MLTBackdoor ClickFix Execution Chain

Thiru N@Iamthiru

•updated Jun 9, 2026•1•0•7

Detects the specific ClickFix execution chain used to download, extract, and execute the MLTBackdoor payload via cmd, curl, tar, and rundll32. This rule identifies the execution of 'cmd.exe' with a command line containing a sequence of 'curl' for downloading, 'tar' for extraction, and 'rundll32' for execution, which is characteristic of the MLTBackdoor's delivery and execution mechanism.