{"id":"T1204.004","name":"Malicious Copy and Paste","url":"https://attack.mitre.org/techniques/T1204/004","tactics":["execution"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0340","stix_id":"x-mitre-detection-strategy--0dabfa5e-9c35-48ec-b825-ff1cce7a3d00","name":"User Execution – Malicious Copy & Paste (browser/email → shell with obfuscated one-liner) – T1204.004","url":"https://attack.mitre.org/detectionstrategies/DET0340","analytics":[{"id":"AN0962","stix_id":"x-mitre-analytic--8cb0a7da-942b-4771-b9d5-cf558755677a","name":"Analytic 0962","description":"A user is socially engineered (web page, email, document) to open Run/PowerShell/CMD and paste an obfuscated one-liner. The chain is: (1) user context active in a browser/email/office app → (2) process creation of a command interpreter with suspicious arguments (base64/Invoke-Expression/web download/pipeline to shell) → (3) optional file drop in %TEMP% or %APPDATA% → (4) outbound network connection to an external domain. Events are correlated within a short window and with consistent user/session.","url":"https://attack.mitre.org/detectionstrategies/DET0340#AN0962","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"NSM:Flow","channel":"HTTP(S) requests with User-Agents typical of PowerShell or curl from desktop; or URIs matching paste-inspired payload hosts","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation horizon from parent app (browser/email/office) to interpreter spawn (e.g., 15 minutes)."},{"field":"ParentProcessAllowList","description":"Legitimate automation that spawns PowerShell/CMD from Office/Email/Browser."},{"field":"SuspiciousArgPatterns","description":"List of command-line substrings indicating pasted one-liners (e.g., '-enc', 'FromBase64String', 'IEX(', 'DownloadString', 'Invoke-WebRequest', 'curl|wget.*\\|\\s*(sh|bash|powershell)')."},{"field":"WritePaths","description":"Directories treated as risky for first-stage drops (%TEMP%, %APPDATA%, %PUBLIC%)."},{"field":"OutboundCIDRBlockList","description":"Internet ranges/domains to alert on for first-run egress."}],"live":true,"detection_strategies":["DET0340"],"techniques":["T1204.004"]},{"id":"AN0963","stix_id":"x-mitre-analytic--1895e723-dcfb-45d4-80fc-aaa0c3963cc9","name":"Analytic 0963","description":"User pastes a multi-line or one-liner into a terminal (bash/zsh) that downloads/decodes and executes content. Chain: terminal exec of curl/wget/bash/sh with pipe to interpreter or base64-decode → transient file under /tmp|~/.cache → immediate outbound egress.","url":"https://attack.mitre.org/detectionstrategies/DET0340#AN0963","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve: exe in (/usr/bin/bash,/usr/bin/sh,/usr/bin/zsh,/usr/bin/python*) AND cmdline matches '(curl|wget).*(\\||\\|\\s*sh|bash)|base64\\s*-d|python\\s*-c'","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"open: File creation under /tmp, /var/tmp, ~/.cache with executable bit or shell shebang","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"New egress to Internet by the same UID/host shortly after terminal exec","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"TerminalProcessNames","description":"Gui/tty terminals to monitor (gnome-terminal, konsole, iTerm2, tmux)."},{"field":"RiskyFilePaths","description":"Temp/cache paths to watch for first-stage drops."},{"field":"AnomalousUserSet","description":"Users who should never run curl/wget or compilers."},{"field":"TimeWindow","description":"Exec→file→egress correlation window (e.g., 10 minutes)."}],"live":true,"detection_strategies":["DET0340"],"techniques":["T1204.004"]},{"id":"AN0964","stix_id":"x-mitre-analytic--acf0fdbb-6fbf-42c0-acc4-75a545c24f90","name":"Analytic 0964","description":"User pastes an obfuscated command into Terminal.app/iTerm2 that decodes or downloads code and executes. Detects Terminal/iTerm2 spawning bash/zsh/python with suspicious pipeline/base64 patterns followed by file writes in ~/Library or /tmp and outbound network connections.","url":"https://attack.mitre.org/detectionstrategies/DET0340#AN0964","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"exec: ParentImage in (Terminal, iTerm2) AND Image in (/bin/zsh,/bin/bash,/usr/bin/python*) AND CommandLine matches '(curl|wget).*(\\||\\|\\s*sh|bash)|base64 -D|python -c'","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"Interpreter exec with suspicious arguments as above","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-osquery"},{"name":"macos:unifiedlog","channel":"create: New files in /tmp or ~/Library/Application Support/* with executable or script extensions","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Flow","channel":"Egress to non-approved networks from host after terminal exec","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ParentAppScope","description":"Terminal apps to treat as user-paste origins (Terminal, iTerm2, VSCode integrated terminal)."},{"field":"CommandPatternList","description":"macOS-specific one-liner traits (pbpaste|base64 -D|curl ... | sh)."},{"field":"AllowListedDevUsers","description":"Developers/automation accounts expected to run such commands."}],"live":true,"detection_strategies":["DET0340"],"techniques":["T1204.004"]}],"live":true,"version":"1.0","techniques":["T1204.004"]}],"sigma_rules":[{"id":"3ae9974a-eb09-4044-8e70-8980a50c12c8","title":"Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-04","modified":"2025-11-26","description":"Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection.\nClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar.\nThe victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.\n","references":["https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/","https://mrd0x.com/filefix-clickfix-alternative/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1204.004","attack.t1027.010"],"path":"rules/windows/process_creation/proc_creation_win_susp_clickfix_filefix_whitespace_padding.yml","techniques":["T1204.004","T1027.010"],"cves":[]},{"id":"4fee3d51-8069-4a4c-a0f7-924fcaff2c70","title":"FileFix - Command Evidence in TypedPaths","author":"Alfie Champion (delivr.to), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-07-05","modified":"2025-11-19","description":"Detects commonly-used chained commands and strings in the most recent 'url' value of the 'TypedPaths' key, which could be indicative of a user being targeted by the FileFix technique.\n","references":["https://x.com/russianpanda9xx/status/1940831134759506029","https://mrd0x.com/filefix-clickfix-alternative/","https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.t1204.004"],"path":"rules/windows/registry/registry_set/registry_set_filefix_typedpath_commands.yml","techniques":["T1204.004"],"cves":[]},{"id":"7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e","title":"Suspicious Space Characters in RunMRU Registry Path - ClickFix","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-04","modified":null,"description":"Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes.\n","references":["https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/","https://github.com/JohnHammond/recaptcha-phish"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.stealth","attack.t1204.004","attack.t1027.010"],"path":"rules/windows/registry/registry_set/registry_set_susp_runmru_space_character.yml","techniques":["T1204.004","T1027.010"],"cves":[]},{"id":"8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e","title":"Suspicious Space Characters in TypedPaths Registry Path - FileFix","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-04","modified":null,"description":"Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands.\n","references":["https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/","https://mrd0x.com/filefix-clickfix-alternative/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.stealth","attack.t1204.004","attack.t1027.010"],"path":"rules/windows/registry/registry_set/registry_set_susp_typedpaths_space_characters.yml","techniques":["T1204.004","T1027.010"],"cves":[]},{"id":"b5b29e4e-31fa-4fdf-b058-296e7a1aa0c2","title":"Suspicious FileFix Execution Pattern","author":"0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-24","modified":null,"description":"Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation.\nThis attack typically begins when users visit malicious websites impersonating legitimate services or news platforms,\nwhich may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content.\nThe clipboard content usually contains commands that download and execute malware, such as information stealing tools.\n","references":["https://mrd0x.com/filefix-clickfix-alternative/","https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/","https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1204.004"],"path":"rules/windows/process_creation/proc_creation_win_susp_filefix_execution_pattern.yml","techniques":["T1204.004"],"cves":[]},{"id":"d487ed4a-fd24-436d-a0b2-f4e95f7b2635","title":"Suspicious ClickFix/FileFix Execution Pattern","author":"montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-11-19","modified":null,"description":"Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix).\nAttackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.\n","references":["https://github.com/JohnHammond/recaptcha-phish","https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware","https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/","https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2","https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution","https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1204.001","attack.t1204.004"],"path":"rules/windows/process_creation/proc_creation_win_susp_clickfix_filefix_execution.yml","techniques":["T1204.001","T1204.004"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}