Cyber Insurance Exclusions Rise: Defending Against Uncovered ClickFix Attacks

---
title: ClickFix Attack Pattern - Browser Spawning PowerShell
id: 8a2b4c1d-9e3f-4a5b-8c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential ClickFix activity where a browser process spawns PowerShell. This is highly suspicious behavior indicative of social engineering tricking the user into running "fix" commands.
references:
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
  - attack.initial_access
  - attack.t1566
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  condition: selection
falsepositives:
  - Legitimate developer debugging (rare)
  - Browser-based administrative tools
level: high
---
title: ClickFix - Browser Spawning Windows Script Host
date: 2026/04/06
id: 9c3d5e2f-0a4b-5c6d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects browsers spawning wscript.exe or cscript.exe, a common method to execute payloads in ClickFix scenarios.
references:
  - https://attack.mitre.org/techniques/T1059.005/
author: Security Arsenal
tags:
  - attack.execution
  - attack.t1059.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection
falsepositives:
  - Legacy web applications
level: high
---
title: Suspicious Clipboard Execution via Run Dialog
id: 0d4e6f3a-1b5c-6d7e-0f1a-2b3c4d5e6f7a
status: experimental
description: Detects execution of commands that match known ClickFix patterns often copied to clipboards, such as specific encoded PowerShell commands.
references:
  - https://attack.mitre.org/techniques/T1059.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'IEX'
      - 'Invoke-Expression'
      - 'FromBase64String'
  filter_legit_admin:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\services.exe'
  condition: selection and not filter_legit_admin
falsepositives:
  - Administrative scripts run via Explorer
level: medium

DeviceProcessEvents
| where Timestamp > ago(1h)
| where InitiatingProcessFileName in~ ('chrome.exe', 'msedge.exe', 'firefox.exe', 'brave.exe')
| where FileName in~ ('powershell.exe', 'pwsh.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe')
| extend AccountName = tostring(split(AccountName, '\')[1]), AccountDomain = tostring(split(AccountName, '\')[0])
| project Timestamp, DeviceName, AccountName, AccountDomain, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc

-- Hunt for ClickFix behavior: Browser spawning a shell
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ 'chrome.exe'
   OR Parent.Name =~ 'msedge.exe'
   OR Parent.Name =~ 'firefox.exe'
WHERE Name =~ 'powershell.exe'
   OR Name =~ 'cmd.exe'
   OR Name =~ 'wscript.exe'
   OR Name =~ 'cscript.exe'

# Remediation Script: Harden Against ClickFix Execution Chains
# Requires Administrator Privileges

Write-Host "[+] Configuring ClickFix Defenses..." -ForegroundColor Cyan

# 1. Enable Attack Surface Reduction (ASR) Rules relevant to ClickFix
# Rule ID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A (Block Office apps from creating child processes)
# Rule ID: 3B576869-A4EC-4529-8536-B80A7769E899 (Block Win32 API calls from Office macro apps)
# Rule ID: 92E97FA1-2EDF-44AC-B9BE-BA751FF7F4D4 (Block Adobe Reader from creating child processes)
# Note: While ClickFix uses browsers, enabling strict child process auditing is the goal.
# We focus on blocking Webshell creation and abusing script engines.

$asrRules = @(
    "BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550", # Block executable content from email and web
    "D3E037E1-3EB8-44C8-A917-57927947596D"  # Block JavaScript or VBScript from launching downloaded executable content
)

foreach ($rule in $asrRules) {
    try {
        Set-MpPreference -AttackSurfaceReductionRules_Ids $rule -AttackSurfaceReductionRules_Actions Enabled
        Write-Host "[+] Enabled ASR Rule: $rule" -ForegroundColor Green
    } catch {
        Write-Host "[-] Failed to enable ASR Rule: $rule" -ForegroundColor Red
    }
}

# 2. Enable PowerShell Script Block Logging and Module Logging
# Essential for visibility into the obfuscated scripts ClickFix tries to run.
$registryPath = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
if (-not (Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force | Out-Null
}
Set-ItemProperty -Path $registryPath -Name "EnableScriptBlockLogging" -Value 1 -Force
Write-Host "[+] Enabled PowerShell Script Block Logging." -ForegroundColor Green

$moduleLogPath = "HKLM:\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging"
if (-not (Test-Path $moduleLogPath)) {
    New-Item -Path $moduleLogPath -Force | Out-Null
}
Set-ItemProperty -Path $moduleLogPath -Name "EnableModuleLogging" -Value 1 -Force
Write-Host "[+] Enabled PowerShell Module Logging." -ForegroundColor Green

Write-Host "[+] Remediation complete. Reboot recommended for full policy enforcement." -ForegroundColor Cyan