Potential ClickFix Activity
This alert detects a two stage behaviour associated with ClickFix style social engineering attacks, where a victim is tricked into manually executing a malicious command via the Windows Run dialog (WIN + R). The first stage monitors the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU), which stores a history of commands entered through the Run dialog. A write to this key containing suspicious strings such as iwr, irm, iex, http, bypass, webdav, or net use indicates a potentially malicious command was executed directly by the user, commonly as a result of being instructed to do so via a fake CAPTCHA, browser prompt, or web page. The second stage correlates this registry event with outbound network connections initiated by known LOLBINs (Living Off the Land Binaries) such as powershell.exe, cmd.exe, mshta.exe, rundll32.exe, certutil.exe, and others within a 60 minute window. This correlation suggests the Run dialog command successfully spawned a process that attempted to reach out to an attacker controlled infrastructure, potentially for payload staging, C2 establishment, or further tool download. Alerts firing on the registry write alone (no network match) should be treated as potential initial access attempts and triaged accordingly. Alerts with a correlated network event represent a higher-severity execution chain and should be escalated.
Microsoft Sentinel (KQL)
