Detect an interpreter launched from the shell with a pasted one-liner

Siemphony@siemphonyhighT1204.004unverified

Matches the ClickFix shape described in AN0962: a command interpreter created directly by explorer.exe — the Run dialog, the Start box or a desktop double-click, which is where a socially engineered paste lands — carrying an argument that only a copied one-liner tends to have, such as an encoded command, an inline download-and-execute, a bare URL or a hidden window. Three selections are ANDed because none of them stands alone: the parent alone fires on every interactive launch, and the argument list alone is ordinary scripting noise. AN0962 continues into a file drop under a user-writable path and first egress; those are separate events with no join in Sigma, so the ParentProcessAllowList, WritePaths and OutboundCIDRBlockList knobs are not expressed here. Nothing in the telemetry records that the text was pasted rather than typed, so intent is inferred from the launch context only. The analytic's process source is Security 4688, which needs the Audit Process Creation subcategory enabled and, because every term here sits on the arguments, the separate Include command line in process creation events policy as well — with either one off the rule matches nothing while appearing healthy. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0340, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((InitiatingProcessFolderPath endswith "\\explorer.exe" and (FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe" or FolderPath endswith "\\cmd.exe" or FolderPath endswith "\\conhost.exe" or FolderPath endswith "\\mshta.exe" or FolderPath endswith "\\wscript.exe" or FolderPath endswith "\\cscript.exe" or FolderPath endswith "\\curl.exe" or FolderPath endswith "\\msiexec.exe")) and (ProcessCommandLine contains " -enc " or ProcessCommandLine contains " -encodedcommand" or ProcessCommandLine contains " -ec " or ProcessCommandLine contains "frombase64string" or ProcessCommandLine contains "invoke-expression" or ProcessCommandLine contains "iex(" or ProcessCommandLine contains "iex " or ProcessCommandLine contains "downloadstring" or ProcessCommandLine contains "invoke-webrequest" or ProcessCommandLine contains "invoke-restmethod" or ProcessCommandLine contains "--headless" or ProcessCommandLine contains " -w hidden" or ProcessCommandLine contains " -windowstyle hidden" or ProcessCommandLine contains "http://" or ProcessCommandLine contains "https://"))

Splunk · SPL

Run this as a search.

index=* ((ParentImage="*\\explorer.exe" AND (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\conhost.exe" OR Image="*\\mshta.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe" OR Image="*\\curl.exe" OR Image="*\\msiexec.exe")) AND (CommandLine="* -enc *" OR CommandLine="* -encodedcommand*" OR CommandLine="* -ec *" OR CommandLine="*frombase64string*" OR CommandLine="*invoke-expression*" OR CommandLine="*iex(*" OR CommandLine="*iex *" OR CommandLine="*downloadstring*" OR CommandLine="*invoke-webrequest*" OR CommandLine="*invoke-restmethod*" OR CommandLine="*--headless*" OR CommandLine="* -w hidden*" OR CommandLine="* -windowstyle hidden*" OR CommandLine="*http://*" OR CommandLine="*https://*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.parent.executable) LIKE "*\\\\explorer.exe" AND (TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cmd.exe" OR TO_LOWER(process.executable) LIKE "*\\\\conhost.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mshta.exe" OR TO_LOWER(process.executable) LIKE "*\\\\wscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\cscript.exe" OR TO_LOWER(process.executable) LIKE "*\\\\curl.exe" OR TO_LOWER(process.executable) LIKE "*\\\\msiexec.exe")) AND (TO_LOWER(process.command_line) LIKE "* -enc *" OR TO_LOWER(process.command_line) LIKE "* -encodedcommand*" OR TO_LOWER(process.command_line) LIKE "* -ec *" OR TO_LOWER(process.command_line) LIKE "*frombase64string*" OR TO_LOWER(process.command_line) LIKE "*invoke-expression*" OR TO_LOWER(process.command_line) LIKE "*iex(*" OR TO_LOWER(process.command_line) LIKE "*iex *" OR TO_LOWER(process.command_line) LIKE "*downloadstring*" OR TO_LOWER(process.command_line) LIKE "*invoke-webrequest*" OR TO_LOWER(process.command_line) LIKE "*invoke-restmethod*" OR TO_LOWER(process.command_line) LIKE "*--headless*" OR TO_LOWER(process.command_line) LIKE "* -w hidden*" OR TO_LOWER(process.command_line) LIKE "* -windowstyle hidden*" OR TO_LOWER(process.command_line) LIKE "*http://*" OR TO_LOWER(process.command_line) LIKE "*https://*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="12">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)\\explorer\.exe$</field>    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$|\\cmd\.exe$|\\conhost\.exe$|\\mshta\.exe$|\\wscript\.exe$|\\cscript\.exe$|\\curl\.exe$|\\msiexec\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)( -enc | -encodedcommand| -ec |frombase64string|invoke-expression|iex\(|iex |downloadstring|invoke-webrequest|invoke-restmethod|--headless| -w hidden| -windowstyle hidden|http://|https://)</field>    <description>Detect an interpreter launched from the shell with a pasted one-liner</description>    <mitre>      <id>T1204.004</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: high
Category: office_macro_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 61894a28-e403-42f2-8c51-ac497c530c55

ATT&CKT1204.004

T1204.004Malicious Copy and Paste

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonoffice macro execution

office macro executionAI draft — unreviewed

01 · What this rule detects

The ClickFix shape: a command interpreter created directly by `explorer.exe` — the Run dialog, the Start box, a desktop double-click — carrying an argument that a copied one-liner tends to have. AN0962 describes a four-step chain: browser or email context, an interpreter spawn with suspicious arguments, an optional drop in %TEMP%, then egress. Only the second step is a single event, so only the second step is here. Nothing in the telemetry records that text was pasted rather than typed; intent is inferred purely from launch context. explorer.exe as the parent is the one field that genuinely encodes "a human did this at the shell", and it is the strongest thing in this rule.

02 · Telemetry you need

The analytic's process source is Security 4688, needing Audit Process Creation and — because every term in the third selection sits on the arguments — the separate Include command line in process creation events policy. With either off, the rule matches nothing while appearing healthy.
The brief's second source, PowerShell 4103/4104 script-block logging, matters more here than usual. Half the ClickFix instruction set tells the victim to paste into an already-open terminal, where the interpreter's parent is WindowsTerminal.exe or OpenConsole.exe — and if the pasted text runs in-session there is no process creation for it at all. 4104 is the only place that case appears.

03 · How the logic works

Three selections, all ANDed, because none stands alone — the parent fires on every interactive launch, the argument list alone is ordinary scripting noise.

The marker list is MITRE's SuspiciousArgPatterns knob — MITRE gives -enc, FromBase64String, IEX(, DownloadString, Invoke-WebRequest and a curl-piped-to-shell regex — expanded here to fifteen terms. Now the failure, and it is a good one to learn from. PowerShell matches parameter names by unambiguous prefix. -EncodedCommand can be written -encoded, -enc, -en, or just -e, and all of them work, because no other PowerShell parameter starting with e collides at that length. The rule enumerates three spellings. powershell -e <base64> matches none of the fifteen markers — and a base64 blob carries no http:// either, so the URL terms do not rescue it, the third selection fails, and the entire AND collapses. -e is the form ClickFix builders emit because it is shortest to paste. The same blind spot recurs one line down: ' -w hidden' and ' -windowstyle hidden' are covered, -w h and -w 1 are not. For any tool with prefix-matched or abbreviated switches — PowerShell, net, wmic, most Unix commands — enumerating spellings is a losing game; use a `re` modifier covering the family, here -e, -en, -enc, -ec and -encodedcommand in one term. Two selectors also cannot fire. \conhost.exe is never spawned by explorer.exe with an attacker's arguments — Windows attaches the console host with a fixed \??\C:\WINDOWS\system32\conhost.exe 0x4 command line — and --headless is a Chromium switch while no browser sits in the Image list. Neither costs a match, but dead selectors validate clean and render in four backends, which is exactly why they are dangerous.

04 · Common false positives

Helpdesk-driven remediation. Support staff telling a user to press Win+R and
The estate's own shell-launched automation — a Startup-folder .lnk running
The two bare-URL terms, which the rule's own fourth false positive calls the

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0340 and never executed against logs.
tier_2: confirm CommandLine is populated, then baseline how much of your own logon automation runs under explorer.exe and allow-list it by script path rather than by loosening the markers.
tier_3: requires the drop and egress legs joined inside MITRE's TimeWindow, plus 4104 coverage for the paste-into-an-open-console half this rule cannot see.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Cover the -e family with a regex before anything else; the rule is one abbreviation away from being walked past. Add \wt.exe to the interpreter list. Drop \conhost.exe and --headless.
MITRE's ParentProcessAllowList knob is aimed at legitimate automation spawning shells from Office or a browser; it does not help with interactive administrators, who have to be scoped by account or host instead. The WritePaths and OutboundCIDRBlockList knobs describe links three and four and have no single-event form — they belong in your correlation layer, where "interpreter from explorer, then a drop in %APPDATA%, then first egress" is a far stronger finding than any one leg alone.

Declared by the author

Helpdesk-driven remediation. Support staff routinely tell a user to press Win+R and paste a fix, and the resulting event is indistinguishable from the attack it is modelled on: same parent, same interpreter, same download-and-run argument. Every environment that supports users this way needs the sanctioned commands recorded before this rule is usable.
Vendor shortcuts and installer stubs on the desktop or Start menu. A .lnk whose target is powershell.exe with a hidden window style, or msiexec.exe pointed at a package URL, is launched by explorer.exe on double-click and matches all three selections without anything unusual happening.
Administrators and developers working interactively, who paste encoded or piped one-liners into the Run box because it is faster than opening a console. MITRE's ParentProcessAllowList knob is aimed at automation rather than at people, so this population has to be scoped by account or host instead.
Bare URL terms are the loosest part of the rule: any interactive launch that passes a link to a browser helper, an updater or a documentation shortcut through one of these interpreters will match. Drop the two URL entries first if volume is a problem, accepting the loss of the mshta and curl variants.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1204.004, evaluated against their process_creation events.

Share this rule

/u/siemphony/61894a28-e403-42f2-8c51-ac497c530c55

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect an interpreter launched from the shell with a pasted one-liner

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it