ClickFix / fake CAPTCHA
Fake error or CAPTCHA instructs the user to paste a clipboard command into Run or a terminal
categorySocial engineering and human-targeted attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab
Example: FileFix variant; Lumma, AsyncRAT
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
powershell -NoProfile -ExecutionPolicy Bypass -File C:\lab\clickfix-objective.ps1 -RunId <run-id>powershell -NoProfile -ExecutionPolicy Bypass -File C:\lab\clickfix-objective.ps1 -RunId run-2026-10-26-021powershell -NoProfile -ExecutionPolicy Bypass -File C:\lab\clickfix-objective.ps1 -RunId run-2026-10-26-022+ 2 more test variant(s) in the corpus.
What our lab measured
detected windows · 2026-10-27 · detected in 28s
What it looked like in telemetry
| Log source | What it means |
|---|---|
| Sysmon · EID 11 | Executable file created by powershell: C:\lab\clickfix-objective-run-2026-10-27-001.js |
| Sysmon · EID 11 | Executable file dropped in folder commonly used by malware |
| Security · EID 4624 | Non network or service local logon. |
| Security · EID 4634 | Non service account logged off. |
| Security · EID 4672 | Special privileges assigned to new logon. |
| Event · EID 4673 | Failed attempt to perform a privileged operation |
| Security · EID 4688 | A process was created. |
| Event · EID 8002 | Applocker: , according to rule Allow Everyone: %WINDIR%\*. |
| … and 1 more event type(s) | |
Detection that fired
- ✓ Wazuh
100321(level 8) lab rule — ClickFix prevention control engaged: AppLocker denied a script-host interpreter (mshta/wscript/cscript) in enforce mode (EID 8004) -- user-execution objective BLOCKED -- T1204.002
Plus 8 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~70904 incidental alerts/hour — tune against this.
partially detected windows · 2026-10-26 · detected in 31s
What it looked like in telemetry
| Log source | What it means |
|---|---|
| Sysmon · EID 1 | Access token manipulation: SYSTEM-integrity process created by a non-service parent |
| Event · EID 1001 | Summary event of the report's signatures. |
| Sysmon · EID 11 | Executable file created by powershell: C:\lab\clickfix-objective-run-2026-10-26-022.js |
| Sysmon · EID 11 | Executable file dropped in folder commonly used by malware |
| Event · EID 16384 | Software protection service scheduled successfully. |
| Security · EID 4624 | Non network or service local logon. |
| Security · EID 4634 | Non service account logged off. |
| Security · EID 4672 | Special privileges assigned to new logon. |
| … and 5 more event type(s) | |
Detection that fired
- ✓ Wazuh
100230(level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent
Plus 12 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~64330 incidental alerts/hour — tune against this.
Classification
31 values: 16 reviewed, 4 lab-measured, 10 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | |
|---|---|
| Reach (CVSS) | |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Active |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | High |
|---|---|
| Impact | AvailabilityConfidentialityIntegrity |
| Platform | LinuxmacOSWindows |
| Environment | CloudOn-premises |
| Target asset class | EndpointHuman |
| Kill-chain phase (tactic) | Execution |
| Remote support | No |
Detection & telemetry
| Detectability (measured in our lab) | Medium |
|---|---|
| Detectability (public detection content) | High |
| Noise level | High |
| Testability | Atomic Red Team testCustom lab test |
| Data sources (ATT&CK data components) | Command ExecutionFile CreationNetwork Connection CreationNetwork Traffic ContentProcess Creation |
Detection & response
Mitigated by 3
Detected by 9
- DET0340 attack-detection-strategy
3ae9974a-eb09-4044-8e70-8980a50c12c8sigma4fee3d51-8069-4a4c-a0f7-924fcaff2c70sigma7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9esigma8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7esigmab5b29e4e-31fa-4fdf-b058-296e7a1aa0c2sigmad487ed4a-fd24-436d-a0b2-f4e95f7b2635sigma100320wazuh100321wazuh
Tested by 1
cec8ad4e-0320-4984-a1ae-70ee398c9519atomic
Attack relationships
- Parent: Baiting
Lab findings
Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.
| Run | Outcome | Tool | Platform | Ran at |
|---|---|---|---|---|
run-2026-10-20-009 | partially-detected | atomic | windows | 2026-10-20 |
run-2026-10-26-021 | detected | other | windows | 2026-10-26 |
run-2026-10-26-022 | partially-detected | other | windows | 2026-10-26 |
run-2026-10-27-001 | detected | other | windows | 2026-10-27 |
run-2026-10-20-009— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1204.004 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=2776 max_level=15 dwell_s=90run-2026-10-26-021— Tier-A prevention A/B (lab/prevention/clickfix-run-box-experiment.md). Benign -- the probe only writes a run-scoped marker via a script interpreter. INTERPRETER = cscript (not mshta) for the measured A/B -- mshta's HTA/MSHTML engine writes nothing under the harness's non-interactive vmrun session (proven 2026-10-26), while cscript runs the same FSO one-liner headless and is denied by the SAME AppLocker control + matched by the SAME block rule 100321 ((mshta|wscript|cscript)\.exe); mshta stays the documented canonical lure for the human runbook. reached_rule 100320 (Application/ LabDetonation 9101) and block_rule 100321 (AppLocker EXE/DLL 8004) are LIVE on the manager (G2 deployed 2026-10-26, verified via the read-only API). Run with --prevention (OFF, operator applies the control + reboot, ON). The control bites only after a reboot (appid.sys caches policy at boot), so the A/B is OFF -> apply deny + reboot -> ON. G1 (live detonation) + G2 (deploy) human approval are BOTH required before a run (both granted 2026-10-26).; expected=1 incidental=1706 max_level=15 dwell_s=90run-2026-10-26-022— Tier-A prevention A/B (lab/prevention/clickfix-run-box-experiment.md). Benign -- the probe only writes a run-scoped marker via a script interpreter. INTERPRETER = cscript (not mshta) for the measured A/B -- mshta's HTA/MSHTML engine writes nothing under the harness's non-interactive vmrun session (proven 2026-10-26), while cscript runs the same FSO one-liner headless and is denied by the SAME AppLocker control + matched by the SAME block rule 100321 ((mshta|wscript|cscript)\.exe); mshta stays the documented canonical lure for the human runbook. reached_rule 100320 (Application/ LabDetonation 9101) and block_rule 100321 (AppLocker EXE/DLL 8004) are LIVE on the manager (G2 deployed 2026-10-26, verified via the read-only API). Run with --prevention (OFF, operator applies the control + reboot, ON). The control bites only after a reboot (appid.sys caches policy at boot), so the A/B is OFF -> apply deny + reboot -> ON. G1 (live detonation) + G2 (deploy) human approval are BOTH required before a run (both granted 2026-10-26).; expected=0 incidental=1644 max_level=15 dwell_s=90run-2026-10-27-001— Tier-A prevention A/B (lab/prevention/clickfix-run-box-experiment.md). Benign -- the probe only writes a run-scoped marker via a script interpreter. INTERPRETER = cscript (not mshta) for the measured A/B -- mshta's HTA/MSHTML engine writes nothing under the harness's non-interactive vmrun session (proven 2026-10-26), while cscript runs the same FSO one-liner headless and is denied by the SAME AppLocker control + matched by the SAME block rule 100321 ((mshta|wscript|cscript)\.exe); mshta stays the documented canonical lure for the human runbook. reached_rule 100320 (Application/ LabDetonation 9101) and block_rule 100321 (AppLocker EXE/DLL 8004) are LIVE on the manager (G2 deployed 2026-10-26, verified via the read-only API). Run with --prevention (OFF, operator applies the control + reboot, ON). The control bites only after a reboot (appid.sys caches policy at boot), so the A/B is OFF -> apply deny + reboot -> ON. G1 (live detonation) + G2 (deploy) human approval are BOTH required before a run (both granted 2026-10-26).; expected=1 incidental=1812 max_level=15 dwell_s=90
Framework references
- Primary source: https://attack.mitre.org/techniques/T1204/004/
- attack: T1204.004 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Social engineering and human-targeted attacks' table, line 49 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 5 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0003 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-009 (partially-detected) for T1204.004: no alert matched the expected technique
- ev-0004 (Phase 4 detection lab - detonation runs 2026-10-26) — Lab detonation run-2026-10-26-021 (detected): Wazuh rule(s) 100320 fired on T1204.002 within the detonation window
ClickFix prevention A/B: user-execution objective REACHED -- the script interpreter ran and the benign probe emitted its success event (control OFF / not prevented) -- T1204.002
- ev-0005 (Phase 4 detection lab - detonation runs 2026-10-26) — Lab detonation run-2026-10-26-022 (partially-detected) for T1204.002: no alert matched the expected technique
- ev-0006 (Phase 4 detection lab - detonation runs 2026-10-27) — Lab detonation run-2026-10-27-001 (detected): Wazuh rule(s) 100321 fired on T1204.002 within the detonation window
ClickFix prevention control engaged: AppLocker denied a script-host interpreter (mshta/wscript/cscript) in enforce mode (EID 8004) -- user-execution objective BLOCKED -- T1204.002