{
  "node_id": "mitre-attack-t1204-004-malicious-copy-and-paste",
  "title": "MITRE ATT&CK T1204.004: Malicious Copy and Paste (Enterprise Tactic TA0002 - Execution)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-06-06",
  "bluf": "MITRE ATT&CK T1204.004 (Malicious Copy and Paste) is an Enterprise Execution technique. An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is \"ClickFix,\" in which adversaries present users with seemingly helpful solutions—such as prompts to fix errors or complete CAPTCHAs—that instead instruct the user to copy and paste malicious code. Malicious websites, such as those used in Drive-by Compromise, may present fake error messages or CAPTCHA prompts that instruct users to open a terminal or the Windows Run Dialog box and execute an arbitrary command. These commands may be obfuscated using encoding or other techniques to conceal malicious intent. Once executed, the adversary will typically be able... Affected platforms: Linux, macOS, Windows. Sub-technique of ATT&CK T1204. ATT&CK-mapped mitigations: M1038 Execution Prevention, M1031 Network Intrusion Prevention, M1021 Restrict Web-Based Content.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "mitre_d3fend"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-cybersecurity-framework-2-0",
    "iso-27001-2022",
    "nist-sp-800-53-r5",
    "cis-controls-v8",
    "mitre-attack-framework-v14"
  ],
  "primary_citations_count": 7
}