Chrome's Gemini-Powered Scam Detection vs. ClickFix Attacks — Defender's Guide to Detection and Hardening

---
title: ClickFix Download Cradle Executed via PowerShell
description: Detects PowerShell execution with typical ClickFix download-cradle syntax (hidden window, bypass policy, IEX/Invoke-WebRequest to remote payload), consistent with a user pasting a command into the Run dialog after visiting a malicious page.
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cradle:
    CommandLine|contains:
      - 'iex'
      - 'Invoke-Expression'
      - 'Invoke-WebRequest'
      - 'irm '
      - 'iwr '
      - 'curl.exe'
      - 'DownloadString'
      - 'Start-BitsTransfer'
  selection_evasion:
    CommandLine|contains:
      - '-w hidden'
      - '-WindowStyle Hidden'
      - '-ep bypass'
      - '-ExecutionPolicy Bypass'
      - '-enc'
      - '-e '
      - 'frombase64string'
  condition: selection_img and selection_cradle and selection_evasion
falsepositives:
  - Legitimate IT automation scripts downloaded and run by administrators; tune by parent process and signer
level: high
---
title: ClickFix Execution via Mshta or Scripting Host from Run Dialog
description: Detects mshta.exe or wscript/cscript being launched by explorer.exe (typical of a Win+R pasted command) reaching out to a remote URL, a signature of ClickFix lures instructing users to paste an mshta one-liner.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
  selection_img:
    Image|endswith:
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\msiexec.exe'
  selection_cli:
    CommandLine|contains:
      - 'http://'
      - 'https://'
  condition: all of them
falsepositives:
  - Rare legitimate enterprise software installers using mshta; enterprise LOB msiexec deployments from internal share
level: high
---
title: Suspicious Run Dialog (Win+R) Command Execution
description: Detects processes spawned directly by the Windows Run dialog context (explorer.exe parent) with command lines containing scripting, encoded, or URL-based content — a strong ClickFix post-paste indicator.
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_cli:
    CommandLine|contains:
      - 'powershell'
      - 'mshta'
      - 'wscript'
      - 'cmd /c'
      - 'cmd.exe /c'
      - 'rundll32'
      - 'regsvr32'
  filter_known:
    CommandLine|contains:
      - 'control.exe'
      - 'appwiz.cpl'
      - 'ncpa.cpl'
      - 'services.msc'
  condition: selection_parent and selection_cli and not filter_known
falsepositives:
  - Power users and helpdesk staff manually launching tools via Win+R; baseline the environment and allowlist known admin patterns
level: medium

// ClickFix hunt: Run-dialog-spawned scripting with download-cradle syntax, plus follow-on network connection
let Lookback = 7d;
let SuspiciousProcs =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName =~ "explorer.exe"
    | where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "cmd.exe", "curl.exe")
    | where ProcessCommandLine has_any (
        "iex", "Invoke-Expression", "Invoke-WebRequest", "irm ", "iwr ",
        "DownloadString", "Start-BitsTransfer", "frombase64string",
        "-enc", "-ep bypass", "ExecutionPolicy Bypass",
        "http://", "https://")
    | project DeviceId, DeviceName, AccountName, ProcTime=TimeGenerated,
              FileName, ProcessCommandLine, ProcessId, SHA256, FolderPath;
SuspiciousProcs
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | project DeviceId, NetTime=TimeGenerated, InitiatingProcessId, RemoteUrl, RemoteIP, RemotePort
) on $left.ProcessId == $right.InitiatingProcessId and DeviceId
| where isnotempty(RemoteIP) or isempty(RemoteIP)
| summarize FirstSeen=min(ProcTime), LastSeen=max(ProcTime), Networks=make_set(RemoteUrl), RemoteIPs=make_set(RemoteIP)
    by DeviceName, AccountName, FileName, ProcessCommandLine
| order by FirstSeen desc;

-- Hunt: ClickFix indicators — RunMRU artifact plus explorer-spawned scripting/download cradles
LET runmru = SELECT
    Key.OSPath AS KeyPath,
    Key.Mtime AS KeyModified,
    { SELECT Data.value AS ValueName, String.Data AS Command FROM items(item=Key) } AS Entries
FROM foreach(row={ SELECT OSPath FROM glob(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Explorer/RunMRU/*', accessor='registry') })

LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(iex|invoke-expression|invoke-webrequest|downloadstring|-enc|-ep bypass|start-bitstransfer|frombase64string)'
   OR (Exe =~ '(?i)mshta\.exe$' AND CommandLine =~ '(?i)https?://')

SELECT 'process' AS Source, Name AS Detail1, CommandLine AS Detail2, Username AS Detail3, CreateTime AS Detail4 FROM procs

# ClickFix hardening and verification for Windows endpoints (run elevated)
# 1) Verify Chrome is current (Gemini scam protections roll out via Chrome updates)
$chrome = (Get-Item "${env:ProgramFiles}\Google\Chrome\Application\chrome.exe" -ErrorAction SilentlyContinue).VersionInfo.ProductVersion
Write-Output "Installed Chrome version: $chrome  (update via chrome://settings/help or your software distribution tool)"

# 2) Enforce Chrome Safe Browsing Enhanced Protection via policy (enables strongest scam/interstitial protections)
New-Item -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Name "SafeBrowsingProtectionLevel" -Value 2
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome" -Name "SafeBrowsingExtendedReportingEnabled" -Value 1
Write-Output "Chrome Safe Browsing Enhanced Protection enforced (level 2)."

# 3) Disable Win+R Run dialog via policy (high-value break-glass control for ClickFix; test for power users)
New-Item -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Force | Out-Null
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoRun" -Value 1
Write-Output "Run dialog disabled for current user (NoRun=1). Revert by setting NoRun to 0."

# 4) Constrain scripting: enforce PowerShell Constrained Language Mode via AppLocker/WDAC is preferred;
#    at minimum, block Office/child abuse patterns and enable Script Block + Module logging for forensics
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -Name "EnableModuleLogging" -Value 1
Write-Output "PowerShell Script Block and Module logging enabled (events in Microsoft-Windows-PowerShell/Operational)."

# 5) Quick sweep: dump RunMRU for the current user to check for pasted commands
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue |
  Select-Object -Property * | Out-String | Write-Output