ClickFix Triage Query

MDE Click Fix Triage Query

Query

// Input variables
let VictimDeviceId = "xxxxxxxxx";
let TopXEvents = 15;
let TimeFrame = 5m;
// Input parameters for the forensic hunting query
let Parameters = dynamic(['http', 'https', 'Encoded', 'EncodedCommand', '-e', '-eC', '-enc', "-w", '-i', '/i','/e', '/eC', '/enc', "/w", 'wind', 'nop', 'DownloadString', 'FromBase64String', 'iwr', '$env']);
let Executables = dynamic(["cmd", "powershell", "curl", "mshta", "msiexec", 'SyncAppvPublishingServer']);
let FilteredSIDs = dynamic(["S-1-5-18"]);
let RegKeyEvents =
    DeviceRegistryEvents
    | where DeviceId =~ VictimDeviceId
    | where ActionType == "RegistryValueSet"
    | where RegistryKey has "RunMRU"
    | where RegistryValueData has_any (Parameters) and RegistryValueData has_any (Executables)
    | extend LogType = "☢️ RunMRU Event"
    | project TimeGenerated, DeviceId, DeviceName, RegistryValueData, RegistryKey, LogType;
let RegKeyEventTimestamp = toscalar (RegKeyEvents | summarize Timestamp = max(TimeGenerated));
let NetworkEventsParser = materialize (DeviceNetworkEvents
    | where DeviceId =~ VictimDeviceId
    | where not(InitiatingProcessAccountSid in~ (FilteredSIDs))
    | where isnotempty(RemoteUrl)
    | extend MatchTimeStamp = RegKeyEventTimestamp
    | project TimeGenerated, RemoteIP, RemoteUrl, ReportId, DeviceId, DeviceName, MatchTimeStamp, InitiatingProcessCommandLine);
let PreInfectionNetworkEvents =
    NetworkEventsParser
    | where TimeGenerated between ((MatchTimeStamp - TimeFrame) .. MatchTimeStamp)
    | top TopXEvents by TimeGenerated desc
    | extend LogType = "🛜 Pre Infection Network Event";
let PostInfectionNetworkEvents =
    NetworkEventsParser
    | where TimeGenerated between (MatchTimeStamp .. (MatchTimeStamp + TimeFrame))
    | top TopXEvents by TimeGenerated asc
    | extend LogType = "🛜 Post Infection Network Event";
let PostInfectionProcessEvents = DeviceProcessEvents
    | where DeviceId =~ VictimDeviceId
    | where TimeGenerated between (RegKeyEventTimestamp .. (RegKeyEventTimestamp + TimeFrame))
    | top TopXEvents by TimeGenerated asc
    | where not(InitiatingProcessAccountSid in~ (FilteredSIDs))
    | extend LogType = "♻️ Post Infection Process Event"
    | project TimeGenerated, ReportId, LogType, DeviceId, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine;
let PostInfectionFileEvents = DeviceFileEvents
    | where DeviceId =~ VictimDeviceId
    | where TimeGenerated between (RegKeyEventTimestamp .. (RegKeyEventTimestamp + TimeFrame))
    | top TopXEvents by TimeGenerated asc
    | where not(InitiatingProcessAccountSid in~ (FilteredSIDs))
    | extend LogType = "📁 Post Infection File Event"
    | project TimeGenerated, ReportId, LogType, DeviceId, DeviceName, ActionType, InitiatingProcessCommandLine, FolderPath;
union isfuzzy=false PreInfectionNetworkEvents,RegKeyEvents, PostInfectionNetworkEvents, PostInfectionProcessEvents, PostInfectionFileEvents
| sort by TimeGenerated asc
| project-reorder TimeGenerated, DeviceId, DeviceName, LogType, RemoteUrl, RegistryValueData, ProcessCommandLine, FolderPath, InitiatingProcessCommandLine

About this query

Explanation

This KQL query is designed to help analyze and triage incidents related to a tool called ClickFix. Here's a simple breakdown of what the query does:

Input Variables:
- VictimDeviceId: The ID of the device that experienced the incident.
- TopXEvents: The number of events to collect before and after a specific action.
- TimeFrame: The time window around the action to consider for event collection.
Purpose:
- The query is used to gather and analyze different types of events related to a potential security incident on a device. It focuses on events surrounding a suspicious registry change (specifically, the "RunMRU" registry key).
Data Collection:
- Pre-Infection Network Events: Collects network events that occurred before the suspicious registry change, which might indicate the source of the infection.
- RunMRU Event: Identifies the registry change event itself, which is a key indicator of compromise.
- Post-Infection Network Events: Collects network events that occurred after the registry change, which might show further malicious activity.
- Post-Infection Process Events: Collects process-related events that occurred after the registry change, indicating what processes might have been affected or initiated.
- Post-Infection File Events: Collects file-related events that occurred after the registry change, showing any file modifications or creations.
Output:
- The query outputs a sorted list of events, categorized by type (network, registry, process, file), to provide a comprehensive view of the incident timeline and help in understanding the scope and impact of the incident.

This query is useful for security analysts to quickly gather relevant information about a potential security incident and make informed decisions on how to respond.

Details

Bert-Jan Pals

Released: January 11, 2026

Tables

DeviceRegistryEventsDeviceNetworkEventsDeviceProcessEventsDeviceFileEvents

Keywords

DevicesNetworkEventsProcessFileRegistry

Operators

letdynamic=~==hashas_anyextendprojecttoscalarsummarizematerializebetweentopascdescunionisfuzzysortproject-reordernotin~

Actions

GitHub

KQL Search