TerminalFix ClickFix Campaign: Defending Against Fake CAPTCHA Lures, DLL Sideloading, and Reverse Tunnel Persistence

---
title: ClickFix-Style Clipboard Command Execution via Run Dialog
description: Detects long, encoded, or download-cradle-style commands executed under explorer.exe, consistent with ClickFix fake CAPTCHA lures that instruct users to paste commands into the Run dialog (Win+R). Microsoft attributes this initial access pattern to the TerminalFix campaign.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
  - https://attack.mitre.org/techniques/T1204/004/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/08/28
status: experimental
id: 3f8c1a94-2b7d-4e61-9c05-7a2d4f8b1e36
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_flags:
    CommandLine|contains:
      - ' -enc'
      - ' -e '
      - 'FromBase64String'
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'iwr '
      - 'irm '
      - 'iex'
      - 'http://'
      - 'https://'
      - 'Start-Process'
  condition: selection_parent and selection_child and selection_flags
falsepositives:
  - Administrators running one-liners via the Run dialog
  - Software deployment tooling that stages scripts interactively
level: high
---
title: DLL Sideloading - Signed Binary Loading Unsigned DLL from User-Writable Path
description: Detects image load events where a DLL is loaded from a user-writable directory (AppData, Temp, Downloads, Public) by a process running outside that same directory, a pattern consistent with TerminalFix DLL sideloading. Tune known-good enterprise sideloading cases before enforcement.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
  - https://attack.mitre.org/techniques/T1574/002/
author: Security Arsenal
date: 2026/08/28
status: experimental
id: 9d4e2b17-6c38-4f52-a891-0e6c3d7b5a24
tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.t1574.002
logsource:
  category: image_load
  product: windows
detection:
  selection_path:
    ImageLoaded|contains:
      - '\AppData\Roaming\'
      - '\AppData\Local\Temp\'
      - '\AppData\Local\'
      - '\Downloads\'
      - '\Users\Public\'
      - '\ProgramData\'
  filter_system_image:
    Image|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  filter_microsoft_signed_dirs:
    ImageLoaded|contains:
      - '\AppData\Local\Microsoft\'
      - '\AppData\Local\Programs\Microsoft\'
  condition: selection_path and not filter_system_image and not filter_microsoft_signed_dirs
falsepositives:
  - Electron-based apps (Teams, Slack, VS Code) that load modules from AppData
  - Legitimate per-user installed software
level: medium
---
title: Reverse SSH Tunnel or Tunneling Tool Execution
description: Detects command lines indicative of reverse tunnel establishment (ssh -R / -N flags, plink, or common tunneling utilities) on Windows endpoints, consistent with the reverse tunnel C2 stage of the TerminalFix campaign.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
  - https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
date: 2026/08/28
status: experimental
id: 5b71c3e8-1a46-4d29-bf73-2c8e9a4d6f10
tags:
  - attack.command_and_control
  - attack.t1572
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_ssh_reverse:
    Image|endswith:
      - '\ssh.exe'
      - '\plink.exe'
    CommandLine|contains:
      - ' -R '
      - ' -N '
  selection_tunnel_tools:
    Image|endswith:
      - '\ngrok.exe'
      - '\cloudflared.exe'
      - '\chisel.exe'
      - '\frpc.exe'
      - '\ligolo.exe'
      - '\socat.exe'
      - '\iodine.exe'
      - '\dnscat2.exe'
  condition: 1 of selection_*
falsepositives:
  - Developers and DevOps staff using SSH remote port forwarding
  - Cloudflare Tunnel or ngrok deployed for legitimate internal tooling
level: high

// Stage 1: ClickFix-style execution - script interpreters spawned by explorer with download/encoded flags
let lookback = 7d;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "curl.exe", "cmd.exe", "wscript.exe")
| where ProcessCommandLine has_any ("-enc", "FromBase64String", "Invoke-WebRequest", "Invoke-RestMethod",
    "iwr ", "irm ", "iex", "https://", "http://")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| sort by Timestamp desc;

// Stage 2: DLL written to user-writable paths shortly before signed process execution
let lookback2 = 7d;
DeviceFileEvents
| where Timestamp > ago(lookback2)
| where FileName endswith ".dll"
| where FolderPath has_any ("\\AppData\\Roaming\\", "\\AppData\\Local\\Temp\\", "\\Downloads\\", "\\Users\\Public\\")
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "curl.exe", "mshta.exe", "cmd.exe", "rundll32.exe")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessCommandLine
| sort by Timestamp desc;

// Stage 3: Reverse tunnel indicators - ssh with -R flag or tunneling tools, plus their network connections
let lookback3 = 7d;
let TunnelProcs = DeviceProcessEvents
| where Timestamp > ago(lookback3)
| where (FileName in~ ("ssh.exe", "plink.exe") and ProcessCommandLine has_any (" -R ", " -N ", "-R", "-N"))
     or FileName in~ ("ngrok.exe", "cloudflared.exe", "chisel.exe", "frpc.exe", "socat.exe", "ligolo.exe")
| summarize by DeviceId, DeviceName, ProcessId, FileName, ProcessCommandLine, AccountName, Timestamp;
DeviceNetworkEvents
| where Timestamp > ago(lookback3)
| join kind=inner TunnelProcs on DeviceId, ProcessId
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
    RemoteIP, RemotePort, RemoteUrl, ActionType
| sort by Timestamp desc;

-- TerminalFix hunt: sideloaded DLL artifacts and live reverse-tunnel processes
-- 1. Recently created DLLs in user-writable directories (last 14 days)
LET dll_drops = SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Users/*/AppData/Roaming/**/*.dll',
  'C:/Users/*/AppData/Local/Temp/**/*.dll',
  'C:/Users/*/Downloads/**/*.dll',
  'C:/Users/Public/**/*.dll'
])
WHERE Mtime > now() - 1209600
  AND FullPath !~ 'Microsoft'
ORDER BY Mtime DESC

-- 2. Live processes with reverse tunnel or tunneling tool indicators
LET tunnel_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ ' -R | -N |ngrok|cloudflared|chisel|frpc|socat|ligolo'
   OR Name =~ 'ssh|plink|ngrok|cloudflared|chisel|frpc'

SELECT * FROM dll_drops
UNION ALL
SELECT * FROM tunnel_procs

# TerminalFix endpoint audit - run as Administrator
# 1. Check RunMRU for pasted ClickFix-style commands (per-user evidence of Win+R execution)
$users = Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList' |
  Where-Object { $_.GetValue('ProfileImagePath') -like 'C:\Users\*' }
foreach ($u in $users) {
  $sid = $u.PSChildName
  $runMRU = "Registry::HKEY_USERS\$sid\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU"
  if (Test-Path $runMRU) {
    $vals = Get-ItemProperty $runMRU
    $vals.PSObject.Properties | Where-Object { $_.Name -match '^[a-z]$' } | ForEach-Object {
      if ($_.Value -match 'powershell|mshta|curl|iex|iwr|http| -enc') {
        Write-Host "[ALERT] Suspicious RunMRU entry for SID $sid : $($_.Value)" -ForegroundColor Red
      }
    }
  }
}

# 2. Scan for DLLs in user-writable paths modified in the last 14 days
$cutoff = (Get-Date).AddDays(-14)
$paths = @("$env:SystemDrive\Users\*\AppData\Roaming", "$env:SystemDrive\Users\*\Downloads", "$env:SystemDrive\Users\Public")
foreach ($p in $paths) {
  Get-ChildItem $p -Recurse -Filter *.dll -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff } |
    ForEach-Object {
      $sig = Get-AuthenticodeSignature $_.FullName
      if ($sig.Status -ne 'Valid') {
        Write-Host "[ALERT] Unsigned/invalid DLL recently written: $($_.FullName)" -ForegroundColor Red
      }
    }
}

# 3. Detect tunneling tools present on disk
$tunnelTools = @('ngrok.exe','cloudflared.exe','chisel.exe','frpc.exe','ligolo.exe','socat.exe')
foreach ($tool in $tunnelTools) {
  $found = Get-ChildItem "$env:SystemDrive\Users" -Recurse -Filter $tool -ErrorAction SilentlyContinue
  if ($found) { Write-Host "[ALERT] Tunneling tool found: $($found.FullName)" -ForegroundColor Red }
}

# 4. Check for live SSH reverse tunnel processes
Get-CimInstance Win32_Process -Filter "Name='ssh.exe' OR Name='plink.exe'" |
  Where-Object { $_.CommandLine -match ' -R | -N ' } |
  ForEach-Object { Write-Host "[ALERT] Reverse tunnel process: PID $($_.ProcessId) - $($_.CommandLine)" -ForegroundColor Red }

# 5. Audit outbound connections on common tunneling ports from non-standard processes
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemotePort -in 22,443,4443,8080 -and $_.OwningProcess -gt 4 } |
  ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.Path -notlike 'C:\Windows\*' -and $proc.Path -notlike 'C:\Program Files*') {
      Write-Host "[REVIEW] Outbound $($_.RemoteAddress):$($_.RemotePort) from $($proc.Path)" -ForegroundColor Yellow
    }
  }
Write-Host "Audit complete. Investigate any ALERT entries before REVIEW items." -ForegroundColor Cyan