Hunting For Malicious Click Fix Cases From Airports
Query
let Airport_Data = externaldata(AirportName:string, maxLatitude: decimal, minLatitude:decimal, maxLongitude:decimal, minLongitude:decimal,iata:string, country: string,maxlatindicator:int)[@"https://raw.githubusercontent.com/Sergio-Albea-Git/Threat-Hunting-KQL-Queries/refs/heads/main/Security-Lists/Airport_polygon.csv"] with (format="csv", ignoreFirstRecord=True);
DeviceNetworkEvents
| where InitiatingProcessFileName has_any("powershell.exe", "curl.exe", "wget.exe", "Invoke-WebRequest")
| where RemoteUrl has_any(".png", ".html", ".htm") or RemotePort == 443 or RemotePort == 80
| extend geo = geo_info_from_ip_address(LocalIP) | extend Country = tostring(geo.country), Latitude = tostring(geo.latitude),Longitude = tostring(geo.longitude)
| extend Latitude0 = todecimal(Latitude), Longitude0 = todecimal(Longitude)
| extend IntegerPart = toint(Latitude0)
| join kind=inner (Airport_Data) on $left.IntegerPart == $right.maxlatindicator
| where Latitude0 < minLatitude and Latitude0 < maxLatitude and Longitude0 > minLongitude and Longitude0 < maxLongitude
| summarize make_set(AirportName), make_set(country),dcount(AirportName) by ActionType,RemoteIP,InitiatingProcessCommandLine,RemoteUrl, CountryAbout this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1204.004 | User Execution: Malicious Copy and Paste |
Author: Sergio Albea (12/09/2025)
Hunting for Malicious ClickFix cases executed from Airports
Description: A few months ago, I shared a post about the risks of users signing in from airport networks. These can easily be spoofed by malicious actors setting up fake Wi-Fi hotspots to harvest user credentials and other sensitive data. Now, a new case has been reported involving users clicking on fraudulent Wi-Fi portals that trick them into executing a “connect” action to what appears to be a legitimate network. These are essentially click-fix attacks, so I’m updating my KQL query to capture all types of DeviceEvents triggered from airport latitude and longitude locations. This should help identify a wider range of suspicious activities originating in such environments.
Explanation
This KQL query is designed to detect suspicious network activities that might indicate a "click-fix" attack, particularly from users connecting to Wi-Fi networks at airports. Here's a simplified breakdown of what the query does:
-
Load Airport Data: It imports a list of airports with their geographical boundaries (latitude and longitude) from an external CSV file.
-
Filter Network Events: It looks at device network events where certain processes (like
powershell.exe,curl.exe,wget.exe,Invoke-WebRequest) are used. These processes are often associated with downloading or executing scripts. -
Check URLs and Ports: It further filters these events to those involving URLs with specific file extensions (like
.png,.html,.htm) or common web ports (80 for HTTP, 443 for HTTPS). -
Geolocation: It extracts geographical information (country, latitude, longitude) from the IP address of the device initiating the network event.
-
Match with Airport Locations: It compares the geolocation data with the imported airport data to identify events occurring within airport boundaries.
-
Summarize Results: Finally, it summarizes the findings by listing the airports and countries involved, along with the count of events, action types, remote IPs, command lines, and URLs associated with these suspicious activities.
The goal is to identify potential security threats from users connecting to fake or malicious Wi-Fi networks at airports, which could lead to credential theft or other malicious activities.
Details
Sergio Albea
Released: July 21, 2026
Tables
Keywords
Operators
MITRE Techniques