ATT&CK technique
View on MITRE ATT&CK →
T1204.004
Malicious Copy and Paste
Execution
12 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential FileFix Command via Windows Explorer Address Bar | production | 2026-10-05 |
| elastic | Potential ClickFix Command via Windows Run Dialog | production | 2026-10-05 |
| elastic | Potential TerminalFix Cloudflare Lure in PowerShell | production | 2026-09-28 |
| elastic | Potential Execution via FileFix Phishing Attack | production | 2026-09-28 |
| elastic | XDG-Open Command Execution | production | 2026-09-18 |
| elastic | Potential Fake CAPTCHA Phishing Attack | production | 2026-09-18 |
| sigma | Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix | experimental | 2025-11-26 |
| sigma | Suspicious FileFix Execution Pattern | experimental | 2025-11-24 |
| sigma | Suspicious ClickFix/FileFix Execution Pattern | experimental | 2025-11-19 |
| sigma | FileFix - Command Evidence in TypedPaths | experimental | 2025-11-19 |
| sigma | Suspicious Space Characters in RunMRU Registry Path - ClickFix | experimental | 2025-11-04 |
| sigma | Suspicious Space Characters in TypedPaths Registry Path - FileFix | experimental | 2025-11-04 |