@chrissanders88@infosec.exchange
2026-07-21 14:08 UTC
Investigation Scenario 🔎
Alert: Microsoft Defender for Endpoint: Behavior:Win32/SuspClickFix.F detected on a Windows 11 workstation.
No additional context is provided. What artifacts would you examine first to determine whether the user executed the ClickFix command?
To go further, what would you look for to determine whether the alert represents the beginning of an ACR Stealer intrusion?
#InvestigationPath #DFIR #SOC
Replies (1)
-
@13reak@infosec.exchange 2026-07-21 16:42
@chrissanders88@infosec.exchange Since most of it is PowerShell or HTA, I'd first check Powershell logs and then check the file system for new HTA files: NTFS, Journal, sysmon, evidence of execution. If there's Defender for Cloud, it's worth a look. And ofc check RunMRU (commands of run dialog) for common lolbins. #DFIR #analysis #incidentresponse #cybersecurity #infosec