ClickFix Social Engineering Campaign: Fake Claude Installer Detection and Defense

---
title: Potential ClickFix Activity - PowerShell Web Request
id: 8a4b2c1d-9e3f-4a5b-bc6d-1e2f3a4b5c6d
status: experimental
description: Detects PowerShell scripts attempting to download content from the internet using common cmdlets, a hallmark of ClickFix campaigns where users copy/paste malicious commands.
references:
  - https://www.rapid7.com/blog/post/ve-clickfix-phishing-campaign-fake-claude-installer
author: Security Arsenal
date: 2025/03/04
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'IWR'
      - 'Invoke-RestMethod'
      - 'IRM'
      - 'DownloadString'
  filter_legit_admin:
    ParentImage|contains:
      - '\System32\'
      - '\Program Files\'
      - '\Program Files (x86)\'
  condition: selection and not filter_legit_admin
falsepositives:
  - Administrative scripts manually run by IT staff
level: high
---
title: PowerShell Execution Policy Bypass
id: 9b5c3d2e-0f4a-5b6c-7d8e-9f0a1b2c3d4e
status: experimental
description: Detects attempts to bypass PowerShell execution policies, frequently seen in social engineering campaigns like ClickFix to run unsigned or malicious scripts.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2025/03/04
tags:
  - attack.defense_evasion
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'ExecutionPolicy Bypass'
      - '-ep bypass'
      - '-Exec Bypass'
falsepositives:
  - Legitimate legacy applications requiring bypass
level: medium

// Hunt for ClickFix indicators: PowerShell processes invoking web requests
// Often spawned by users manually pasting commands into Console Window Host
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("Invoke-WebRequest", "DownloadString", "IEX", "Invoke-RestMethod")
| where ProcessCommandLine has_any ("http://", "https://")
| extend IsBase64 = iff(ProcessCommandLine matches regex "[A-Za-z0-9+/]{50,}={0,2}", true, false)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, IsBase64
| order by Timestamp desc

-- Hunt for PowerShell processes with web-related command line arguments typical of ClickFix
-- Look for manual invocation patterns (high entropy or specific keywords)
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ "powershell.exe"
  AND (
    CommandLine =~ "Invoke-WebRequest" OR
    CommandLine =~ "DownloadString" OR
    CommandLine =~ "IEX" OR
    CommandLine =~ "Invoke-RestMethod" OR
    CommandLine =~ "http:"
  )

# Incident Response Script: Hunt for ClickFix artifacts in User Temp directories
# ClickFix payloads often download to the user's temp folder with obfuscated names

$DateThreshold = (Get-Date).AddDays(-7)
$UserProfiles = Get-ChildItem -Path "C:\Users" -Directory -ErrorAction SilentlyContinue
$SuspiciousExtensions = @(".exe", ".bat", ".cmd", ".ps1", ".js", ".vbs", ".dll")

Write-Host "Scanning for suspicious files created in the last 7 days..." -ForegroundColor Cyan

foreach ($Profile in $UserProfiles) {
    # Exclude system profiles
    if ($Profile.Name -in @("Public", "Default", "Default User")) { continue }

    $TempPath = Join-Path -Path $Profile.FullName -ChildPath "AppData\Local\Temp"
    if (Test-Path $TempPath) {
        Get-ChildItem -Path $TempPath -Recurse -Include $SuspiciousExtensions -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt $DateThreshold -and $_.Length -gt 0 } |
        Select-Object FullName, LastWriteTime, Length, @{Name="Owner";Expression={(Get-Acl $_.FullName).Owner}}
    }
}