Potential ClickFix Execution Pattern in RunMRU Registry

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•4•0•47

Detects potential ClickFix malware execution patterns by monitoring registry modifications in RunMRU keys. Specifically, it looks for HTTP/HTTPS links combined with suspicious keywords related to CAPTCHA/verification or common command-line utilities, which are indicative of clipboard hijacking and execution of remotely hosted malicious files or scripts.