Brand Impersonation & ClickFix: Defending Against Fake Cloudflare Attacks

---
title: Potential ClickFix Attack - Browser Spawning Shell
id: 8a4b2c19-1d3e-4f5a-a6b7-8c9d0e1f2a3b
status: experimental
description: Detects browsers spawning shell processes like PowerShell or CMD, a common indicator of ClickFix or fake browser update attacks.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate developer workflows (rare in non-engineering environments)
  - Local HTML files launching scripts (admin tools)
level: high
---
title: Fake Cloudflare Update - Suspicious PowerShell Arguments
id: 9c5d3e20-2e4f-5g6b-b7c8-0d1e2f3a4b5c
status: experimental
description: Detects PowerShell commands containing keywords associated with fake browser updates or Cloudflare verification pages.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/22
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - 'cloudflare'
      - 'checking your browser'
      - 'verify you are human'
      - 'press allow'
      - 'browser update'
      - 'install-extension'
  condition: selection
falsepositives:
  - Legitimate Cloudflare utility scripts (very rare)
level: critical

// Hunt for ClickFix activity: Browsers spawning shells
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in ('chrome.exe', 'msedge.exe', 'firefox.exe', 'brave.exe')
| where FileName in ('powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe')
| extend ProcessDetail = strcat(ProcessCommandLine, " | ", FolderPath)
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

-- Hunt for processes spawned by browsers that look like shell commands
SELECT Pid, Ppid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Pid IN (
    SELECT Pid FROM pslist()
    WHERE Name =~ 'chrome.exe' OR Name =~ 'msedge.exe' OR Name =~ 'firefox.exe'
)
  AND (Name =~ 'powershell.exe' OR Name =~ 'cmd.exe' OR Name =~ 'wscript.exe')

# Incident Response Script: Check for signs of ClickFix execution
# This script checks for recent PowerShell events initiated by browsers

$StartTime = (Get-Date).AddHours(-24)
$BrowserProcesses = @('chrome.exe', 'msedge.exe', 'firefox.exe')
$ShellProcesses = @('powershell.exe', 'cmd.exe', 'wscript.exe')

Write-Host "[+] Scanning for ClickFix indicators in the last 24 hours..." -ForegroundColor Cyan

# Check PowerShell Script Block Logs for suspicious commands
try {
    $Events = Get-WinEvent -FilterHashtable @{
        LogName='Microsoft-Windows-PowerShell/Operational'
        ID=4104
        StartTime=$StartTime
    } -ErrorAction SilentlyContinue

    if ($Events) {
        $SuspiciousEvents = $Events | Where-Object { 
            $_.Message -match 'cloudflare' -or 
            $_.Message -match 'checking your browser' -or
            $_.Message -match 'downloadstring'
        }
        
        if ($SuspiciousEvents) {
            Write-Host "[!!!] CRITICAL: Suspicious PowerShell script blocks found matching ClickFix keywords." -ForegroundColor Red
            $SuspiciousEvents | Select-Object TimeCreated, Id, Message | Format-List
        } else {
            Write-Host "[+] No suspicious PowerShell script blocks detected." -ForegroundColor Green
        }
    }
} catch {
    Write-Host "[-] Could not read PowerShell logs. Ensure Script Block Logging is enabled." -ForegroundColor Yellow
}

# Check for recent processes matching the parent-child profile
Write-Host "[+] Checking process lineage..."
$Procs = Get-CimInstance Win32_Process | Where-Object { 
    $_.CreationDate -gt $StartTime 
}

foreach ($Proc in $Procs) {
    $Parent = $Procs | Where-Object { $_.ProcessId -eq $Proc.ParentProcessId }
    if ($Parent -and $ShellProcesses -contains $Proc.Name.ToLower()) {
        if ($BrowserProcesses -contains $Parent.Name.ToLower()) {
            Write-Host "[!!!] ALERT: $($Proc.Name) (PID: $($Proc.ProcessId)) spawned by browser $($Parent.Name) (PID: $($Parent.ProcessId))" -ForegroundColor Red
            Write-Host "     Command: $($Proc.CommandLine)" -ForegroundColor DarkRed
        }
    }
}

Write-Host "[+] Scan complete. If alerts were triggered, isolate the endpoint and initiate IR." -ForegroundColor Cyan