ClickFix at Scale: 17,000 Malicious URLs, Fake CAPTCHAs, and Why Domain Blocking Is Dead — Detection and Hardening Guide

---
title: ClickFix Run Dialog Spawned Script Interpreter or LOLBin
id: 3f8a1c92-7b4e-4d1a-9c55-2e6b8d0f4a71
status: experimental
description: Detects ClickFix-style execution where a user pastes a malicious command into the Windows Run dialog, causing explorer.exe to spawn mshta, powershell, rundll32, regsvr32 or cmd with a remote URL or encoded payload. High-fidelity fingerprint of fake CAPTCHA/browser-update lures.
references:
  - https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.html
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1218/005/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1218.005
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\cmd.exe'
  selection_cl:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - '-enc'
      - '-e '
      - 'FromBase64String'
      - 'iex'
      - 'iwr'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'curl '
      - 'certutil'
  condition: selection_parent and selection_child and selection_cl
falsepositives:
  - Administrators pasting commands into Run dialog (rare in most environments)
  - Software deployment tools with interactive shell usage
level: high
---
title: Mshta Network Connection to External Host
id: 6b2d9e47-1f3a-4c8b-a2d6-9f0e5c7b8d23
status: experimental
description: Detects mshta.exe establishing outbound network connections, consistent with ClickFix payloads retrieving remote HTA content. Mshta has virtually no legitimate reason to initiate network traffic in enterprise environments.
references:
  - https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.html
  - https://attack.mitre.org/techniques/T1218/005/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.command_and_control
  - attack.t1218.005
  - attack.t1105
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\mshta.exe'
  filter_local:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '127.0.0.0/8'
  condition: selection and not filter_local
falsepositives:
  - Legacy intranet HTA applications (rare; baseline and allowlist per host)
level: high
---
title: ClickFix Lure Page Clipboard and Run Dialog Instruction Artifacts
id: 9c4e7a15-2d8b-4f61-b3c9-5a1d6e8f0c42
status: experimental
description: Detects suspicious PowerShell execution combining hidden window styles with download cradles and Base64 obfuscation, typical of ClickFix paste-payloads staged via fake verification pages. Tune against your admin tooling baselines before production deployment.
references:
  - https://thehackernews.com/2026/09/17000-urls-reveal-how-clickfix-turns.html
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1059.001
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_hidden:
    CommandLine|contains:
      - '-w hidden'
      - '-windowstyle hidden'
      - '-win hidden'
      - '-noni'
  selection_cradle:
    CommandLine|contains:
      - 'DownloadString'
      - 'DownloadFile'
      - 'Start-BitsTransfer'
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'wget '
      - 'curl.exe '
  condition: selection_img and selection_hidden and selection_cradle
falsepositives:
  - Enterprise software updaters using hidden PowerShell download logic
  - RMM tooling scripts
level: medium

// ClickFix hunt: Run-dialog-pasted payload execution (explorer.exe parentage)
// and follow-on network activity. Lookback: 14 days.
let lookback = 14d;
let SuspiciousChildren = dynamic(["mshta.exe","powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","cmd.exe","curl.exe"]);
let ClickFixExec = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ (SuspiciousChildren)
| where ProcessCommandLine has_any ("http://","https://","-enc","FromBase64String","DownloadString","Invoke-Expression","iex ","iwr ","certutil")
| project ExecutionTime=Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, ProcessId, SHA256, ReportId;
ClickFixExec
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(lookback)
    | where InitiatingProcessFileName in~ (SuspiciousChildren)
    | project NetTime=Timestamp, DeviceName, InitiatingProcessId, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
) on $left.ProcessId == $right.InitiatingProcessId and $left.DeviceName == $right.DeviceName
| project ExecutionTime, DeviceName, AccountName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, SHA256
| order by ExecutionTime desc

// macOS ClickFix variant: curl/osascript piped payloads executed via Terminal
DeviceProcessEvents
| where Timestamp > ago(14d)
| where DeviceOSPlatform has "macOS"
| where InitiatingProcessFileName in~ ("Terminal","iTerm2","zsh","bash","loginwindow")
| where FileName in~ ("curl","bash","zsh","osascript","python","python3")
| where ProcessCommandLine has_any ("| bash","| sh","| zsh","curl -s","base64 -d","eval ","-e do shell script")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| order by Timestamp desc

-- ClickFix scoping: find explorer-spawned LOLBin/script interpreter processes
-- and pull RunMRU history per user hive for pasted-command forensics
LET suspicious_procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       dict(Name=parent.Name, Exe=parent.Exe) AS Parent
FROM pslist()
LET parent = SELECT Pid, Name, Exe FROM pslist()
WHERE Name =~ '(?i)mshta|powershell|pwsh|rundll32|regsvr32|cmd|curl'

SELECT Pid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(https?://|-enc|frombase64string|downloadstring|iex|iwr)'
  AND Name =~ '(?i)mshta|powershell|pwsh|rundll32|regsvr32|cmd|curl'

-- Separately hunt RunMRU artifacts (run per-user hive via Windows.Registry.Hunter
-- or collect the key directly):
-- Key: HKEY_USERS\*\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
-- Suspicious MRUListEx entries containing http, mshta, powershell, or base64 blobs
-- are direct evidence of the pasted ClickFix payload.

# ClickFix Defense Audit & Hardening — run elevated
# 1) Verify Script Block Logging + Module Logging (payload visibility)
$sbl = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
if (-not (Test-Path $sbl)) { New-Item -Path $sbl -Force | Out-Null }
Set-ItemProperty -Path $sbl -Name 'EnableScriptBlockLogging' -Value 1 -Type DWord
Write-Host "[+] PowerShell Script Block Logging enabled (Event ID 4104)." -ForegroundColor Green

# 2) Sweep current user's RunMRU for ClickFix-style pasted payloads
$runMru = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
$suspicious = 'http|https|mshta|powershell|-enc|FromBase64String|iex|iwr|curl|certutil|rundll32'
if (Test-Path $runMru) {
    $hits = Get-ItemProperty -Path $runMru | Select-Object -Property * |
        Out-String -Stream | Select-String -Pattern $suspicious
    if ($hits) {
        Write-Host "[!] SUSPICIOUS RunMRU entries found — possible prior ClickFix execution:" -ForegroundColor Red
        $hits | ForEach-Object { Write-Host "    $_" }
    } else {
        Write-Host "[+] RunMRU clean of URL/script-interpreter patterns for this user." -ForegroundColor Green
    }
}

# 3) Deploy mshta AppLocker rule in AUDIT mode first (baseline before Enforce)
$ruleXml = @'
<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="AuditOnly">
    <FilePathRule Id="a1b2c3d4-1111-4222-8333-444455556666" Name="Audit mshta.exe (ClickFix control)" Description="Audits mshta execution fleet-wide" UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions><FilePathCondition Path="%SYSTEM32%\MSHTA.EXE" /></Conditions>
    </FilePathRule>
  </RuleCollection>
</AppLockerPolicy>
'@
$ruleXml | Out-File "$env:TEMP\mshta-audit.xml" -Encoding UTF8
Write-Host "[i] mshta audit policy written to $env:TEMP\mshta-audit.xml — import via GPO/Intune after review." -ForegroundColor Yellow

# 4) Confirm AMSI is functional (payload content inspection)
try {
    $amsi = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
    Write-Host "[+] AMSI interface present; ensure AV provider is registered (Get-MpComputerStatus)." -ForegroundColor Green
} catch { Write-Host "[!] AMSI check failed — investigate AV health." -ForegroundColor Red }

# 5) Verify Attack Surface Reduction rules relevant to script abuse
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids |
    ForEach-Object { Write-Host "[i] ASR rule configured: $_" }