Microsoft ClickFix LOLBIN Stacking cmd and curl
This rule detects two distinct patterns associated with the 'ClickFix' social engineering technique, as described by Microsoft. The first pattern identifies the stacking of 'cmd.exe /c' commands, indicating a multi-stage command execution. The second pattern focuses on obfuscated 'curl' commands, specifically looking for escape characters within 'curl' or 'curl.exe' combined with indicators of network communication (HTTP/HTTPS URLs, PHP, or BAT file extensions). This combination suggests an attempt to download or execute malicious content using an obfuscated 'curl' command.
Sigma
