← All Chokepoints HIGH

ClickFix Techniques

Initial Access T1204.004 Detection difficulty: LOW Prevalence: HIGH

Social engineering attacks that trick users into copying and executing malicious commands via clipboard manipulation. A malicious site instructs the user to copy a command (often disguised as a CAPTCHA fix, software update, or troubleshooting step) and paste it into a Run dialog, terminal, or browser address bar. The clipboard is the pivot — the scripting interpreter execution is the chokepoint. As of late 2024 through early 2025, nation-state actors including APT28 (Russia), MuddyWater (Iran), and Kimsuky (North Korea) adopted ClickFix in targeted espionage campaigns, elevating it from commodity crimeware to an advanced persistent threat vector.

By @iimp0ster · Updated 2026-03-10 · View source YAML

Prerequisites (Environmental)

  • ✓ Scripting interpreter available on target system (powershell.exe, cmd.exe, mshta.exe, bash)
  • ✓ Modern browser with Clipboard API enabled (default on all mainstream browsers)

Variations

Tools and methods that exploit this chokepoint — the list grows; the chokepoint doesn't change:

ClickFix Active
2024-Q1

Original variant; fake CAPTCHA or browser-fix prompts user to paste PowerShell into Run dialog

Source →
FileFix Active
2025-Q2

Shifts attack surface to Windows File Explorer address bar; weaponized within two weeks of public disclosure

Source →
TerminalFix Active
2024-Q4

Mimics terminal windows; targets IT-savvy users with same execution path

DownloadFix Active
2024-Q4

Simplified delivery; user pastes a download-and-execute one-liner

JackFix / GlitchFix / ConsentFix Active
2025

Family of variants using clipboard-paste-execute with different social engineering pretexts

Source →
WebDAV ClickFix Active
2025-Q1

Victims paste UNC paths into Run dialog; mshta.exe executes JScript from attacker WebDAV share

Source →
InstallFix Active
2026-Q1

Clones AI/developer tool install pages; distributed via Google Ads malvertising

Source →
Windows Terminal ClickFix Active
2026-Q1

Lure uses Win+X→I shortcut; hex/XOR-encoded PowerShell in wt.exe bypasses Run-dialog detections

Source →
DNS-based ClickFix Active
2026-Q1

Payload embedded in DNS Name field response; nslookup retrieval evades URL-based web filtering

Source →

Detection Strategy

Build detections iteratively. Start broad to understand your baseline, then tighten to production-ready.

Goal: Identify any scripting interpreter making outbound external connections

Log Sources

  • Windows Security Event Log (Process Creation / Event ID 4688)
  • Sysmon Event ID 3 (Network Connection)
  • DNS query logs

FP Rate: High

Use Case: Threat research baseline; understanding scripting interpreter network behavior

Detection Logic

Process: powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe Network: External destination (non-RFC1918) initiated by that process Parent: ANY
Sigma Rule — Research Level
View on GitHub Download 
title: Scripting Interpreter Outbound Network Connection
id: c4f8a2b1-3e7d-4a5c-8b9f-2d1e6f0a7c3b
status: experimental
description: >
  Detects scripting interpreters (powershell.exe, cmd.exe, wscript.exe, etc.) making
  outbound connections to external (non-RFC1918) addresses. Broad research-level rule
  for the ClickFix chokepoint. Establishes baseline visibility into scripting interpreter
  network behavior. High false positive rate expected — use for research and baselining only.
references:
  - https://huntress.com/blog/dont-sweat-clickfix-techniques
  - https://mhaggis.github.io/ClickGrab/
  - https://attack.mitre.org/techniques/T1204/001/
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.initial_access
  - attack.t1204.001
  - attack.t1204.003
  - detection.maturity.research
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  filter_private_ranges:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
      - '127.'
      - '::1'
      - 'fe80:'
  filter_loopback:
    DestinationIp: '0.0.0.0'
  condition: selection and not 1 of filter_*
falsepositives:
  - Legitimate administrative scripts making web requests (SCCM, Ansible, etc.)
  - Software update mechanisms (Windows Update, application updaters)
  - Monitoring agents and IT management tooling
  - Developer tooling (npm, pip, curl wrappers, build scripts)
  - Security scanning tools
level: low

Goal: Scripting interpreter spawned by browser, explorer, or Windows Terminal with external network connection

Log Sources

  • Sysmon Event ID 1 (Process Creation)
  • Sysmon Event ID 3 (Network Connection)
  • DNS query logs

FP Rate: Medium

Use Case: Proactive hunting for user-initiated clipboard execution; campaign detection

Detection Logic

Process: powershell.exe OR cmd.exe OR wscript.exe OR cscript.exe OR mshta.exe ParentProcess: explorer.exe OR wt.exe OR WindowsTerminal.exe OR chrome.exe OR firefox.exe OR msedge.exe OR iexplore.exe OR brave.exe OR opera.exe Network: External connection within 60 seconds of process start Additional pivot: nslookup.exe spawned by cmd.exe with a non-RFC1918 IP as DNS server argument (KongTuke DNS-staging variant)
Sigma Rule — Hunt Level
View on GitHub Download 
title: Browser or Explorer Spawning Script Interpreter
id: a7b3c9d2-5e8f-4a1b-9c6d-3f2e8b0a4d7e
status: experimental
description: >
  Detects scripting interpreters (PowerShell, cmd, wscript, mshta) spawned directly by
  web browsers, Windows Explorer, or Windows Terminal. This is a hunt-level rule
  targeting the ClickFix chokepoint, where users are socially engineered to paste and
  execute malicious commands. The Windows Terminal path (wt.exe parent) covers the
  March 2026 variant disclosed by Microsoft Defender Experts (Lumma Stealer delivery
  via Win+X→I terminal lure). Browsers and Explorer should rarely directly spawn
  scripting interpreters in normal enterprise operations.
references:
  - https://huntress.com/blog/dont-sweat-clickfix-techniques
  - https://staging.huntress.com/blog/dont-sweat-clickfix-techniques
  - https://mhaggis.github.io/ClickGrab/
  - https://www.aitmfeed.com/blog/blog-1/tracking-clickfix-infrastructure-4
  - https://attack.mitre.org/techniques/T1204/001/
  - https://thehackernews.com/2026/03/microsoft-reveals-clickfix-campaign.html
  - https://www.bleepingcomputer.com/news/security/new-clickfix-attack-abuses-nslookup-to-retrieve-powershell-payload-via-dns/
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.initial_access
  - attack.t1204.001
  - attack.t1204.003
  - detection.maturity.hunt
logsource:
  category: process_creation
  product: windows
detection:
  selection_interpreter:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_parent_browser:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
      - '\opera.exe'
      - '\brave.exe'
      - '\vivaldi.exe'
      - '\waterfox.exe'
  selection_parent_explorer:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\wt.exe'
      - '\WindowsTerminal.exe'
  filter_known_legit:
    # Browser-launched shell integrations for file associations (rare but legitimate)
    CommandLine|contains:
      - 'IEShims.dll'
      - 'ShellExecute'
  condition: selection_interpreter and (selection_parent_browser or selection_parent_explorer) and not filter_known_legit
falsepositives:
  - Browser extensions that invoke system shell for file processing (rare)
  - Shell integrations for file associations opened via browser download
  - IT tooling launched from Windows Explorer (e.g., admin scripts opened by double-click)
  - Some enterprise software launchers that spawn from explorer.exe
level: medium

Goal: Browser-spawned interpreter with encoded command and outbound connection to low-reputation destination

Log Sources

  • Sysmon Event ID 1 (Process Creation)
  • Sysmon Event ID 3 (Network Connection)
  • Sysmon Event ID 22 (DNS Query)
  • Parent process chain analysis

FP Rate: Low

Use Case: Automated SOC alerting; immediate IR response trigger

Detection Logic

Process: powershell.exe OR cmd.exe ParentProcess: [browser] OR explorer.exe CommandLine: Contains encoded command OR obfuscation pattern
  (-enc, -EncodedCommand, FromBase64String, IEX, Invoke-Expression)
Network: External connection within 30 seconds UserContext: Interactive logon session (LogonType 2 or 10)
Sigma Rule — Analyst Level
View on GitHub Download 
title: Browser-Spawned Script with Encoded Command — ClickFix/Clipboard Attack
id: f1e2d3c4-b5a6-4789-a0b1-c2d3e4f5a6b7
status: experimental
description: >
  High-fidelity detection for ClickFix and similar clipboard-based social engineering
  attacks. Detects scripting interpreters with encoded or obfuscated command lines
  spawned by browsers or Windows Explorer. This pattern is strongly indicative of a
  user pasting and executing a malicious command copied from a threat actor-controlled
  webpage. Minimal false positives expected in most enterprise environments.
references:
  - https://huntress.com/blog/dont-sweat-clickfix-techniques
  - https://staging.huntress.com/blog/dont-sweat-clickfix-techniques
  - https://mhaggis.github.io/ClickGrab/
  - https://www.aitmfeed.com/blog/blog-1/tracking-clickfix-infrastructure-4
  - https://attack.mitre.org/techniques/T1204/001/
  - https://attack.mitre.org/techniques/T1204/003/
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.initial_access
  - attack.t1204.001
  - attack.t1204.003
  - attack.defense_evasion
  - attack.t1027
  - detection.maturity.analyst
logsource:
  category: process_creation
  product: windows
detection:
  selection_interpreter:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\mshta.exe'
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
      - '\opera.exe'
      - '\brave.exe'
      - '\vivaldi.exe'
      - '\explorer.exe'
  selection_encoded:
    CommandLine|contains:
      # PowerShell encoded command flags
      - ' -enc '
      - ' -EncodedCommand '
      - ' -ec '
      # Base64 decode patterns
      - 'FromBase64String'
      - 'Convert]::FromBase64'
      # Execution patterns
      - 'IEX ('
      - 'IEX('
      - 'Invoke-Expression'
      - 'iex('
      # Download-and-execute patterns
      - 'DownloadString'
      - 'DownloadFile'
      - 'WebClient'
      - 'Net.WebClient'
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'curl '
      # mshta http invocation
      - 'mshta http'
      - 'mshta vbscript'
      # cmd piping to powershell
      - '/c powershell'
      - '/c start'
  filter_legit_software:
    # Known-good software that uses encoded commands during legitimate operation
    # Tune this list for your environment
    ParentCommandLine|contains:
      - 'Teams.exe'
      - 'OneDrive.exe'
  condition: selection_interpreter and selection_parent and selection_encoded and not filter_legit_software
falsepositives:
  - Legitimate software deployment tools that encode commands (rare when browser is parent)
  - Custom IT automation scripts that use encoded commands and are user-initiated
  - Developers using PowerShell with encoding from browser-launched terminals
level: high

Early Detection Layers

Detect before the user pastes or executes — earlier in the kill chain than the Sysmon-based rules above, using different data sources.

Pre-Execution — ETW Clipboard Write

Goal: Browser process writing scripting keywords to the Windows clipboard via ETW (Microsoft-Windows-Win32k SetClipboardData). Fires before the user pastes. Clipboard seeding is an inescapable prerequisite for all ClickFix variants.

Log Sources

  • ETW Microsoft-Windows-Win32k (GUID: 8c416c79-d49b-4f01-a467-e56d3aa8234c)
  • ETW Microsoft.Windows.OLE.Clipboard (GUID: 3e0e3a92-b00b-4456-9dee-f40aba77f00e)
  • SilkETW or EDR with Win32k telemetry → Windows Event Forwarding

FP Rate: Medium

Use Case: On-host pre-execution detection; pairs with Sysmon EID 1 to confirm paste

Note: Requires SilkETW or compatible EDR; not available via standard Sysmon config

Detection Logic

Process: [any browser] writing to clipboard ClipboardContent contains: powershell, -enc, mshta, nslookup, cmd.exe, IEX, \\\\ (UNC)
Sigma Rule
View on GitHub Download 
title: Browser Process Writing Scripting Payload to Clipboard (ETW)
id: f3b8e2d1-7c4a-4b9e-a2f6-1d8e5c0b3a7f
status: experimental
description: >
  Detects browser processes writing PowerShell or command-interpreter keywords to the
  Windows clipboard via ETW (Microsoft-Windows-Win32k SetClipboardData events). This is
  the ClickFix chokepoint at the pre-execution layer — the clipboard write fires before
  the user pastes and executes the payload. Covers all ClickFix variants (ClickFix,
  FileFix, WebDAV ClickFix, Windows Terminal ClickFix, InstallFix, DNS-based ClickFix)
  because clipboard seeding is an inescapable prerequisite for the attack regardless of
  which paste target the lure page instructs the user to use.
references:
  - https://gist.github.com/mattifestation/04e8299d8bc97ef825affe733310f7bd
  - https://github.com/mandiant/SilkETW
  - https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape
  - https://attack.mitre.org/techniques/T1204/004/
author: "@iimp0ster"
date: 2026/03/10
tags:
  - attack.initial_access
  - attack.t1204.004
  - detection.maturity.hunt
  - detection.datasource.etw
logsource:
  product: windows
  category: clipboard
  # Requires ETW infrastructure. Two provider options:
  #   Microsoft-Windows-Win32k   GUID: 8c416c79-d49b-4f01-a467-e56d3aa8234c
  #   Microsoft.Windows.OLE.Clipboard  GUID: 3e0e3a92-b00b-4456-9dee-f40aba77f00e
  # Configure SilkETW (github.com/mandiant/SilkETW) with either provider and route
  # output to Windows Event Log or forward to SIEM via Windows Event Forwarding (WEF).
  # Field names below reflect SilkETW JSON serialization defaults — adjust to match
  # your ingestion pipeline's schema.
detection:
  selection_browser:
    ProcessName|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\iexplore.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\vivaldi.exe'
      - '\waterfox.exe'
  selection_payload_keywords:
    ClipboardContent|contains:
      - 'powershell'
      - '-EncodedCommand'
      - '-enc '
      - 'mshta'
      - 'nslookup'
      - 'cmd.exe'
      - 'wscript'
      - 'cscript'
      - 'IEX'
      - 'Invoke-Expression'
      - '\\\\'   # UNC path prefix — WebDAV ClickFix variant
  condition: selection_browser and selection_payload_keywords
falsepositives:
  - Developer tools or documentation sites that copy script examples to clipboard (rare
    match against these specific keywords in combination with a browser process)
  - Code snippet managers or password managers with keyboard shortcut triggers
level: high
Pre-Interaction — IOK Lure Page

Goal: Lure page combining a JavaScript Clipboard API write with a paste-into-shell instruction. The co-occurrence of these two elements is the invariant fingerprint of all ClickFix variants regardless of visual design, threat actor, or domain. Fires at the delivery layer, before the user interacts with the page.

Log Sources

  • Web proxy with JS/HTML content inspection
  • phish.report IOK community rule feed
  • URLScan.io live scan API

FP Rate: Low

Use Case: Proactive infrastructure blocking; phishing triage; threat intel enrichment

Detection Logic

js contains: navigator.clipboard.writeText OR navigator.clipboard.write OR ClipboardItem html contains: Win+R OR Run dialog OR Ctrl+V OR Windows Terminal OR Win+X OR address bar Condition: clipboard_api AND execution_hint
IOK Rule
View on GitHub Download 
title: ClickFix Lure Page — Clipboard API Write with Execution Instruction
description: >
  Detects ClickFix-family lure pages that combine a JavaScript Clipboard API write
  (navigator.clipboard.writeText / ClipboardItem) with instructions directing the user
  to paste into a Run dialog, Windows Terminal, File Explorer address bar, or similar
  execution context. The co-occurrence of clipboard seeding AND an execution instruction
  is the stable invariant across all ClickFix variants regardless of visual design,
  threat actor, or obfuscation technique. Covers: ClickFix (original), FileFix, WebDAV
  ClickFix, Windows Terminal ClickFix, InstallFix, DNS-based ClickFix, and future variants
  that have not yet been named.
tags:
  - clickfix
  - initial_access
  - t1204.004
references:
  - https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape
  - https://mrd0x.com/filefix-clickfix-alternative/
  - https://thehackernews.com/2026/03/microsoft-reveals-clickfix-campaign.html
  - https://attack.mitre.org/techniques/T1204/004/
  - https://phish.report/docs/iok-rule-reference
detection:
  clipboard_api:
    js|contains:
      - 'navigator.clipboard.writeText'
      - 'navigator.clipboard.write'
      - 'ClipboardItem'
  execution_hint:
    html|contains:
      - 'Win+R'
      - 'Windows key'
      - 'Run dialog'
      - 'Ctrl+V'
      - 'Windows Terminal'
      - 'Win+X'
      - 'address bar'
      - 'Ctrl+L'
  condition: clipboard_api and execution_hint
# ─── IOK Detection Notes ─────────────────────────────────────────────────────────
# Kill chain position: PRE-INTERACTION — fires against the lure page itself, before
# the user copies or executes anything. Earliest possible detection point.
#
# Why this condition is stable across all variants:
#   clipboard_api   — the browser MUST write the payload to the clipboard; without this
#                     the user cannot paste it. Cannot be removed without breaking the attack.
#   execution_hint  — the page MUST instruct the user where to paste; without this the
#                     user will not execute the payload. Cannot be removed without breaking
#                     the social engineering component.
#
# False positive profile:
#   clipboard_api alone → HIGH FP (widely used by legitimate sites for copy buttons)
#   execution_hint alone → LOW FP (paste-into-shell instructions are unusual on legit sites)
#   clipboard_api AND execution_hint → VERY LOW FP (near-unique to ClickFix)
#
# Evasion considerations:
#   - Obfuscated clipboard writes (e.g., atob() + eval(), string concatenation) evade
#     js|contains; add dom|contains matchers if your scanner supports post-JS rendering.
#   - Multilingual lures: add translated execution instructions for your threat landscape
#     (e.g., Japanese: 'を押して', Korean: '실행', etc.)
#   - Dynamically injected clipboard write (loaded from external JS) evades js|contains;
#     pair with requests|contains for known ClickFix JS CDN patterns.
#
# Usage:
#   - Submit to phish.report/IOK for community feed inclusion.
#   - Run against URLScan.io live scan API for proactive infrastructure hunting.
#   - Integrate with web proxy content inspection for real-time blocking.

OSINT Sources

URLScan (page.body:navigator.clipboard OR page.body:ClipboardItem) AND (page.title:*verify* OR page.title:*update* OR page.title:*captcha*)

Clipboard API presence anchored to deceptive page titles; retains cross-variant resilience while reducing false positives from clipboard API alone.

 URLScan page.body:"I am not a robot" AND page.body:navigator.clipboard

Fake CAPTCHA pages that write to the clipboard — the canonical ClickFix lure UI; high precision across Google reCAPTCHA and Cloudflare impersonation variants.

 URLScan page.body:navigator.clipboard AND (page.body:"Win+R" OR page.body:"Windows key" OR page.body:"Run dialog" OR page.body:"Ctrl+V")

Targets pages instructing users to open Run dialog or paste commands — the execution instruction unique to ClickFix and its variants.

 VirusTotal Intelligence behavior_processes:"nslookup.exe" tag:powershell

Requires VT Intelligence subscription; targets DNS-based ClickFix staging where nslookup retrieves the payload instead of direct HTTP download.

 VirusTotal Intelligence behavior_processes:"powershell.exe" behavior_command_line:"-enc" tag:dropper

Requires VT Intelligence subscription; finds encoded PowerShell droppers consistent with ClickFix payload obfuscation patterns.

Intel Resources

Related Chokepoints

Renamed RMM Tools HIGH Ransomware Service Manipulation CRITICAL