Detecting Phishing Payload Delivery: LNK, ISO, HTA and ClickFix

Once a lure lands — by QR, callback, malvertising or email — delivery turns a file into execution: Office spawning interpreters, mounted ISO/IMG, LNK and HTA, and ClickFix clipboard-to-run. This pack covers detecting those chains on the endpoint.

Signals at a Glance

Office & Script Hosts

The classic and still-common signal is an Office application spawning a command interpreter or script host — almost never legitimate:

title: Office Application Spawning Interpreter
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\winword.exe'
            - '\excel.exe'
            - '\powerpnt.exe'
            - '\outlook.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
level: high

Containers, LNK & ClickFix

• Alert on ISO/IMG mount events followed by execution from the mounted volume (a Mark-of-the-Web bypass), and on explorer.exe launching LNK files that run interpreters or LOLBins.
• Alert on mshta.exe executing remote content and on regsvr32/rundll32 with network paths.
• For ClickFix, alert on explorer.exe (Run dialog) spawning PowerShell with a clipboard-pasted command — a user tricked into running the attacker’s own line.