KQL Search

This query is designed to detect a specific type of cyber attack known as the "ClickFix" attack, which was observed in February 2026. The attack involves using a social engineering technique where victims are tricked into running the nslookup command with a specific DNS server controlled by attackers. This malicious server then sends back a PowerShell script in the DNS response, which is executed to install malware like ModeloRAT.

Here's a simple breakdown of what the query does:

1. Data Source: It looks at security events, specifically those related to process creation (Event ID 4688).

2. Time Frame: The query checks for events that occurred in the last hour.

3. Process Monitoring: It focuses on instances where the nslookup.exe process is run.

4. Command Line Analysis: The query identifies nslookup commands that specify an explicit DNS server IP address, which is a key indicator of this attack. It uses specific patterns and regular expressions to find these commands.

5. Parent Process Check: It checks if the parent process of nslookup.exe is a shell or script interpreter like cmd.exe or powershell.exe, which is common in such attacks.

6. Output: The query projects details such as the time of the event, the computer involved, the user account, the command line used, and the parent process.

7. Alerting: If such an event is detected, it triggers an alert with a high severity level, providing details about the computer and account involved, and the command that was executed.

8. Entity Mapping: It maps the computer and account details to entities for better identification and tracking.

9. Alert Customization: The alert includes a custom message that highlights the nature of the attack and provides specific details about the command used.

Overall, this query is a security measure to detect and alert on potential ClickFix attacks by monitoring for suspicious nslookup usage patterns.