Contagious InterviewG1052 ↗
Has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.123
- Tactic
- Execution
- Platforms
- Linux, macOS, Windows
- Version
- 1.1
- Created
- 18 March 2025
- Last modified
- 12 May 2026
- Contributors
- Ale Houspanossian; Fernando Bacchin; Gabriel Currie; Harikrishnan Muthu, Cyble; Menachem Goldstein; ReliaQuest; SeungYoul Yoo, AhnLab
An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
3
Threat groups64th pct
Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.6
Detection rules67th pct
Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.Malicious Copy and Paste MITRE reference T1204.004
64th pctamong all ATT&CK techniques for number of groups
3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
KimsukyG0094 ↗
Has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.1
MuddyWaterG0069 ↗
Has leveraged ClickFix type tactics enticing victims to copy and paste malicious PowerShell code.1
All 3 groups for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Kali365S9044 ↗
Has dynamically generated legitimate device codes that displays on the victims screen alongside instructions to copy and paste the device code to initiate and complete a successful authentication process.12345
HavocS1229 ↗
The Havoc infection chain has been initiated via ClickFix lures in phishing emails.1
All 2 software entries for this technique
Offense vs defense T1204.004
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 6Splunk ESCU (cumulative) · 0
first rule: 2025 Q3Malicious Copy and Paste detection strategy DET0340
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
User Execution – Malicious Copy & Paste (browser/email → shell with obfuscated one-liner) – T1204.004
3 platforms
AN0962 · Windows
A user is socially engineered (web page, email, document) to open Run/PowerShell/CMD and paste an obfuscated one-liner. The chain is: (1) user context active in a browser/email/office app → (2) process creation of a command interpreter with suspicious arguments (base64/Invoke-Expression/web download/pipeline to shell) → (3) optional file drop in %TEMP% or %APPDATA% → (4) outbound network connection to an external domain. Events are correlated within a short window and with consistent user/session.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog:Security | EventCode=4688 |
| File CreationDC0039 | WinEventLog:Sysmon | EventCode=11 |
| Command ExecutionDC0064 | WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 |
| Network Connection CreationDC0082 | WinEventLog:Sysmon | EventCode=3, 22 |
| Network Traffic ContentDC0085 | NSM:Flow | HTTP(S) requests with User-Agents typical of PowerShell or curl from desktop; or URIs matching paste-inspired payload hosts |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlation horizon from parent app (browser/email/office) to interpreter spawn (e.g., 15 minutes). |
| ParentProcessAllowList | Legitimate automation that spawns PowerShell/CMD from Office/Email/Browser. |
| SuspiciousArgPatterns | List of command-line substrings indicating pasted one-liners (e.g., '-enc', 'FromBase64String', 'IEX(', 'DownloadString', 'Invoke-WebRequest', 'curl|wget.*\|\s*(sh|bash|powershell)'). |
| WritePaths | Directories treated as risky for first-stage drops (%TEMP%, %APPDATA%, %PUBLIC%). |
| OutboundCIDRBlockList | Internet ranges/domains to alert on for first-run egress. |
AN0963 · Linux
User pastes a multi-line or one-liner into a terminal (bash/zsh) that downloads/decodes and executes content. Chain: terminal exec of curl/wget/bash/sh with pipe to interpreter or base64-decode → transient file under /tmp|~/.cache → immediate outbound egress.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve: exe in (/usr/bin/bash,/usr/bin/sh,/usr/bin/zsh,/usr/bin/python*) AND cmdline matches '(curl|wget).*(\||\|\s*sh|bash)|base64\s*-d|python\s*-c' |
| File CreationDC0039 | auditd:SYSCALL | open: File creation under /tmp, /var/tmp, ~/.cache with executable bit or shell shebang |
| Network Connection CreationDC0082 | NSM:Flow | New egress to Internet by the same UID/host shortly after terminal exec |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TerminalProcessNames | Gui/tty terminals to monitor (gnome-terminal, konsole, iTerm2, tmux). |
| RiskyFilePaths | Temp/cache paths to watch for first-stage drops. |
| AnomalousUserSet | Users who should never run curl/wget or compilers. |
| TimeWindow | Exec→file→egress correlation window (e.g., 10 minutes). |
AN0964 · macOS
User pastes an obfuscated command into Terminal.app/iTerm2 that decodes or downloads code and executes. Detects Terminal/iTerm2 spawning bash/zsh/python with suspicious pipeline/base64 patterns followed by file writes in ~/Library or /tmp and outbound network connections.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos:unifiedlog | exec: ParentImage in (Terminal, iTerm2) AND Image in (/bin/zsh,/bin/bash,/usr/bin/python*) AND CommandLine matches '(curl|wget).*(\||\|\s*sh|bash)|base64 -D|python -c' |
| File CreationDC0039 | macos:unifiedlog | create: New files in /tmp or ~/Library/Application Support/* with executable or script extensions |
| Command ExecutionDC0064 | macos:osquery | Interpreter exec with suspicious arguments as above |
| Network Traffic ContentDC0085 | NSM:Flow | Egress to non-approved networks from host after terminal exec |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| ParentAppScope | Terminal apps to treat as user-paste origins (Terminal, iTerm2, VSCode integrated terminal). |
| CommandPatternList | macOS-specific one-liner traits (pbpaste|base64 -D|curl ... | sh). |
| AllowListedDevUsers | Developers/automation accounts expected to run such commands. |
Execution PreventionM1038
Use application control where appropriate. PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., Add-Type).
If a link is being requested by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.
If a link is being requested by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc.
Tests1Executorsmanual 1Need elevation0 of 1Have prerequisites0Have cleanup0Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition