ClickFix Ecosystem: Defending Against the MaaS 'Fix-It' Scam and EDR Evasion

---
title: ClickFix - Web Browser Spawning PowerShell or CMD
id: 8a2b3c4d-1e2f-4a5b-8c7d-9e0f1a2b3c4d
status: experimental
description: Detects web browsers spawning shell processes like PowerShell or CMD, a common indicator of copy-paste attacks like ClickFix.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.initial_access
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_script:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\mshta.exe'
  condition: selection and selection_script
falsepositives:
  - Legitimate web-based SSH clients or terminal emulators (rare in standard enterprise images)
  - Developer tools launching shells from browser-based IDEs
level: high
---
title: ClickFix - PowerShell Suspicious Download Cradle Patterns
id: 9b3c4d5e-2f3a-5b6c-9d8e-0f1a2b3c4d5e
status: experimental
description: Detects PowerShell commands often found in ClickFix campaigns involving obfuscation and remote download cradles.
references:
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\powershell.exe'
  selection_cli:
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
      - 'Invoke-Expression'
      - 'FromBase64String'
  filter_legit_admin:
    ParentImage|contains:
      - '\System32\'
      - '\SysWOW64\'
  condition: selection_img and selection_cli and not filter_legit_admin
falsepositives:
  - System administration scripts
  - Legitimate software installers
level: medium

// Hunt for Browser Spawning Shell with Suspicious Arguments
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe")
| where FileName in ("powershell.exe", "cmd.exe", "pwsh.exe", "mshta.exe")
| extend ProcessCommandLine = tostring(ProcessCommandLine)
| where ProcessCommandLine matches regex @"(?:-c|-command|/c).*" // Looks for arguments implying code execution
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| order by Timestamp desc

-- Hunt for suspicious child processes of web browsers
SELECT Pid, Name, CommandLine, Exe, Username, StartTime, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ '(chrome|msedge|firefox|brave).exe'
  AND Name =~ '(powershell|cmd|pwsh|mshta).exe'
  -- Filter for short executions or specific command patterns if needed
  AND CommandLine =~ '(DownloadString|IEX|Invoke-Expression)'

<#
.SYNOPSIS
    Remediation script for ClickFix attack vectors.
.DESCRIPTION
    Restricts browser rights to spawn shells and enables ASR rules to block obfuscated script execution.
#>

# Ensure running as Administrator
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
    Write-Error "Please run this script as Administrator."
    exit
}

Write-Output "[+] Starting ClickFix Hardening Process..."

# 1. Enforce Attack Surface Reduction (ASR) Rules
# ASR Rule: Block execution of potentially obfuscated scripts (GUID: 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC)
# ASR Rule: Block Win32 API calls from Office macro apps (GUID: 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B) - Often used as vector
$asrRules = @(
    "5BEB7EFE-FD9A-4556-801D-275E5FFC04CC", # Block Obfuscated Scripts
    "D4F940AB-401B-4EFC-AADC-AD5F3C50688A"  # Block all Office apps from creating child processes
)

foreach ($rule in $asrRules) {
    try {
        $currentStatus = (Get-MpPreference).AttackSurfaceReductionRules_Actions | Where-Object { $_.Split(':')[0] -eq $rule }
        if ($currentStatus -and $currentStatus.Split(':')[1] -eq "1") {
            Write-Output "[+] ASR Rule $rule is already enabled."
        } else {
            Add-MpPreference -AttackSurfaceReductionRules_Ids $rule -AttackSurfaceReductionRules_Actions Enabled
            Write-Output "[+] Enabled ASR Rule: $rule"
        }
    } catch {
        Write-Error "[-] Failed to set ASR Rule $rule: $_"
    }
}

# 2. AppLocker / Software Restriction Policy (Basic Hardening)
# Creating a rule to prevent Chrome/Edge from launching CMD/PowerShell directly.
# Note: This requires AppLocker service to be running and configured.
Write-Output "[*] Note: Consider implementing AppLocker policies to explicitly deny browsers from spawning shells."
Write-Output "[*] Example Path: Computer Configuration -> Windows Settings -> Security Settings -> Application Control Policies -> AppLocker."

Write-Output "[+] Remediation Complete. Please reboot systems for ASR rules to take full effect."