Skip to content

Commit d76aa41

Browse files
nasbenchnasbench
authored
Merge pull request #3526 from splunk/captcha
CAPTCHA if you Can
2 parents 271f1bc + f6832c6 commit d76aa41

6 files changed

+142
-27
lines changed

‎detections/endpoint/detect_mshta_url_in_command_line.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect MSHTA Url in Command Line
22
id: 9b3af1e6-5b68-11eb-ae93-0242ac130002
3-
version: '13'
4-
date: '2025-05-06'
3+
version: 13
4+
date: '2025-05-19'
55
author: Michael Haag, Splunk
66
status: production
77
type: TTP

‎detections/endpoint/lolbas_with_network_traffic.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: LOLBAS With Network Traffic
22
id: 2820f032-19eb-497e-8642-25b04a880359
3-
version: 9
4-
date: '2025-05-02'
3+
version: 10
4+
date: '2025-05-19'
55
author: Steven Dick
66
status: production
77
type: TTP
@@ -77,6 +77,7 @@ tags:
7777
analytic_story:
7878
- Living Off The Land
7979
- Water Gamayun
80+
- Fake CAPTCHA Campaigns
8081
asset_type: Endpoint
8182
mitre_attack_id:
8283
- T1105

‎detections/endpoint/powershell_4104_hunting.yml

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: PowerShell 4104 Hunting
22
id: d6f2b006-0041-11ec-8885-acde48001122
3-
version: '17'
4-
date: '2025-05-06'
3+
version: 17
4+
date: '2025-05-02'
55
author: Michael Haag, Splunk
66
status: production
77
type: Hunting
@@ -59,25 +59,25 @@ references:
5959
- https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/
6060
tags:
6161
analytic_story:
62-
- CISA AA23-347A
63-
- China-Nexus Threat Activity
64-
- Data Destruction
65-
- PHP-CGI RCE Attack on Japanese Organizations
66-
- Hermetic Wiper
67-
- Medusa Ransomware
68-
- Braodo Stealer
69-
- Cleo File Transfer Software
70-
- Lumma Stealer
71-
- Salt Typhoon
72-
- Cactus Ransomware
73-
- Malicious PowerShell
74-
- Water Gamayun
75-
- XWorm
76-
- Flax Typhoon
77-
- CISA AA24-241A
78-
- Rhysida Ransomware
79-
- SystemBC
80-
- DarkGate Malware
62+
- Braodo Stealer
63+
- Cactus Ransomware
64+
- China-Nexus Threat Activity
65+
- CISA AA23-347A
66+
- CISA AA24-241A
67+
- Cleo File Transfer Software
68+
- DarkGate Malware
69+
- Data Destruction
70+
- Flax Typhoon
71+
- Hermetic Wiper
72+
- Lumma Stealer
73+
- Malicious PowerShell
74+
- Medusa Ransomware
75+
- Rhysida Ransomware
76+
- Salt Typhoon
77+
- SystemBC
78+
- PHP-CGI RCE Attack on Japanese Organizations
79+
- Water Gamayun
80+
- XWorm
8181
asset_type: Endpoint
8282
mitre_attack_id:
8383
- T1059.001

‎detections/endpoint/windows_powershell_fakecaptcha_clipboard_execution.yml

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: Windows PowerShell FakeCAPTCHA Clipboard Execution
2+
id: d81d4d3d-76b5-4f21-ab51-b17d5164c106
3+
version: 1
4+
date: '2025-05-14'
5+
author: Michael Haag, Splunk
6+
status: production
7+
type: TTP
8+
description: This detection identifies potential FakeCAPTCHA/ClickFix clipboard hijacking campaigns by looking for PowerShell execution with hidden window parameters and distinctive strings related to fake CAPTCHA verification. These campaigns use social engineering to trick users into pasting malicious PowerShell commands from their clipboard, typically delivering information stealers or remote access trojans.
9+
data_source:
10+
- Sysmon EventID 1
11+
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
12+
as lastTime FROM datamodel=Endpoint.Processes where `process_powershell`
13+
AND Processes.process="*-w*h*"
14+
AND (
15+
(Processes.process IN ("*robot*", "*captcha*", "*verify*", "*security check*", "*complete verification*"))
16+
OR
17+
(
18+
(Processes.process IN ("*iwr *", "*Invoke-WebRequest*", "*wget *", "*curl *", "*Net.WebClient*", "*DownloadString*", "*[Convert]::FromBase64String*"))
19+
AND
20+
(Processes.process IN ("*iex*", "*Invoke-Expression*"))
21+
AND
22+
(Processes.process IN ("*click*", "*verify*", "*check*", "*human*", "*bot*", "*token*", "*challenge*"))
23+
)
24+
OR
25+
(
26+
Processes.process="*clipboard*"
27+
AND Processes.process="*iex*"
28+
AND (Processes.process="*FromBase64String*" OR Processes.process="*decode*")
29+
)
30+
)
31+
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process
32+
Processes.parent_process_exec Processes.parent_process_guid Processes.parent_process_id
33+
Processes.parent_process_name Processes.parent_process_path Processes.process
34+
Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
35+
Processes.process_integrity_level Processes.process_name Processes.process_path
36+
Processes.user Processes.user_id Processes.vendor_product
37+
| `drop_dm_object_name(Processes)`
38+
| `security_content_ctime(firstTime)`
39+
| `security_content_ctime(lastTime)`
40+
| `windows_powershell_fakecaptcha_clipboard_execution_filter`'
41+
how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, process path, and command-line executions from your endpoints. If you are using Sysmon, you must have at least Sysmon version 6.0.4 with EventID 1 configured. The full command line arguments are necessary for proper detection.
42+
known_false_positives: Legitimate PowerShell commands that use hidden windows for automation tasks may trigger this detection. The search specifically looks for patterns typical of FakeCAPTCHA campaigns. You may need to add additional exclusions for legitimate administrative activities in your environment by modifying the filter macro.
43+
references:
44+
- https://urlhaus.abuse.ch/
45+
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape
46+
- https://reliaquest.com/blog/using-captcha-for-compromise/
47+
- https://attack.mitre.org/techniques/T1204/001/
48+
- https://github.com/MHaggis/ClickGrab
49+
drilldown_searches:
50+
- name: View the detection results for - "$dest$"
51+
search: '%original_detection_search% | search dest = "$dest$"'
52+
earliest_offset: $info_min_time$
53+
latest_offset: $info_max_time$
54+
- name: View risk events for the last 7 days for - "$dest$"
55+
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
56+
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
57+
values(search_name) as "Search Name" values(risk_message) as "Risk Message"
58+
values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations"
59+
values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object
60+
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
61+
earliest_offset: $info_min_time$
62+
latest_offset: $info_max_time$
63+
rba:
64+
message: A potential FakeCAPTCHA/ClickFix campaign execution was detected on $dest$ running a PowerShell command with hidden window and suspicious verification strings typical of social engineering attacks.
65+
risk_objects:
66+
- field: dest
67+
type: system
68+
score: 80
69+
threat_objects:
70+
- field: process
71+
type: process
72+
tags:
73+
analytic_story:
74+
- Fake CAPTCHA Campaigns
75+
asset_type: Endpoint
76+
mitre_attack_id:
77+
- T1059.001
78+
- T1204.001
79+
- T1059.003
80+
product:
81+
- Splunk Enterprise
82+
- Splunk Enterprise Security
83+
- Splunk Cloud
84+
security_domain: endpoint
85+
cve: []
86+
tests:
87+
- name: True Positive Test
88+
attack_data:
89+
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/captcha_windows-sysmon.log
90+
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
91+
sourcetype: XmlWinEventLog

‎detections/endpoint/windows_runmru_command_execution.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Windows RunMRU Command Execution
22
id: a15aa1ab-2b79-467f-8201-65e0f32d5b1a
3-
version: 6
4-
date: '2025-05-02'
3+
version: 7
4+
date: '2025-05-14'
55
author: Nasreddine Bencherchali, Michael Haag, Splunk
66
data_source:
77
- Sysmon EventID 12
@@ -66,6 +66,7 @@ rba:
6666
tags:
6767
analytic_story:
6868
- Lumma Stealer
69+
- Fake CAPTCHA Campaigns
6970
asset_type: Endpoint
7071
mitre_attack_id:
7172
- T1202

‎stories/fake_captcha_campaigns.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Fake CAPTCHA Campaigns
2+
id: b6578255-250a-4620-8e5e-7946e11ac2e9
3+
version: 1
4+
status: production
5+
date: '2025-05-14'
6+
author: Michael Haag, Splunk
7+
description: This analytic story addresses the emerging threat of Fake CAPTCHA and ClickFix campaigns that exploit users' familiarity with verification systems to deliver malware through clipboard manipulation techniques. First observed in early 2024 and increasing through 2025, these campaigns use deceptive interfaces that mimic legitimate CAPTCHA systems to trick users into executing malicious commands.
8+
narrative: Fake CAPTCHA campaigns represent a sophisticated evolution in social engineering attacks that rely entirely on manipulating user behavior rather than exploiting technical vulnerabilities. These attacks begin with victims landing on malicious websites through phishing emails, malvertising, or compromised legitimate sites. The site presents what appears to be a standard CAPTCHA verification interface with familiar branding from Google reCAPTCHA or Cloudflare. When users interact with the fake CAPTCHA, malicious JavaScript silently copies commands to their clipboard. Users are then instructed to perform additional verification steps such as pressing Windows+R followed by Ctrl+V, unknowingly pasting and executing malicious commands. These commands typically download and run additional malware using PowerShell scripts that operate in hidden windows. Common payloads include information stealers (Lumma, Redline, Vidar, PureLog), Remote Access Trojans (NetSupport, XWorm, AsyncRAT, Quasar), and multi-stage payloads that can deploy multiple malware families from a single infection.
9+
references:
10+
- https://urlhaus.abuse.ch/
11+
- https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape
12+
- https://reliaquest.com/blog/using-captcha-for-compromise/
13+
- https://attack.mitre.org/techniques/T1204/001/
14+
- https://github.com/MHaggis/ClickGrab
15+
tags:
16+
category:
17+
- Adversary Tactics
18+
product:
19+
- Splunk Enterprise
20+
- Splunk Enterprise Security
21+
- Splunk Cloud
22+
usecase: Advanced Threat Detection

0 commit comments

Comments
 (0)