T1204.004Execution
Malicious Copy and Paste
An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
6 Sigma rules tagged T1204.004Malicious Copy and PasteT1204.0046 general rules
- FileFix - Command Evidence in TypedPathshighexperimental
- Suspicious ClickFix/FileFix Execution Patternhighexperimental
- Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFixhighexperimental
- Suspicious FileFix Execution Patternhighexperimental
- Suspicious Space Characters in RunMRU Registry Path - ClickFixhighexperimental
- Suspicious Space Characters in TypedPaths Registry Path - FileFixhighexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Malicious Copy and Paste
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.