ClickFix Attack via Fake Cloudflare Pages: Detection and Remediation Guide

---
title: Potential ClickFix Attack - Browser Spawning Shell
id: 4a8f2e1b-9c3d-4f7a-8b1e-0d5c6a7b8c9d
status: experimental
description: Detects web browsers spawning command-line shells, a common behavior in ClickFix attacks where users are tricked into pasting commands or clicking links that trigger local execution.
references:
 - https://securityaffairs.com/192613/security/fbi-director-kash-patels-brand-website-taken-offline-after-malware-reports.html
author: Security Arsenal
date: 2025/02/07
tags:
 - attack.initial_access
 - attack.t1059.001
 - attack.execution
logsource:
 category: process_creation
 product: windows
detection:
 selection:
   ParentImage|endswith:
     - '\chrome.exe'
     - '\msedge.exe'
     - '\firefox.exe'
     - '\brave.exe'
   Image|endswith:
     - '\powershell.exe'
     - '\cmd.exe'
     - '\powershell_ise.exe'
     - '\wscript.exe'
     - '\cscript.exe'
 condition: selection
falsepositives:
 - Legitimate developers testing web applications locally
 - rare misbehaving browser extensions
level: high
---
title: Suspicious PowerShell Copy-Paste Activity
id: 7b9c0d1e-2a3f-4b5c-6d7e-8f9a0b1c2d3e
status: experimental
description: Detects PowerShell commands containing keywords associated with fake Cloudflare or browser update fixes often seen in ClickFix campaigns.
references:
 - https://securityaffairs.com/192613/security/fbi-director-kash-patels-brand-website-taken-offline-after-malware-reports.html
author: Security Arsenal
date: 2025/02/07
tags:
 - attack.execution
 - attack.t1059.001
logsource:
 category: process_creation
 product: windows
detection:
 selection_cli:
   CommandLine|contains:
     - 'cloudflare'
     - 'browser update'
     - 'verification code'
   Image|endswith: '\powershell.exe'
 condition: selection_cli
falsepositives:
 - Admins manually troubleshooting Cloudflare issues (rare via CLI)
level: medium

let Browsers = pack_array("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe");
let Shells = pack_array("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe");
DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName in (Shells)
| where InitiatingProcessFileName in (Browsers)
| extend ProcessIntegrity = tostring(ProcessIntegrityLevel)
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ProcessIntegrity
| join kind=inner (
    DeviceNetworkEvents
    | where Timestamp > ago(1d)
    | where InitiatingProcessFileName in (Shells)
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessId
) on $left.Timestamp, $left.DeviceName, $left.ProcessId
| project Timestamp, DeviceName, AccountName, BrowserCommand=InitiatingProcessCommandLine, ShellCommand=ProcessCommandLine1, RemoteUrl, RemoteIP, SHA256

-- Hunt for browser processes spawning shells (ClickFix TTP)
SELECT 
    Pid,
    Name as ProcessName,
    CommandLine,
    Exe,
    Username,
    Parent.Pid as ParentPid,
    Parent.Name as ParentName,
    Parent.CommandLine as ParentCommandLine
FROM pslist()
WHERE Parent.Name =~ "chrome.exe" 
   OR Parent.Name =~ "msedge.exe" 
   OR Parent.Name =~ "firefox.exe"
   AND (Name =~ "powershell.exe" 
        OR Name =~ "cmd.exe" 
        OR Name =~ "wscript.exe")

# Triage and Hardening Script for ClickFix Vectors
# Requires Admin Privileges

Write-Host "[+] Starting ClickFix Triage and Hardening..." -ForegroundColor Cyan

# 1. Hunt for suspicious unsigned executables in user temp folders (Common payload drop)
Write-Host "[!] Scanning for unsigned executables in User Temp directories..." -ForegroundColor Yellow
$tempPaths = @("$env:TEMP", "$env:LOCALAPPDATA\Temp")
$suspiciousFiles = @()

foreach ($path in $tempPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Filter "*.exe" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            if (-not ($_.VersionInfo.CompanyName) -or $_.VersionInfo.CompanyName -eq "") {
                # Flag files created in the last 7 days with no Company Name
                if ($_.LastWriteTime -gt (Get-Date).AddDays(-7)) {
                    $suspiciousFiles += $_
                }
            }
        }
    }
}

if ($suspiciousFiles.Count -gt 0) {
    Write-Host "[WARNING] Found suspicious unsigned executables:" -ForegroundColor Red
    $suspiciousFiles | Format-Table FullName, LastWriteTime, Length -AutoSize
} else {
    Write-Host "[+] No suspicious unsigned executables found in Temp folders." -ForegroundColor Green
}

# 2. Check/Enable ASR Rule to Block Office Apps from creating child processes (Proxy for Script Blocking)
# Note: Specific "Block browser from spawning" rule is often managed via MDM, checking Audit state here.
Write-Host "[!] Checking Attack Surface Reduction (ASR) Audit Status..." -ForegroundColor Yellow
$asrGuids = @(
    "D4F940AB-401B-4EFC-AADC-AD5A20A0A5CC" # Block Adobe Reader from creating child processes
    "3B576869-A4EC-4529-8536-B80A7769E899"  # Block Office apps from creating child processes
)

foreach ($guid in $asrGuids) {
    $currentSetting = (Get-MpPreference -ErrorAction SilentlyContinue).AttackSurfaceReductionRules_Actions
    $ruleIndex = [array]::indexof((Get-MpPreference).AttackSurfaceReductionRules_Ids, $guid)
    
    if ($ruleIndex -ge 0) {
        $action = $currentSetting[$ruleIndex]
        $status = switch ($action) {
            0 { "Disabled" }
            1 { "Block" }
            2 { "Audit" }
            6 { "Warn" }
            default { "Unknown" }
        }
        Write-Host "ASR Rule $guid is currently set to: $status"
    } else {
        Write-Host "ASR Rule $guid is not configured."
    }
}

Write-Host "[+] Triage Complete. If suspicious files were found, isolate the endpoint and initiate IR." -ForegroundColor Cyan