Weaponized Claude Artifacts and ClickFix Lures: Detecting AI Platform Abuse in Your Environment

---
title: ClickFix-Style Explorer-Spawned PowerShell Download Cradle
id: 3f8a2b71-9c4d-4e6f-a1b2-7d5e9c0f3a84
status: experimental
description: Detects PowerShell spawned by explorer.exe (consistent with Win+R paste execution from ClickFix lures) running download or encoded command patterns. Observed in campaigns abusing AI platform shared content to deliver malware.
references:
  - https://www.bleepingcomputer.com/news/security/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface/
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\powershell_ise.exe'
  selection_cmd:
    CommandLine|contains:
      - ' -enc'
      - ' -e '
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'curl.exe'
      - 'DownloadString'
      - 'Start-BitsTransfer'
      - 'hidden'
  condition: selection_parent and selection_cmd
falsepositives:
  - Rare; legitimate admin pasting encoded commands via Run dialog
level: high
---
title: MSHTA Network Connection to External Host
id: 8b1c4d62-5f3a-4e7b-92c1-6a8d0e4f7b35
status: experimental
description: Detects mshta.exe initiating outbound network connections, a common ClickFix payload launcher used in campaigns delivered via weaponized AI platform content and search poisoning.
references:
  - https://www.bleepingcomputer.com/news/security/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface/
  - https://attack.mitre.org/techniques/T1218/005/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1218.005
  - attack.command_and_control
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\mshta.exe'
  filter_rfc1918:
    DestinationIp|contains:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
      - '127.'
  condition: selection and not filter_rfc1918
falsepositives:
  - Legacy internal HTA applications (should be inventoried and exceptions scoped)
level: high
---
title: Browser-Spawning Script Interpreter After AI Platform Visit
id: 2e7f9a14-3b6c-4d8e-a5f2-9c1b7e0d4a96
status: experimental
description: Detects browser processes spawning cmd, powershell, or mshta — a pattern consistent with ClickFix lures delivered through weaponized Claude Artifacts or malicious shared AI conversations. Browser child processes of this type are abnormal in standard user workflows.
references:
  - https://www.bleepingcomputer.com/news/security/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface/
  - https://attack.mitre.org/techniques/T1204/002/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Browser extensions with native messaging hosts (rare; investigate per-host)
  - Enterprise SSO helpers (scoped by known signer)
level: high

// Hunt: ClickFix-style execution correlated with AI platform browsing
let Lookback = 7d;
let SuspiciousExec =
    DeviceProcessEvents
    | where Timestamp > ago(Lookback)
    | where InitiatingProcessFileName in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe")
       or InitiatingProcessFileName =~ "explorer.exe"
    | where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","cmd.exe","wscript.exe","cscript.exe","rundll32.exe")
    | where ProcessCommandLine has_any ("-enc","FromBase64String","IEX","Invoke-Expression","Invoke-WebRequest","iwr ","DownloadString","Start-BitsTransfer","curl","mshta http")
    | project ExecTime=Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, ReportId;
SuspiciousExec
| join kind=leftouter (
    DeviceNetworkEvents
    | where Timestamp > ago(Lookback)
    | where RemoteUrl has_any ("claude.ai","anthropic.com","chatgpt.com","openai.com","gemini.google.com","copilot.microsoft.com")
    | project BrowseTime=Timestamp, DeviceName, RemoteUrl, InitiatingProcessFileName2=InitiatingProcessFileName
) on DeviceName
| where isempty(RemoteUrl) or BrowseTime between (ExecTime .. ExecTime + 30m)
| project ExecTime, DeviceName, AccountName, FileName, ProcessCommandLine, ParentProcess=InitiatingProcessFileName, RemoteUrl, BrowseTime
| order by ExecTime desc

-- Hunt: ClickFix execution artifacts - RunMRU history and suspicious process lineage
-- Pulls Run dialog history (where victims paste ClickFix commands) and
-- cross-references live/recent processes with suspicious parent-child patterns.

LET runmru = SELECT Key.Name AS UserSID,
       Data.value AS RunCommand,
       Key.Mtime AS LastWrite
FROM read_reg_key(globs='HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Explorer/RunMRU/*')
WHERE RunCommand =~ '(?i)(powershell|mshta|curl|iwr|invoke|base64|http)'

LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(-enc|frombase64string|invoke-expression|downloadstring|mshta http|iwr )'
  AND Name =~ '(?i)(powershell|pwsh|mshta|cmd)'

SELECT * FROM runmru
UNION ALL
SELECT UserSID=NULL, RunCommand=format(format='%v | %v', args=[Name, CommandLine]), LastWrite=CreateTime FROM procs

# ClickFix / AI-Platform-Abuse Hardening & Triage Script
# Run as Administrator. Test in a pilot OU before broad deployment.

# --- 1. Block mshta outbound execution via Windows Defender Attack Surface Reduction ---
# ASR rule: Block execution of potentially obfuscated scripts
Add-MpPreference -AttackSurfaceReductionRules_Ids 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC `
  -AttackSurfaceReductionRules_Actions Enabled
# ASR rule: Block process creations from Office/abuse of script interpreters
Add-MpPreference -AttackSurfaceReductionRules_Ids D3E037E1-3EB8-44C8-A917-57927947596D `
  -AttackSurfaceReductionRules_Actions Enabled

# --- 2. Restrict PowerShell for standard users via AppLocker policy note ---
# Recommended: deploy WDAC/AppLocker policy constraining powershell.exe to
# admin-only contexts. Flagging current execution policy state for review:
Get-ExecutionPolicy -List | Format-Table Scope, ExecutionPolicy

# --- 3. Triage: dump RunMRU (ClickFix victims execute via Win+R) ---
$runMruPath = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
if (Test-Path $runMruPath) {
  Get-ItemProperty $runMruPath | Select-Object * |
    Out-File "$env:TEMP\runmru_triage_$(Get-Date -Format yyyyMMdd_HHmmss).txt"
  Write-Output "RunMRU exported to $env:TEMP - review for pasted commands referencing http, powershell, mshta, or base64."
}

# --- 4. Audit: recent PowerShell with suspicious command lines in last 24h ---
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; StartTime=(Get-Date).AddDays(-1)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'FromBase64String|Invoke-Expression|DownloadString|mshta|http' } |
  Select-Object TimeCreated, Id, Message -First 50 |
  Format-List

# --- 5. Verify ASR rule states applied ---
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids