POST","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation window (e.g., 15m) between link click / first egress / file write."},{"field":"BrowserParents","description":"Processes considered link sources: chrome.exe, msedge.exe, firefox.exe, winword.exe, outlook.exe, teams.exe."},{"field":"UserPaths","description":"User-writable directories to monitor (%USERPROFILE%\\Downloads, %TEMP%, %APPDATA%\\*, OneDrive caches)."},{"field":"SuspiciousTLDs","description":"High-risk TLD and domain list (e.g., .top .xyz .monster; newly observed domains/NOD)."},{"field":"AllowedCDNs","description":"Corporate CDNs/update hosts to reduce false positives."}],"live":true,"detection_strategies":["DET0066"],"techniques":["T1204.001"]},{"id":"AN0179","stix_id":"x-mitre-analytic--bbfa2ed1-f8d5-44cf-9da8-5e3fed544172","name":"Analytic 0179","description":"Behavioral chain: (1) browser/office/GUI mail client opens a URL, (2) outbound connection to untrusted domain, (3) a new file is saved in $HOME/Downloads, /tmp, or cache immediately after.","url":"https://attack.mitre.org/detectionstrategies/DET0066#AN0179","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve: Execs of chromium, google-chrome, firefox, libreoffice with http(s) in cmdline","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"open,creat,rename: Writes in $HOME/Downloads, /tmp, ~/.cache with exe/script/archive/office extensions","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"Suspicious URL patterns, uncommon TLDs, URL shorteners","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"TimeWindow","description":"Typical 10–20m between click and write."},{"field":"UserPaths","description":"$HOME/Downloads, /tmp, ~/.cache, ~/.local/share."},{"field":"HighRiskExtensions","description":"exe, elf, sh, js, py, jar, iso, img, zip, rar, xlsm, docm, xll."},{"field":"DomainRiskScore","description":"Heuristic or TI score threshold for domains."}],"live":true,"detection_strategies":["DET0066"],"techniques":["T1204.001"]},{"id":"AN0180","stix_id":"x-mitre-analytic--3f615721-c62f-4229-9c6e-cb873b2591e5","name":"Analytic 0180","description":"Behavioral chain: (1) Safari/Chrome/Firefox/Office handles a URL; unified logs show open/click or LSQuarantine assignment, (2) outbound connection to untrusted domain, (3) a new file appears in ~/Downloads or /private/var/folders/* with quarantine flag.","url":"https://attack.mitre.org/detectionstrategies/DET0066#AN0180","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"open URL|clicked link|LSQuarantineAttach","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Connections","channel":"New outbound connection from Safari/Chrome/Firefox/Word","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-connections"},{"name":"fs:fsevents","channel":"Create in /Users/*/Downloads or /private/var/folders/* with quarantine attribute","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"fs-fsevents"}],"mutable_elements":[{"field":"TimeWindow","description":"10–30m correlation."},{"field":"QuarantinePolicy","description":"Alert when com.apple.quarantine missing on newly downloaded executables."},{"field":"SuspiciousTLDs","description":"Org-specific risky domains/TLDs."}],"live":true,"detection_strategies":["DET0066"],"techniques":["T1204.001"]}],"live":true,"version":"1.0","techniques":["T1204.001"]}],"sigma_rules":[{"id":"6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4","title":"Suspicious Execution via macOS Script Editor","author":"Tim Rauch (rule), Elastic (idea)","status":"test","level":"medium","date":"2022-10-21","modified":"2022-12-28","description":"Detects when the macOS Script Editor utility spawns an unusual child process.","references":["https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685","https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.defense-impairment","attack.t1566","attack.t1566.002","attack.initial-access","attack.t1059","attack.t1059.002","attack.t1204","attack.t1204.001","attack.execution","attack.persistence","attack.t1553"],"path":"rules/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml","techniques":["T1566","T1566.002","T1059","T1059.002","T1204","T1204.001","T1553"],"cves":[]},{"id":"c67fc22a-0be5-4b4f-aad5-2b32c4b69523","title":"Symlink Etc Passwd","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-04-05","modified":"2021-11-27","description":"Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd","references":["https://www.qualys.com/2021/05/04/21nails/21nails.txt"],"logsource":{"product":"linux"},"tags":["attack.t1204.001","attack.execution"],"path":"rules/linux/builtin/lnx_symlink_etc_passwd.yml","techniques":["T1204.001"],"cves":[]},{"id":"d487ed4a-fd24-436d-a0b2-f4e95f7b2635","title":"Suspicious ClickFix/FileFix Execution Pattern","author":"montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-19","modified":null,"description":"Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix).\nAttackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.\n","references":["https://github.com/JohnHammond/recaptcha-phish","https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware","https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/","https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2","https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution","https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1204.001","attack.t1204.004"],"path":"rules/windows/process_creation/proc_creation_win_susp_clickfix_filefix_execution.yml","techniques":["T1204.001","T1204.004"],"cves":[]},{"id":"f5fe36cf-f1ec-4c23-903d-09a3110f6bbb","title":"Potential ClickFix Execution Pattern - Registry","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-03-25","modified":"2025-11-19","description":"Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys containing HTTP/HTTPS links.\nClickFix is known to be distributed through phishing campaigns and uses techniques like clipboard hijacking and fake CAPTCHA pages.\nThrough the fakecaptcha pages, the adversary tricks users into opening the Run dialog box and pasting clipboard-hijacked content,\nsuch as one-liners that execute remotely hosted malicious files or scripts.\n","references":["https://github.com/JohnHammond/recaptcha-phish","https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware","https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/","https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2","https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution","https://medium.com/@boutnaru/the-windows-foreniscs-journey-run-mru-run-dialog-box-most-recently-used-57375a02d724","https://unit42.paloaltonetworks.com/preventing-clickfix-attack-vector/","https://medium.com/@poudelswachchhanda123/preventing-lnk-and-fakecaptcha-threats-a-system-hardening-approach-2f7b7ed2e493","https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.t1204.001"],"path":"rules/windows/registry/registry_set/registry_set_potential_clickfix_execution.yml","techniques":["T1204.001"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-38112","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-5631","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-5217","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2023-2136","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-3038","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-3075","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-21971","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2012-0767","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2015-5119","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2022-24682","state":"mapped","mapping_types":["exploitation_technique"]},{"cveID":"CVE-2020-3580","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}