ClickFix Attacks Delivering Vidar Infostealer: ACSC Detection & Defense Guide

---
title: Potential ClickFix Activity - Browser Spawning PowerShell
id: 8a1b2c3d-4e5f-6789-0abc-1d2e3f4a5b6c
status: experimental
description: Detects potential ClickFix social engineering where a browser process spawns PowerShell. This is highly suspicious as browsers do not typically launch shell environments.
references:
  - https://www.cyber.gov.au/acsc/view-all-content/alerts/clickfix
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative web tools launching local scripts (rare)
level: high
---
title: ClickFix Payload Delivery - PowerShell Spawning MSHTA with URL
id: 9b2c3d4e-5f6a-7890-1bcd-2e3f4a5b6c7d
status: experimental
description: Detects the classic ClickFix payload delivery where PowerShell launches mshta.exe with a remote URL argument, indicative of fetching a malicious HTML Application (HTA).
references:
  - https://attack.mitre.org/techniques/T1059/001
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
    Image|endswith: '\mshta.exe'
    CommandLine|contains: 'http'
  condition: selection
falsepositives:
  - Legacy internal enterprise applications launching help files
level: critical
---
title: Vidar Stealer Behavior - PowerShell DownloadString
id: 0c3d4e5f-6a7b-8901-2cde-3f4a5b6c7d8e
status: experimental
description: Detects PowerShell commands characteristic of ClickFix droppers, specifically combining 'DownloadString' with obfuscation techniques or direct execution.
references:
  - https://www.infosecurity-magazine.com/news/australian-cyber-security-centre/
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX '
      - 'Invoke-Expression'
  filter_legit_admin:
    CommandLine|contains:
      - 'System.Management.Automation'
  condition: selection and not filter_legit_admin
falsepositives:
  - Administrators running remote scripts manually
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for ClickFix: Browser -> PowerShell -> MSHTA or Network Request
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ('chrome.exe', 'msedge.exe', 'firefox.exe')
| where FileName in~ ('powershell.exe', 'cmd.exe', 'mshta.exe')
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| extend ClickFixIndicator = iff(
    FileName =~ 'powershell.exe' and (ProcessCommandLine contains 'DownloadString' or ProcessCommandLine contains 'IEX'), 'Suspicious PS Command',
    FileName =~ 'mshta.exe' and ProcessCommandLine contains 'http', 'Suspicious MSHTA Execution',
    'Suspicious Parent Process')
| where isnotempty(ClickFixIndicator)
| order by Timestamp desc


**Velociraptor VQL**

-- Hunt for Browser Spawning PowerShell or CMD
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM chain(
  parent=pslist(),
  child=pslist()
)
WHERE parent.Name =~ 'chrome.exe' 
   OR parent.Name =~ 'msedge.exe' 
   OR parent.Name =~ 'firefox.exe'
   AND child.Name =~ 'powershell.exe'
   OR child.Name =~ 'cmd.exe'


**Remediation Script (PowerShell)**

# Ensure PowerShell Script Block Logging is enabled for detection
$registryPath = 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
$name = 'EnableScriptBlockLogging'
$value = 1

if (-not (Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force | Out-Null
    Write-Host "[+] Created ScriptBlock Logging registry path."
} else {
    Write-Host "[*] ScriptBlock Logging registry path exists."
}

$currentValue = (Get-ItemProperty -Path $registryPath -Name $name -ErrorAction SilentlyContinue).$name
if ($currentValue -ne $value) {
    Set-ItemProperty -Path $registryPath -Name $name -Value $value -Type DWord
    Write-Host "[+] Enabled ScriptBlock Logging."
} else {
    Write-Host "[+] ScriptBlock Logging is already enabled."
}

# Hunt Security Event Log for ClickFix indicators (Event ID 4688)
Write-Host "[*] Hunting for ClickFix indicators in Security Log (Last 24h)..."
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue

if ($events) {
    $clickFixHits = $events | Where-Object { 
        $_.Message -match 'ParentProcessName.*\(chrome|msedge|firefox)\.exe' -and 
        $_.Message -match 'NewProcessName.*\(powershell|cmd)\.exe'
    }
    
    if ($clickFixHits) {
        Write-Host "[!] ALERT: Potential ClickFix activity detected!" -ForegroundColor Red
        $clickFixHits | Format-List TimeCreated, Message
    } else {
        Write-Host "[+] No immediate ClickFix process chains found in last 24h."
    }
} else {
    Write-Host "[-] No 4688 events found (Audit Policy might be off or Sysmon not configured)."
}