ClickFix nslookup Payload Delivery via DNS
This query is designed to detect a specific type of cyber attack known as the "ClickFix" attack, which was observed in February 2026. The attack involves using a social engineering technique where victims are tricked into running the nslookup command with a specific DNS server controlled by attackers. This malicious server then sends back a PowerShell script in the DNS response, which is executed to install malware like ModeloRAT. Here's a simple breakdown of what the query does: Data Source: It looks at security events, specifically those related to process creation (Event ID 4688). Time Frame: The query checks for events that occurred in the last hour. Process Monitoring: It focuses on instances where the nslookup.exe process is run. Command Line Analysis: The query identifies nslookup commands that specify an explicit DNS server IP address, which is a key indicator of this attack. It uses specific patterns and regular expressions to find these commands. Parent Process Check: It checks if the parent process of nslookup.exe is a shell or script interpreter like cmd.exe or powershell.exe, which is common in such attacks. Output: The query projects details such as the time of the event, the computer involved, the user account, the command line used, and the parent process. Alerting: If such an event is detected, it triggers an alert with a high severity level, providing details about the computer and account involved, and the command that was executed. Entity Mapping: It maps the computer and account details to entities for better identification and tracking. Alert Customization: The alert includes a custom message that highlights the nature of the attack and provides specific details about the command used. Overall, this query is a security measure to detect and alert on potential ClickFix attacks by monitoring for suspicious nslookup usage patterns.
Microsoft Sentinel (KQL)
