Defending Against ClickFix and AI-Driven Threats: ESET 2026 Report Analysis

---
title: Potential ClickFix Activity via Browser Spawned Shell
id: 8a2b4c9d-1e3f-4a5b-8c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious process execution patterns associated with ClickFix attacks, where a browser process spawns mshta, powershell, or cmd to download payloads.
references:
  - https://www.welivesecurity.com/2026/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.initial_access
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\opera.exe'
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\cmd.exe'
    CommandLine|contains:
      - 'downloadstring'
      - 'iex'
      - 'copyitem'
  condition: selection
falsepositives:
  - Legitimate troubleshooting by IT staff (rare)
level: high
---
title: Security Software Directory Modification via Untrusted Process
id: 9b3c5d0e-2f4a-5b6c-9d7e-0f1a2b3c4d5e
status: experimental
description: Detects attempts to encrypt or modify files within known security software directories by processes not signed by the vendor, indicative of defense evasion.
references:
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/05/15
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: file_change
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '\ProgramData\Microsoft\Windows Defender\'
      - '\ProgramData\CrowdStrike\'
      - '\ProgramData\SentinelOne\'
      - '\Program Files (x86)\Symantec\'
    Image|notcontains:
      - '\Microsoft\'
      - '\CrowdStrike\'
      - '\SentinelOne\'
      - '\Symantec\'
  condition: selection
falsepositives:
  - Security software updating itself (should be excluded via Image signature)
level: critical

// Hunt for ClickFix Attack Chains
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ('chrome.exe', 'msedge.exe', 'firefox.exe')
| where FileName in~ ('mshta.exe', 'powershell.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe')
| where ProcessCommandLine has_any ('download', 'iex', 'copy', 'invoke-expression', 'FromBase64String')
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

-- Hunt for suspicious modifications in Security Software directories
SELECT FullPath, Size, Modetime, Mode.String
FROM glob(globs='/*ProgramData/*/Platform/**', accessor='file')
WHERE Modetime > now() - 24h
   AND NOT Mode.String =~ '^d'
   AND FullPath =~ '(Microsoft|CrowdStrike|SentinelOne|Symantec)'

-- Supplement with process creation for browser spawned shells
SELECT Pid, Name, CommandLine, Exe, Parent.Pid, Parent.Name
FROM pslist()
WHERE Parent.Name =~ 'chrome.exe'
   OR Parent.Name =~ 'msedge.exe'
   OR Parent.Name =~ 'firefox.exe'
WHERE Name =~ 'powershell.exe'
   OR Name =~ 'mshta.exe'
   OR Name =~ 'cmd.exe'

# Check Windows Defender Status and Integrity
Function Check-DefenderIntegrity {
    Write-Host "[+] Checking Windows Defender Service Status..." -ForegroundColor Cyan
    
    $defenderService = Get-Service -Name WinDefend -ErrorAction SilentlyContinue
    if ($defenderService.Status -ne 'Running') {
        Write-Host "[!] ALERT: Windows Defender Service is not running. Status: $($defenderService.Status)" -ForegroundColor Red
        Start-Service WinDefend -ErrorAction SilentlyContinue
    } else {
        Write-Host "[+] Windows Defender Service is Running." -ForegroundColor Green
    }

    # Check Tamper Protection Status (Registry)
    $tamperPath = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features"
    $tamperStatus = (Get-ItemProperty -Path $tamperPath -ErrorAction SilentlyContinue).TamperProtection
    
    if ($tamperStatus -ne 5) { # 5 usually means ON, 0 OFF, 1 Limited
        Write-Host "[!] WARNING: Tamper Protection may be disabled or limited. Value: $tamperStatus" -ForegroundColor Yellow
    } else {
        Write-Host "[+] Tamper Protection is Enabled." -ForegroundColor Green
    }
}

# Scan for recent file modifications in security directories (Encryption-based attack indicators)
Function Find-SuspiciousSecurityModifications {
    Write-Host "[+] Scanning for recent modifications in Security Directories (Last 24h)..." -ForegroundColor Cyan
    
    $paths = @("$env:ProgramData\Microsoft\Windows Defender", "$env:ProgramData\CrowdStrike", "$env:ProgramData\SentinelOne")
    $cutoffTime = (Get-Date).AddHours(-24)

    foreach ($path in $paths) {
        if (Test-Path $path) {
            Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | 
            Where-Object { $_.LastWriteTime -gt $cutoffTime } | 
            Select-Object FullName, LastWriteTime, Length | 
            Format-Table -AutoSize
        }
    }
}

Check-DefenderIntegrity
Find-SuspiciousSecurityModifications
Write-Host "[+] Audit Complete." -ForegroundColor Cyan