T1204.004 — Malicious Copy and Paste

Tactic: Execution · Platforms: Linux, macOS, Windows

An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with…

Sub-technique of User Execution (T1204).

Sigma detection rules (3)

T1204.004 User Execution: Malicious Copy and Paste

title: "T1204.004 User Execution: Malicious Copy and Paste"
id: c70c5c1d-e0d6-45bc-8b03-a16d60e10275
description: 'Detects a browser/explorer-spawned shell running an obfuscated one-liner (ClickFix). (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, ParentProcessAllowList, SuspiciousArgPatterns, WritePaths, OutboundCIDRBlockList.'
references:
  - https://attack.mitre.org/techniques/T1204/004
author: Shahrukh Khan
date: 2026-03-23
license: MIT
tags:
  - attack.execution
  - attack.t1204.004

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
  selection_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_susp_cli:
    CommandLine|contains:
      - '-enc'
      - '-EncodedCommand'
      - 'IEX'
      - 'Invoke-Expression'
      - 'FromBase64String'
      - 'DownloadString'
      - 'iwr '
      - 'curl '
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_parent and selection_shell and selection_susp_cli and not filter_system_account

falsepositives:
  - IT-provided remediation scripts distributed as paste-and-run.

level: medium

T1204.004 User Execution: Malicious Copy and Paste

title: "T1204.004 User Execution: Malicious Copy and Paste"
id: 8c5c596e-6f42-4d67-98b0-40d9bfc858c9
description: 'User Execution - Malicious Copy & Paste (ClickFix-style browser/email -> shell with obfuscated one-liner) - T1204.004. Auditd EXECVE records only expose the exec''d process own exe/argv, not a parent-child (terminal-to-shell) relationship, so the prior selection*.exe AND-of-bash-and-terminal-emulator logic could never match a single event. Retargeted to a single-event-observable proxy: a shell invoked non-interactively via -c whose command-line argument fetches remote content (curl/wget) and pipes it directly into an interpreter, characteristic of pasted ClickFix payloads. Auditd has no clipboard visibility, so this remains an indirect proxy. Tune using: RiskyFilePaths, AnomalousUserSet, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1204/004
author: Shahrukh Khan
date: 2026-01-17
license: MIT
tags:
  - attack.execution
  - attack.t1204.004

logsource:
  category: process_creation
  product: linux

detection:
  selection_shell_dash_c:
    type: EXECVE
    a0|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
    a1: '-c'
  selection_fetch_util:
    type: EXECVE
    a2|contains:
      - 'curl '
      - 'wget '
  selection_pipe_to_interpreter:
    type: EXECVE
    a2|contains:
      - '|bash'
      - '| bash'
      - '|sh'
      - '| sh'

  condition: selection_shell_dash_c and selection_fetch_util and selection_pipe_to_interpreter

falsepositives:
  - Legitimate admin one-liners that intentionally curl/wget a trusted install script and pipe it to a shell (common for package installers); scope RiskyFilePaths/AnomalousUserSet to unexpected users or unapproved source domains.

level: medium

T1204.004 User Execution: Malicious Copy and Paste

title: "T1204.004 User Execution: Malicious Copy and Paste"
id: ab9dffca-5322-4d80-a5a4-9629d9cbe656
description: 'User Execution – Malicious Copy & Paste (browser/email → shell with obfuscated one-liner) – T1204.004. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentAppScope, CommandPatternList, AllowListedDevUsers.'
references:
  - https://attack.mitre.org/techniques/T1204/004
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.execution
  - attack.t1204.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/bash'
      - '/zsh'
  selection_parent:
    ParentImage|endswith:
      - '/Terminal'
      - '/iTerm2'
  selection_paste:
    CommandLine|contains:
      - 'curl'
      - 'base64'
      - 'sudo'
  condition: selection and selection_parent and selection_paste

falsepositives:
  - Developers legitimately pasting multi-step setup commands, including curl-piped installers, into Terminal or iTerm2 during normal workflows.

level: medium

Related sub-techniques

Explore