[New] Windows Clickfix Investigation

[w0rk3r]

Summary

Adds an Agent Builder-centered Windows ClickFix investigation workflow. For a supported alert, the workflow collects bounded endpoint evidence and reputation context, constructs a typed evidence manifest, and asks the ClickFix Investigation Agent to produce a structured, evidence-referenced assessment.

After receiving a schema-valid agent response, the workflow creates, deduplicates, or repairs an Elastic Security Case and attaches selected correlated alerts. The disposition and attacker-behavior chain are AI-generated analytical conclusions for analyst review; evidence citations provide traceability to the collected observations.

The workflow performs investigation, external enrichment, and Case creation. It does not execute containment or endpoint response actions.

How it works

1. Target resolution: requires the triggering alert’s host ID, process entity ID, and original event time before beginning the investigation.
2. Evidence collection: follows the triggering process and observed descendants from one minute before through ten minutes after the alert. It collects process, file, library, network, DNS, PowerShell 4104, file-provenance, and related-alert evidence.
3. External enrichment: evaluates local hash and domain prevalence, then sends up to ten selected SHA-256 hashes and five selected domains or URLs to VirusTotal through the configured connector. No file content is uploaded.
4. Agent analysis: sends a compact, typed evidence manifest to clickfix-investigation-agent. The agent is instructed to call its assigned read-only ES|QL tool at most once to retrieve up to 20 fragments for one exact PowerShell script-block locator. It returns a disposition, confidence, rationale, material uncertainties, and a structured three-to-eight-stage attacker-behavior chain.
5. Case delivery: creates or recovers a Security Case after validating the agent response. It attaches the trigger and alerts selected through exact entity-ID correlation. Host-and-time-only alerts remain contextual evidence and are not attached.

Trigger and scope

The workflow uses an alert trigger and currently provides a specialized investigation for Suspicious Command Execution via Windows Run (f4f436c8-5c4a-4f61-b0cc-17b154920887).

Alerts without the required host, process, or time context return an explicit unresolved result without creating a Case. Unsupported behaviors return an explicit unsupported result.

Included components

• windows-clickfix-investigation.yaml: the alert-triggered investigation, enrichment, agent invocation, and Case-delivery workflow.
• windows-clickfix-agent.md: setup instructions for the ClickFix Investigation Agent and its read-only ES|QL tool.
• README.md: workflow catalog entry and setup guidance.

The agent is assigned exactly one ClickFix-specific custom tool. Elastic capabilities are disabled, although Agent Builder may still show built-in tools in the active-tool total.

Prerequisites

• Elastic Workflows, Elastic Security, and Agent Builder.
• Elastic Defend process, file, and network telemetry.
• Windows PowerShell Operational logs for script-block retrieval.
• A configured VirusTotal connector.
• Replace every REPLACE_WITH_CONNECTOR_ID value before importing the workflow.
• Create clickfix.get_script_block before creating the agent so the tool is available for assignment.

External data disclosure: VirusTotal enrichment sends selected hashes and domains or URLs outside the Elastic deployment. Operators should review applicable licensing, privacy, and data-handling requirements before configuring the connector.

Investigation boundaries

• Investigation scope is anchored to the exact triggering host, process entity, and original event time.
• Evidence receives citation-addressable IDs within each execution so agent claims can be traced to collected observations.
• Observed telemetry, candidate script behavior, third-party reputation, and agent inference remain distinct.
• Script content describes intended behavior unless event evidence confirms that the activity completed.
• VirusTotal results enrich the investigation but do not override endpoint observations or establish benignness.
• A schema-valid agent response is required for Case delivery. Agent failure does not create a malformed Case.
• Related-alert attachment represents correlation through exact entity identifiers within the investigation scope, not independent proof of causality.
• complete_within_policy means the configured bounded collection and enrichment checks reconciled successfully; it does not imply unlimited investigative completeness.
• Case delivery is mutating and uses best-effort idempotency. It first checks for a Case attached to the exact trigger alert, then checks for one Case carrying the source-alert recovery tag. This is not transactional protection against concurrent executions, and an interrupted run can leave a partially delivered Case for a later run to repair.

Testing

Validated end to end in an Elastic Serverless deployment using the July 20 alert generated from malware delivered through a Cloudflare CAPTCHA ClickFix flow.

The final execution:

• Completed 125 workflow steps with zero failures.
• Reached complete_within_policy coverage for the configured investigation boundary.
• Produced a malicious disposition with high confidence.
• Produced an eight-stage attacker-behavior chain with evidence citations.
• Identified 24 related alerts: 21 entity-correlated and three host-and-time-only contextual alerts.
• Created a Security Case containing the trigger plus the 21 entity-correlated alerts, for 22 attached alerts total.

Case Markdown: https://gist.github.com/w0rk3r/5a6e84ee4ef046bf244271012671fcb2

Workflow execution JSON: https://p.elstc.co/?4411f86bd36d00f0#8GnhUWvRsNzqg4HWXaimrjxVWdTZwB64c3qZQERPq7ux