Potential ClickFix Execution Pattern - Registry

[swachchhanda000]

Summary of the Pull Request

Detects ClickFix malware by monitoring RunMRU registry keys for suspicious HTTP/HTTPS links.

Changelog

new: Potential ClickFix Execution Pattern - Registry

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[Copilot]

Pull Request Overview

Detects potential ClickFix malware execution by monitoring RunMRU registry keys for HTTP/HTTPS links and suspicious commands or keywords.

• Adds a new Sigma rule registry_set_potential_clickfix_execution.yml
• Defines registry path, URL presence, and suspicious keyword/command patterns
• Sets detection level to high with example false positives

Comments suppressed due to low confidence (3)

rules/windows/registry/registry_set/registry_set_potential_clickfix_execution.yml:28

• Consider extending the registry path filter to include the Wow6432Node branch (e.g., \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\) to catch 32-bit applications on 64-bit systems.

        TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\'

rules/windows/registry/registry_set/registry_set_potential_clickfix_execution.yml:1

• This new detection rule lacks accompanying test cases. Consider adding unit or integration tests to validate the registry and pattern matching behavior.

title: Potential ClickFix Execution Pattern - Registry

rules/windows/registry/registry_set/registry_set_potential_clickfix_execution.yml:67

• [nitpick] It may help analysts if you provide concrete examples of known benign applications or patterns in the false positives section to aid tuning.

    - Legitimate applications using RunMRU with HTTP links